Stepfully · three-family pilot
Your family’s information.
Operator contact: Ask the parent who invited you for the pilot operator’s contact details.
Notice version: pilot-1 · Selected optional AI processor: OpenAI, using an approved Zero Data Retention arrangement. Processing remains off without the required approvals and consent.
Parents create family accounts. Child devices use a nickname and an age band. We do not ask for a diagnosis, birth date, school, location, microphone access, or medical history. There are no ads, public profiles, or child chatbots.
Your choices
Routine tracking requires verified CORE consent before pairing. PHOTO and AI are separately optional. A parent returns a signed consent form; the operator reviews it. The camera permission prompt and app checkboxes are not the consent verification method. Families can use routines without photos and photo review without AI.
Task pictures
A picture can show what is visible at a moment. It cannot prove who did the task, honesty, or effort. Photo checking is limited to a bed, desk, toys, or items ready for a backpack. Keep people, mirrors, documents, and private spaces outside the frame.
Pictures are cropped/resized, re-encoded to remove metadata, encrypted, and kept in private storage. Task photos expire 72 hours after server receipt, or sooner when a parent finishes review, replaces a submitted attempt, withdraws photo consent, or requests deletion. AI confirmation by itself keeps the photo available for the parent until expiry. Unattached uploads expire after one hour. References remain only while used by an active task.
Optional AI
The default is parent review. Cloud evaluation receives the two task images and visible criteria; no child name, diagnosis, family identity, account tokens, points, or task history is included. OpenAI evaluation requires a documented approved Zero Data Retention arrangement for the actual account, project, image endpoint, model, and age band. Setting store=false alone is insufficient. Potential child sexual abuse material can still be retained for safety review under the provider’s documented exception. Photos are not authorized for general model training.
The experimental OpenRouter/Parasail route is for adult-staged or synthetic evaluation by default. Its standard terms exclude under-13 personal information. An overriding documented arrangement and a new notice/consent review would be needed to enable that route for such children. The local evaluation experiment runs only on an operator’s device; its images and results are not uploaded.
AI has a clear-match result and an “I can’t tell” result. Uncertainty goes to a parent, without a penalty. Parents can correct decisions. Raw AI text is not shown to children.
Who receives information
Parents in your family can review task records and permitted task photos. The pilot operator can verify consent proof and manage operational settings; that role does not grant access to another family’s task pictures. A parent can explicitly grant support access to one task image, which expires with that image and can be revoked. Production hosting uses Railway application hosting, PostgreSQL, and private object storage. Browser/OS push services receive generic notification messages and subscription identifiers. Cloud AI is disclosed separately above and remains disabled until its activation conditions are met.
Retention and deletion
- New phone task history, assessment metadata, and settled ledger detail: 180 days. Current balances, inventory, and still-owed rewards remain separately.
- Inbox: 30 days. Expired sessions and content-free delivery logs: 30 days.
- Signed consent proof: while a grant is in use, then 90 days, unless erasure is requested.
- PostgreSQL backups: configure a seven-day rolling retention. Raw task images are not stored in database backups. Deletion markers must be reapplied before a restore serves users.
- Existing e-ink history is preserved by the phone migration. Explicit child erasure also removes that history.
Parents can export records, withdraw CORE, PHOTO, or AI, revoke phones, and request deletion in Phone pilot → Privacy. CORE withdrawal revokes online child access immediately. Child erasure targets completion within 24 hours; the app shows pending until physical storage deletion succeeds.
A disconnected phone may retain its authorized cached view for up to 72 hours after its last sync. Local unuploaded photos become unusable after 72 hours and are cleared when the app next runs, or when upload and submission are acknowledged. A suspended browser cannot run a timed erasure job. Forget this device clears its local app data. The fallback camera app may save an original to the gallery; the PWA cannot erase that separate original. A photo already sent to a provider cannot be unsent.
A companion without pressure
Task submissions grow the pet or plant. Basic care is always free. Missed days cause no decay, illness, death, or lost streak rewards. Optional decorations spend existing points only; time rewards stay minutes.