Privacy Policy

1. Overview and Scope

Konvoo is designed for speech-language pathologists, educators, caregivers, and other adults. Accounts, subscriptions, uploads, and the AI planner are for people aged 18 or older. Children may play the games only under direct adult supervision and should never operate an account, subscription, upload, or planner feature.

Our Terms and Conditions explain account responsibilities and permitted use of Konvoo.

This Policy covers information handled through Konvoo. When you follow a link to another service, such as YouTube, that service's own privacy terms apply.

2. Information We Handle Now

Information Stored in Your Browser

Konvoo stores the following information on your device:

• Session storage: planner forms, draft and finalized plans, local clinician notes, conversations, game setup preferences, a copy of any shared plan you start playing, your place in the sample session plan, and navigation state are saved for the current browser-tab session.
• Local storage: your sound-effects preference, prerecorded reader-voice preference, and which tours you have seen (the session plan panel, game, and site tours) are saved in this browser profile until you change or clear them or clear browser data. If you choose to save a copy of a shared plan before logging in, its link is remembered for up to 24 hours so you can return to it.
• IndexedDB: files that an adult attaches to a session plan are saved locally in the browser until deleted in Konvoo or cleared from the browser.

Local planner attachments are not uploaded to Konvoo or sent to Mistral. Information stored on a shared device may be available to another person who uses the same browser profile.

AI Planner Submissions

When you select Generate plan, Konvoo sends your goals, interests, session length, and custom planning instructions through a same-origin Vercel Function to Mistral AI. When you send a conversation message, it also sends a limited activity schedule and recent conversation so Mistral can explain activities or propose edits. Conversation requests exclude local clinician notes, game setup preferences, and attachment contents, identifiers, and filenames. Konvoo does not intentionally write planner text to its application logs. Your planner form and AI conversation are not saved to your account. A finished plan is saved to your account only when you select Save to My Plans, as described below.

Under Mistral's current API documentation, API input and output are not used to train its models. Mistral may retain input and output for up to 30 rolling days for abuse monitoring unless Zero Data Retention is active for Konvoo's account. See Mistral's privacy controls and Zero Data Retention documentation.

Create Words and Pictures

When a verified adult makes a picture, Konvoo sends the word, the chosen style, and any extra detail through a same-origin Vercel Function to OpenAI, which returns the picture. When an adult selects AI Suggest, Konvoo sends the target sound, word count, and optional theme to Mistral, which returns suggested words. Konvoo does not write these words or details to its application logs.

Under OpenAI's current API documentation, API data is not used to train its models, and abuse-monitoring logs may be retained for up to 30 days. See OpenAI's data controls documentation. Mistral's retention terms are described under AI Planner Submissions above.

Konvoo stores each run's title, mode, style, target sound, and chosen game, each picture's word and image files, and each word list in your account in Supabase. Pictures and lists are private until an administrator approves them for everyone; administrators can see everything generated, with the creator's username. Approved pictures and lists become visible to all Konvoo players without the creator's name. Picture request-limit events contain an account identifier, action, and timestamp, and are removed after one day. Deleting your account removes your private pictures, runs, and lists; items already approved for everyone remain without any link to your account.

Accounts and Cloud Data

Verified users may explicitly save private Tic-Tac-Toe board templates to Supabase. These contain a board title, words or prompts, built-in question references, board size, and support settings. Saved templates include revision and update timestamps. They do not include game turns, spoken responses, or recordings. Templates remain until you delete them or delete your account, and they are included when you request a copy of your account data. Uploading a board file reads it locally and does not save it to your account unless you choose Save board. Never put patient names or identifying information in a board title, prompt, or file name.

Verified users may explicitly save private Conversation Spinner topics to Supabase. A topic contains a topic name, an icon choice, and 2 to 20 questions the adult writes, with revision and update timestamps. Topics do not include answers, spoken responses, or recordings. Topics remain until you delete them or delete your account, and they are included when you request a copy of your account data. Never put patient names or identifying information in a topic name or question.

Pizza Recipes and Public Gallery

Saving a pizza recipe stores its title, editable ingredients, placement, and generated images privately in your account. Publishing makes the title, pizza image, ingredient list, gallery pen name, and remix relationship publicly viewable. Verified adults can open the editable recipe and save independent copies. Publication is immediate; there is no pre-publication review. Do not include child names or identifying information in titles or pen names.

Recipe favorites are private. Likes display aggregate counts without identifying the adults who liked a recipe. Unpublishing stops new public access through Konvoo, but cannot recall copies already downloaded or saved by others. Deleting a recipe or your account removes your recipe images and attribution; other adults’ independently saved remixes remain. Administrators can withdraw published recipes.

A pizza held during login stays temporarily in this browser tab for up to one hour and is cleared when restored or canceled. This temporary copy is not a cloud save. Gallery write-limit events contain an account identifier, action, and timestamp, and are removed after one day when the next gallery write is processed.

Supabase processes an adult account's email address, password-authentication records, sign-in tokens, account identifier, email-confirmation status, current and former usernames, and security timestamps. Former usernames remain reserved to the account until it is deleted. Resend delivers transactional authentication messages, including email-verification, one-time sign-in, and password-recovery messages.

Verified users may explicitly save word-set titles and word/emoji entries to Supabase. Sets are private to their owner unless the owner grants editable access to another verified account or creates a single-use invitation link. Collaborators can view and edit the set; owners can revoke them, and editors can leave. Never put patient identifiers in a username or word set.

Verified users may choose to save a finished session plan with Save to My Plans. A saved plan contains its title, optional description, session length, and each activity's type, title, section label, timing, notes, the AI's reason for suggesting it, and game setup, including word lists. Attached files stay on your device; a saved plan records only each file's name, type, and size. Saved plans are private to their owner.

The owner of a saved plan may create an unlisted link to it. Anyone who has the link can open the plan and play its activities without an account, and search engines are asked not to index it. The link shows the plan's title, description, activities, timing, game setups including word lists, section titles, web links, and the owner's username. Notes and the AI's reasons appear only if the owner selects Include my notes. Attached files are never included. The link always shows the latest saved version of the plan. The owner can stop sharing or replace the link at any time; deleting the plan or the account also turns the link off. People who open a shared link can save their own copy to their account. Never include patient names or identifying information in a plan you save or share.

Request a Game Board

Verified users may post requests for new games or features, upvote requests, comment on requests, reply to and upvote comments, and report requests to Konvoo administrators. A request contains a type (game or feature), a title, optional details, your current username, its status, and its vote count. Anyone who visits the board, including visitors without an account, can read visible requests and the username that posted them. Your email address is never shown. A comment contains its text, your current username, the request it belongs to, the comment it replies to, if any, and its vote count. Changing your username also changes the name shown on your existing requests and comments. Anyone who visits the board can read visible comments and the username that posted them. Konvoo stores which requests and comments you upvoted so you can remove a vote, but other users see only the total. Reports, including their optional note, are visible only to Konvoo administrators, and the person who posted a request is not told who reported it. Never put patient names or identifying information in a request, detail, comment, or report note.

Verified users may also save a private ordered favorite-game library. The library includes game IDs, user-created group labels, each group's ordering, website theme and Matilda or Chris reader-voice preference, and the last selected group. Groups begin with anonymous labels such as “Group 1.” If you rename one, do not use a patient name or any other identifying information.

Usage Analytics

When usage collection is enabled, Konvoo records the first finalization of a newly generated session plan, its selected public game IDs, game starts, and estimated visible play time. Finalizing again or editing, opening, or copying an existing plan does not count as another finalization. A game start is recorded after setup is accepted or the first meaningful interaction in a game without setup; replay starts a new play. Administrators can also see counts of currently saved plans and the games included in them, separately from finalization events.

Signed-in usage is linked to the adult's account identifier. Authorized Konvoo administrators can view account usage alongside the adult's current username and email address. Guest game usage has a random identifier and temporary delivery token for each play, with no persistent guest profile or count of unique guest users. Guest play records contain a game ID, timestamps, and credited time. Playing from a shared plan is attributed to the viewer's account or guest play, never to the plan owner. Shared-link identifiers are excluded from usage events.

Visible play time estimates how long a game remains visible in an active play state. Setup, hidden tabs, help, explicit pauses, and completion screens suspend timing. Device sleep and delivery failures can reduce the recorded time. These estimates do not establish attention, participation, speech ability, or clinical progress.

Usage events contain identifiers, game IDs, account or guest status, administrator status, timestamps, counts, and duration. They exclude planner text, clinician notes, word lists, attachments, spoken responses, recordings, and clinical results. A random plan identifier is kept with the draft in browser session storage to prevent duplicate finalization counts. Per-play delivery tokens stay in memory; the server stores only their hashes, and they expire after 12 hours. For abuse prevention, the collector processes the request's IP address into a keyed hourly counter; it does not store the raw IP address in analytics tables.

Konvoo uses these records to understand use of planning and game features, prioritize improvements, maintain the service, and investigate delivery problems or abuse. Authorized administrators can view detailed usage reports; those reports exclude administrator activity by default. Public game tiles show the total number of recorded starts for each game since collection began. These totals include guest, signed-in, and administrator plays, and visitors can sort All Games by that total. Public counts do not reveal accounts, guests, session records, or play time. Vercel handles collection requests and Supabase stores the records. Account-linked usage is personal information.

Technical and Operational Information

Konvoo and its hosting provider may process IP address, approximate city or country derived from IP address, browser and device type, request path, date and time, response status, diagnostics, and security information to deliver the service, prevent abuse, investigate failures, and protect Konvoo. Planner application logs may also contain a request identifier, outcome, duration, and provider response status, but not the planner text itself.

On public pages, Vercel Speed Insights collects page loading and interaction timing, the public page path, and general browser, device, network, and country information. Konvoo removes query strings and fragments from reported URLs and excludes private and unknown pages from these reports. These measurements are not linked to an account or used to assess speech ability.

External Videos

Konvoo uses locally hosted video thumbnails. When you play a video from a session plan, Konvoo shows it in YouTube's privacy-enhanced player (youtube-nocookie.com). Your browser connects to YouTube when that player loads, and YouTube receives your IP address and browser information. Video links elsewhere in Konvoo open YouTube directly. In both cases, Google's Privacy Policy applies to YouTube.

The About page embeds the founder’s Instagram video. When the embedded player loads, your browser connects to Instagram, which receives your IP address and browser information even before you play the video. Instagram’s Privacy Policy applies to the embedded player.

3. Information Future Subscription Features May Collect

Konvoo does not currently offer paid subscriptions. If billing launches, we expect to handle:

• Subscriptions and payments: subscription plan and status, invoice and transaction records, and payment-processor customer or transaction identifiers. A payment processor will collect full card details directly; Konvoo will not store full payment-card numbers.
• Email communications: billing and service messages. Marketing email will require separate consent and will include an unsubscribe option.

We will update this Policy and provide notice at or before collecting payment information, including the identity of the payment provider.

4. How and Why We Use Information

We use information only as reasonably necessary to provide requested features, generate planner options, remember settings, authenticate adults, administer subscriptions, process payments, communicate about the service, secure and troubleshoot Konvoo, comply with law, and protect our users and rights.

Where data-protection law requires a lawful basis, we generally rely on:

• Contract: to provide features, accounts, and subscriptions an adult requests.
• Legitimate interests: to secure, maintain, and troubleshoot Konvoo, and to understand use of planning and game features and prioritize improvements, where these interests are not overridden by individual rights.
• Consent: for optional marketing communications, which may be withdrawn at any time.
• Legal obligations: for tax, accounting, fraud-prevention, and legally required disclosures.

Konvoo does not sell personal information, share it for cross-context behavioral advertising, use behavioral advertising, or make decisions that produce legal or similarly significant effects through automated processing.

5. Patient Data, Health Information, and Your Responsibility

Konvoo is not an electronic health record, patient-record system, or medical-record repository. Konvoo is not represented as HIPAA compliant and does not offer a Business Associate Agreement. Do not use Konvoo to create or maintain a patient record or to transmit protected health information or student education records.

Never enter patient names, dates of birth, street addresses, school or student identifiers, medical-record numbers, insurance information, contact details, photographs, voice or video recordings, or identifying file names. This applies to every field, favorite-group label, custom word or word set, Conversation Spinner topic or question, plan section, attachment, AI planner prompt, and Request a Game post, comment, or report.

You are responsible for having authority to use the information you submit, removing identifiers before entry, and ensuring that submitted content follows applicable professional, workplace, school, and legal requirements. Konvoo does not review or screen every submission for identifiers. If you submit identifying information accidentally, it may be processed as described in this Policy; contact us promptly about server-side deletion options and remove any locally stored copy from your browser.

6. Children's Privacy

Konvoo's games are pediatric, but all data-entry and commercial features are adult-operated. Adults operate game sessions, and children may participate in game interactions under direct adult supervision. Usage analytics can record those sessions, linked to the signed-in adult or to a guest play. Konvoo does not create analytics profiles for individual child participants. Children must not create an account, provide an email address, make a payment, submit planner text, upload a file, or otherwise provide personal information.

The games do not ask children for names, contact information, photographs, recordings, or precise location, and Konvoo does not use advertising trackers. Hosting providers may process limited technical identifiers as needed to deliver and secure the service.

If you are a parent or guardian and believe a child supplied personal information to Konvoo, email privacy@konvoospeech.com. We may ask for limited information to verify the request, and we will review, delete, or stop further collection of the child's information as required by applicable law.

7. Service Providers and Other Disclosures

We may disclose information only as needed to:

• Mistral AI: process planner text and return AI-generated session options.
• Supabase: provide adult authentication, database hosting, access control, and account deletion.
• Resend: deliver transactional authentication, verification, and recovery emails.
• Vercel: host, deliver, secure, and provide operational logging for Konvoo. See Vercel's Privacy Notice.
• Visitors to the Request a Game board: can read the requests and comments you post, your username, and each request's and comment's vote count, and each request's status. Administrators can see reports, hide or merge requests, and remove comments.
• Other users you choose: receive editable access to a word set when you share it by exact username, verified account email, or a single-use invitation link. A failed nonmember email lookup is not retained or emailed.
• Future service providers: provide subscriptions, payment processing, customer support, security, and professional services when those features launch.
• Authorities or affected parties: comply with law, legal process, or valid government requests; investigate fraud or security incidents; or protect the rights, safety, and integrity of Konvoo, its users, or others.
• A successor organization: support a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.

Providers may process information in the United States, European Union, or other locations where they operate. Where required, we will use recognized safeguards for international transfers, such as adequacy decisions or contractual protections.

8. Retention

• Browser data: planner session storage generally ends with the browser-tab session; preferences in local storage remain until changed or cleared; IndexedDB attachments remain until an adult deletes them or clears browser data.
• Planner processing: Konvoo does not intentionally retain planner text in its application logs, and planner forms and AI conversations are not saved to accounts. Plans you save to your account are retained as described below. Mistral may retain API input and output for up to 30 rolling days unless Zero Data Retention is active.
• Operational logs: Konvoo application logs are retained for no more than 30 days, depending on the hosting plan, unless a security investigation or legal requirement requires longer.
• Accounts, cloud sets, game libraries, saved plans, and Request a Game posts: retained while the account is active or until you delete them. Account deletion immediately removes live account data, favorite libraries, owned word sets, collaborations, invitations, saved session plans and their shared links, Conversation Spinner topics, Request a Game posts, comments, votes, and reports, and rate events. Copies that other accounts saved from a shared link belong to those accounts. Other users' votes and comments on a deleted post are removed with it, as are replies to your deleted comments. Managed backup copies expire under Supabase's documented backup-retention window.
• Request a Game posts: visible on the board until you withdraw them, an administrator hides them, or you delete your account. Withdrawn and hidden posts stay in the database, visible only to you and administrators, until you delete your account.
• Request a Game comments: visible on the request until you delete them, an administrator removes them, the request is hidden, or you delete your account. Deleted and removed comments, and replies to them, are hidden from the board but stay in the database, visible only to administrators, until you delete your account.
• Abuse-control metadata: planner and exact account-lookup events contain user ID, time, and outcome metadata only and are lazily deleted after 24 hours. Request a Game posting, commenting, and reporting limits store user ID, action, and time only and are lazily deleted after 25 hours. Planner prompts, results, searched identity values, and request text are not stored in these events.
• Invitation links: expire after seven days and become unusable after claim or revocation. Only a SHA-256 hash of the random link token is stored.
• Future billing records: retained for up to seven years where needed for accounting, tax, chargeback, fraud-prevention, or legal obligations.
• Support correspondence: retained for up to two years unless a longer period is reasonably needed for a dispute, security matter, or legal requirement.

Usage analytics: individual play records, including delivery-token hashes, are retained for 30 days. Account-linked finalization records and daily account summaries are retained for 12 months. A daily cleanup job removes records after these periods and removes abuse counters whose one-hour validity has expired; deletion occurs on the next successful cleanup. Daily aggregate totals without account identifiers and unlinked hashes used to prevent duplicate events have no scheduled expiry. The duplicate-prevention hashes contain no account, game, or timestamp. The date collection first succeeded is also retained.

Deleting your account removes its linked finalization records, play records, and daily summaries. Aggregate totals and unlinked duplicate-prevention hashes remain. Guest play records cannot be included in a copy of your account data or removed through account deletion because they are not linked to an account; they expire through scheduled cleanup.

We may retain information longer when required by law, necessary to establish or defend legal claims, or needed to address fraud or security incidents. When possible, we will delete or de-identify information when it is no longer needed.

9. Security

Konvoo uses administrative, technical, and organizational safeguards appropriate to the information handled, including verified accounts, row-level database access controls, encrypted network connections, restrictive browser security policies, minimized application logging, one-way invitation-token hashes, and limits on collection. No online service can guarantee absolute security. Use a unique password, protect sign-in links, and clear local data on shared devices.

10. Your Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; object to or restrict certain processing; withdraw consent; opt out of a sale or sharing; and appeal or complain to a privacy regulator. Konvoo will not discriminate against you for exercising a privacy right.

Konvoo does not sell or share personal information for behavioral advertising, so there is currently no sale or sharing to opt out of. We will honor applicable browser-based opt-out signals if our practices change in a way that requires them.

To request a copy of your account data, email privacy@konvoospeech.com. The copy includes your current and former usernames, favorite-game library, saved session plans, Conversation Spinner topics, retained account-linked usage metadata (finalizations, play records, and daily summaries), pizza recipes, gallery pen name, recipe favorites and likes, and Request a Game posts, comments, votes, and reports. You can permanently delete your account from the account page. Deletion requires explicit confirmation. If you want a copy, request it before deleting, because deleting an owner also removes sets shared with editors. Send other privacy requests to the same address. We may request information reasonably necessary to verify your identity or authority.

Browser-only information is not accessible to Konvoo. You can choose the device-data clearing option during account deletion, or use your browser's site-data controls.

11. Changes to This Policy

We may update this Policy when Konvoo's features, providers, or legal obligations change. We will change the effective date and provide additional notice when a change is material. We will provide notice at or before collection before launching subscription or payment features described above.

12. Contact

Konvoo Speech is the operator responsible for this Policy. Questions, privacy requests, and parent or guardian inquiries may be sent to privacy@konvoospeech.com.

This Policy is intended to explain Konvoo's practices clearly. It is not a substitute for jurisdiction-specific legal advice to a healthcare practice, school, or other organization using the service.