Security
Last updated October 26, 2026
Draft. Kinovi is in a small, invite-only test. A privacy lawyer reviews these pages before Kinovi opens to everyone. Words marked in yellow are not final yet.
This follows the COPPA security rule (16 CFR 312.8).
| Item | What we do |
|---|---|
| Named lead | The founder is the security and privacy lead |
| Yearly risk check | A written review every year, and after big changes |
| Testing | Regular checks of sign-in, PIN, uploads and the sandbox |
| Encryption | HTTPS everywhere. Backups and parent AI keys are locked (encrypted). |
| Passwords and PINs | Stored only as strong scrambled hashes, with limits on tries |
| Least access | Only the site admin can reach the server. Two-step sign-in on hosting, code and email. |
| Vendors | Written agreements, checked every year |
| Backups | Locked, kept off the server, and test-restored |
| Hosting | We use shared hosting, and keep the app and its data in a private folder |
| Standards | We follow the NIST Cybersecurity Framework |
If something goes wrong
We find the problem, stop it, fix it, then tell affected grown-ups (and state officials where the law asks) without delay. Our target is within 72 hours of confirming a breach.
Report a security problem
Found a security problem? Please write to security@kinovi.kids. We will not take legal action against good-faith research that respects kids' privacy, does not touch other people's data, and gives us time to fix the problem. Our security.txt has the details.