INFORMATION SECURITY POLICY

Effective Date: 04/02/2026 | Last Updated: 09/27/2026

App Name: RegulateMe | Website: regulateme.app | Contact: privacy@regulateme.app

1. Purpose

This document describes the information security program maintained by RegulateMe to protect children's personal information collected through the RegulateMe application, as required by the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments.

2. Data We Protect

RegulateMe collects and protects the following categories of personal information:

  • Parent account information: email address, display name, authentication credentials (hashed)
  • Child information: first name or nickname, avatar selection (entered by parent)
  • Activity data: goal completions, points, streaks, reward redemptions, mood scores, context tags, ABC behavior logs, sensory and cool-down activity usage
  • Local-first data: drawings and current Feelings Journal entries stored locally on this device; older server-synced Feelings Journal rows, if present, remain protected by family-scoped database access controls
  • Preference data: avatar selection, color themes, sensory settings, mood reminder preferences
  • Consent records: timestamps, verification method, IP address, user agent (retained for legal compliance)
  • Technical request data: Browser type, operating system, IP address and approximate location inferred from it (city, region, country and postal code), session and account identifiers, request timing, errors, and connection characteristics. We use these operational logs for security, troubleshooting and service performance, not advertising.

For a complete description of what we collect and how we use it, see our Privacy Policy at /privacy.

3. Encryption & Data Protection

All data transmitted between your device and our servers is encrypted using TLS 1.2+ (Transport Layer Security) via HTTPS. All data stored in our database is encrypted at rest using AES-256 encryption provided by our infrastructure provider, Supabase. Database backups are also encrypted at rest.

4. Authentication & Access Control

  • Parent accounts are protected by email-based authentication with secure session management provided by Supabase Auth.
  • Parent Mode is additionally protected by a 4-digit PIN, which is bcrypt-hashed server-side and never stored in plaintext.
  • COPPA consent verification codes are bcrypt-hashed, expire after 15 minutes, and are rate-limited to one request per 60 seconds.
  • All database tables containing child data are protected by Row-Level Security (RLS) policies that restrict data access to authenticated family members only, enforced via the is_family_member() database function.
  • Administrative database access uses a service role key restricted to server-side edge functions and never exposed to client-side code.
  • The application enforces strict security headers including X-Frame-Options DENY and restrictive Permissions-Policy (no camera, microphone, or geolocation access).

5. Third-Party Service Providers

We use the following third-party service providers for limited operational purposes and restrict the data sent to each provider to what is needed for the listed service:

  • Supabase, Inc. (Database, Authentication & Serverless Functions) - SOC 2 Type II certified. All application data, including children's personal information, is stored and processed within Supabase's infrastructure.
  • Vercel, Inc. (Web Hosting & CDN) - SOC 2 Type II certified. Serves the application and processes standard web request metadata. Does not store personal data from the application.
  • Stripe, Inc. (Payment Processing) - PCI DSS Level 1 certified. Processes subscription payments for parent accounts only. Stripe receives parent email address for billing purposes but does not receive children's personal information or activity data.
  • Apple App Store and Google Play (Native Subscription Billing) - Process native subscriptions through the store account on the device.
  • RevenueCat, Inc. (Subscription Entitlement, Receipt Processing and Analytics) - Processes native subscription receipt status, parent billing identifiers, and purchase history to unlock Premium, prevent billing fraud, and provide subscription analytics. RevenueCat receives no child activity data.
  • Resend, Inc. (Transactional Email) - SOC 2 Type II certified. Used exclusively for sending verification codes and notifications to parent email addresses. Resend does not receive children's personal information.

No other third-party services receive or process children's personal information. RevenueCat provides subscription analytics using parent billing data; child activity is not sent to RevenueCat. We do not use advertising SDKs, social media integrations, or technologies that track users across other apps and websites for advertising.

6. Data Minimization

We collect only the minimum data necessary to provide the RegulateMe service. We do not collect precise geolocation, contact lists, photographs (except user-created drawings stored locally on the device and never uploaded), audio or video recordings, or any data not directly related to goal tracking, mood monitoring, and emotional regulation features. We do not serve advertisements, sell data, or use children's data to train machine learning models.

7. Data Retention & Deletion

Active accounts: Data is retained for the duration of an active subscription.

Parent-initiated deletion: Parents may delete all child data stored in their RegulateMe account at any time through Privacy & Data in Parent Settings, or by emailing privacy@regulateme.app. Active child data stored in the account is deleted immediately when the deletion runs.

Consent revocation: Revoking parental consent immediately triggers deletion of active child data stored in the RegulateMe account.

Inactive accounts: Child data stored in unsubscribed RegulateMe accounts with no sign-in activity for 60 consecutive days is automatically purged.

Local-only data: A successful in-app child-data deletion or consent revocation clears drawings and current Feelings Journal entries from the device where the action is completed. Copies on other devices, and local copies remaining after server-side 60-day cleanup, cannot be remotely erased and must be cleared on those devices.

Completion-email delivery: After account deletion, one encrypted copy of the parent delivery email may remain in a restricted dispatch queue solely to send or retry the confirmation. It contains no child data and is deleted once provider acceptance is confirmed and recorded, or automatically after no more than 7 days.

Deletion completion evidence: We retain only a minimized, non-identifying record containing an opaque event reference, deletion method, subject count, outcome, completion time, and expiry time. It is retained for no more than 90 days and automatically purged by a daily retention job.

Consent audit records: Retained while the parent account exists to document and manage consent. Full account deletion removes the records, including their IP addresses and browser information. Child-data deletion alone preserves the parent account and consent history.

For complete details, see Section 7 of our Privacy Policy at /privacy.

8. Parental Rights Under COPPA

Parents and legal guardians have the following rights regarding their child's personal information:

  • Access: Review all personal information collected about your child, including a full data export (available in Privacy & Data settings or by request).
  • Deletion: Request deletion of all personal information about your child stored in the RegulateMe account at any time.
  • Withdraw consent: Revoke your COPPA consent at any time, which immediately deletes child data stored in the RegulateMe account and suspends child features until consent is re-verified.
  • Refuse further collection: You may refuse to allow further collection of your child's information. Existing account-stored child data will be deleted upon consent revocation, and a successful in-app revocation clears local-only child data from the device where the action is completed. Copies on other devices must be cleared there.
  • Non-discrimination: Your child's access to app features will not be conditioned on providing more personal information than is reasonably necessary.

We commit to responding to all parental data requests within 5 business days of receipt. To exercise any of these rights, contact us at privacy@regulateme.app or through the Privacy & Data section in Parent Settings.

9. Incident Response & Breach Notification

In the event of a suspected or confirmed security breach involving children's personal information:

  • Immediate investigation: The incident will be investigated and contained as quickly as possible.
  • Parent notification: Affected parents will be notified by email without unreasonable delay, and no later than 30 days after confirmation of the breach, consistent with applicable state breach notification laws and COPPA requirements.
  • FTC notification: The Federal Trade Commission will be notified if the breach involves children's personal information protected under COPPA, or if the breach affects 500 or more individuals.
  • Remediation: A post-incident review will be conducted to identify the root cause and implement measures to prevent recurrence.
  • Transparency: Breach notifications will include a description of the incident, the types of information involved, and steps being taken in response.

10. Operator Access

RegulateMe is operated by Brian Hukee as a sole proprietor. No employees, contractors, or third parties have direct access to the production database, user credentials, or children's personal information beyond what is accessible through the third-party service providers listed in Section 5.

11. Review Schedule

This information security program is reviewed at least annually, or whenever a material change occurs to the application's data collection practices, infrastructure, or third-party service providers. The date of the most recent review is reflected in the "Last Updated" date at the top of this document.

12. Contact Information

Questions or concerns about this security policy:

Email: privacy@regulateme.app

Mailing address: 4809 Harvest Moon Ct, Summerville, SC 29485

Phone: (843) 606-0404

To exercise your parental data rights or report a security concern, please contact us at the email above. We commit to acknowledging all inquiries within 5 business days.

This Information Security Policy should be read in conjunction with our Privacy Policy (/privacy) and Terms of Service (/terms).