← GoRegulate home
Privacy Policy
Your family's trust is the whole point.
GoRegulate helps neurodivergent children find calm, communicate, and thrive. That only works if parents, caregivers, and therapists can trust us with sensitive information. This policy explains — in plain language — what we collect, why, and the control you have over it.
Effective date: August 12, 2026 · Applies to the GoRegulate app (iPhone, iPad and Android) and goregulate.ca · Operated by GoRegulate, British Columbia, Canada
Our commitments, up front
- We never sell personal information — anyone's, and especially not a child's.
- No advertising in the app. No third-party advertising or ad-tracking SDKs. No behavioural profiling for marketing.
- Children's data is collected only with verifiable parent, guardian, or authorized-therapist consent.
- You can view, export, correct, or permanently delete your data at any time.
- All data is encrypted in transit and at rest, with per-account access controls.
Contents
- Who we are & scope
- Children's privacy
- Information we collect
- How we use information
- What we never do
- Sharing & service providers
- Health information & HIPAA
- How we protect your data
- Data retention
- Deleting your account & data
- Your privacy rights
- International data transfers
- If something goes wrong
- Changes to this policy
- Contact us
1. Who we are & what this policy covers
GoRegulate ("GoRegulate", "we", "us") is based in British Columbia, Canada. We build the GoRegulate app for iPhone, iPad and Android — an emotional-regulation and augmentative and alternative communication (AAC) tool for neurodivergent children, used together with their care circle of parents, caregivers, and therapists — and operate the website goregulate.ca.
This policy covers personal information handled through the GoRegulate app (including versions distributed via Apple's App Store, TestFlight, and Google Play) and through goregulate.ca. It applies to account holders (adults) and to child profiles managed by those account holders.
We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act. Where users are located in other regions, additional rights described in Section 11 apply.
2. Children's privacy
GoRegulate is designed to be used by children — always under an account created and controlled by an adult. We treat children's information with the highest level of care, consistent with the U.S. Children's Online Privacy Protection Act (COPPA), Apple's guidelines for apps used by kids, and Google Play's Families policies.
- Adult-controlled accounts. Only a parent, legal guardian, or authorized therapist can create an account, and that adult provides consent for any information collected about a child. Children cannot create accounts themselves.
- Minimum necessary. A child profile needs only a name or nickname the child recognizes. We do not require a child's full legal name, birthdate, photo, or contact details.
- No advertising to children. The app contains no ads, no third-party advertising or analytics SDKs, and performs no behavioural profiling of children.
- No public sharing. Nothing a child enters in the app is ever made publicly visible. Data is visible only within the child's own care circle.
- Parental rights. The account-holding adult can review, export, correct, or delete a child's information at any time, and can withdraw consent to further collection by deleting the child profile or the account (Section 10).
- External purchases and links. Purchases, account-level settings, external website links, and the optional location feature all sit behind adult-gated areas of the app.
3. Information we collect
Account information (about the adult)
- Email address and password credentials, used to create and secure your account and enable sign-in (including magic-link and Apple/Google sign-in).
- Role in the care circle (for example parent or therapist), so the app shows the right dashboard.
Child profile & wellbeing information (entered by the care circle or generated through use)
- A name or nickname and optional profile settings such as avatar and theme choices.
- Emotional-regulation entries: the zone a child is in, triggers, timestamps, and which calming strategies were used.
- Strategy outcomes — the "Did it help?" ratings that let the app learn which strategies work best for a specific child.
- AAC content: communication boards, word selections, custom buttons, and images or icons added to boards.
- Content created in-app, such as social stories, drawings, and practice worksheets.
- Messages sent between members of a care circle (for example a parent and child) when messaging is used.
Some of this is sensitive wellbeing information. We collect it for one reason only: so the app can do its job for your child. See Section 7 for how we protect it.
Purchase information
- Purchases made through Apple or Google Play are processed by those stores; we receive a receipt confirming your subscription status, never your payment card details.
- Purchases made on our website are processed by Stripe; Stripe handles your card details and we receive only confirmation of payment and your email. We never see or store full card numbers.
Technical & diagnostic information
Basic device and app-version information, a device identifier used to enforce the number of devices on your subscription, and error logs needed to keep the app working and fix bugs. We do not collect contacts, photos (beyond images you deliberately add to AAC boards or calm cards), microphone recordings, or camera images — voice recordings and Calm Detector camera frames are processed on the device only and never leave it.
Device location (optional, adult-initiated)
GoRegulate does not track location in the background and never follows a child's movements. Location is collected only at the moment an adult taps "Update location" in the adult-gated dashboard, and only after passing the app's grown-up check. When that happens we send the device's latitude, longitude and accuracy to our server so the location can be shown to the account's care circle.
- We store only the most recent position — one record per account. There is no location history or trail.
- Location is never used for advertising, profiling, or analytics, and is never shared with anyone outside your care circle.
- The record is deleted automatically when you delete your account, and can be removed at any time on request.
If you never use this feature, no location data is ever collected.
Website
If you join our early-access list on goregulate.ca, the form (processed by Formspree) collects the email address you provide. The website does not use advertising cookies or cross-site trackers.
4. How we use information
- To provide the service: sync your data securely across the care circle, restore it if you change devices, and keep your account working.
- To power in-app insights: the Regulation Forecast analyzes a child's own zone, trigger, and outcome history to highlight risky time windows and suggest the strategies that have worked best for that child. This analysis serves your family only — it is not used to profile children for any other purpose.
- AI-assisted features: when you use an AI-assisted feature such as the icon generator, the text prompt you type is sent to our secure server and on to Anthropic's API to generate the result. We do not send your child's wellbeing history with these requests, and Anthropic does not use API data to train its models by default.
- To process purchases and verify premium access.
- To support you: respond when you contact us, and send essential service messages (for example, security or account notices).
- To keep the service safe: debugging, preventing abuse, and securing accounts.
We rely on the consent of the account-holding adult, the necessity of processing to deliver the service you asked for, and our legitimate interest in keeping the service secure.
5. What we never do
- We never sell or rent personal information, and we never have.
- We never share personal information with data brokers or advertisers.
- We never use children's data for advertising, marketing profiles, or any purpose beyond providing GoRegulate to your family.
- We never use your family's data to train third-party AI models.
6. Sharing & service providers
Within your account, information is shared only with the care circle you set up — for example, a therapist you connect can see the regulation data for the child they support. Beyond that, we share personal information only with the service providers below, who process it on our instructions under contractual confidentiality and security obligations, and never for their own marketing:
| Provider | What they do for us | Data involved |
|---|
| Supabase | Secure database, authentication, and cloud sync | Account and in-app data described in Section 3 |
| Apple | App distribution and in-app purchase processing | Purchase receipts; Apple ID handled by Apple |
| Google | App distribution (Google Play), in-app purchases, and Google sign-in | Purchase receipts; Google account handled by Google |
| Stripe | Website payment processing | Payment details (held by Stripe), email, purchase confirmation |
| Anthropic | AI-assisted generation via API | The prompt text you type |
| Formspree | Website early-access form delivery | Email address you submit |
| GoDaddy | Website hosting | Standard server logs for goregulate.ca |
We may also disclose information if required by law or valid legal process, to protect the safety of a child or others, or as part of a business transition — in which case this policy's protections would continue to apply and you would be notified.
7. Health information & HIPAA
Emotional-regulation records are sensitive wellbeing information, and we safeguard them in line with the administrative, technical, and physical safeguard standards of the U.S. Health Insurance Portability and Accountability Act (HIPAA) Security Rule, even where HIPAA does not directly apply:
- Encryption of data in transit (TLS) and at rest.
- Row-level security so each account can access only its own records, with role-based access within a care circle.
- Access limited to the minimum necessary for the feature being used.
- No use or disclosure of wellbeing information for marketing, and no sale of it — ever.
For U.S. clinics and therapists: if you are a HIPAA covered entity (or a business associate of one) and use GoRegulate with clients as part of treatment, contact us at ceo@goregulate.ca before onboarding client data so we can put a Business Associate Agreement (BAA) in place. HIPAA obligations attach through that agreement; using the app alone does not create a HIPAA relationship.
8. How we protect your data
- All connections between the app, the website, and our servers use TLS encryption; data is encrypted at rest in our database.
- Database row-level security policies enforce that every request can only touch the requesting account's own data.
- Authentication uses industry-standard mechanisms, including magic-link sign-in, Apple and Google sign-in, and server-side verification of purchase receipts.
- Sensitive in-app areas (such as AAC board editing, the dashboard, and settings) can be locked behind an adult PIN on shared devices.
- We limit internal access to personal data to what is strictly needed to operate and support the service.
No system can be guaranteed 100% secure, but we design for security first and review our practices as the service grows.
9. Data retention
- Account and in-app data: kept while your account is active so the app can work for your child.
- After deletion: when you delete your account, personal data is deleted from our production systems within 30 days, and from encrypted backups within 90 days.
- Location: only the single most recent position is kept, and it is deleted immediately when the account is deleted.
- Purchase records: transaction records are kept as long as tax and accounting law requires, then deleted.
- Early-access list: your email is kept until you unsubscribe or ask us to remove it.
10. Deleting your account & data
You can delete your account and all associated data — including every child profile, regulation record, and AAC board — at any time. Deletion is permanent.
- In the app: open the adult-gated settings area and choose account deletion, or
- By email: write to ceo@goregulate.ca from your account email with the subject "Delete my account". We will verify the request and confirm deletion.
Either route deletes the same data on the same timeline described in Section 9. You do not need an active subscription to request deletion, and you can request deletion of specific data (for example, one child profile) without closing the whole account.
11. Your privacy rights
Wherever you live, you can ask us to:
- Access a copy of the personal information we hold about you or a child you are responsible for;
- Correct information that is inaccurate;
- Delete information (Section 10);
- Withdraw consent to further collection at any time;
- Receive your data in a portable format.
We respond to verified requests within 30 days and never charge for them or treat you differently for making one.
Region-specific rights
- Canada (PIPEDA / BC PIPA): you may also complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
- United States: parents and guardians have COPPA rights to review, delete, and refuse further collection of a child's information. California residents have the rights to know, delete, and correct under the CCPA/CPRA; we do not sell or share personal information as those laws define it.
- EEA & UK (GDPR): you additionally have rights to restrict or object to processing and to lodge a complaint with your supervisory authority. Our legal bases are consent, contract performance, and legitimate interests as described in Section 4.
12. International data transfers
We are a Canadian company, and our service providers may store or process data in Canada, the United States, or other countries where they operate. Whenever data leaves your region, it remains protected by this policy and by contractual safeguards with our providers, and it stays encrypted in transit and at rest.
13. If something goes wrong
If a data breach ever creates a real risk of significant harm, we will notify affected users promptly and without undue delay, report to the applicable privacy regulators as the law requires, and tell you plainly what happened, what data was involved, and what we are doing about it.
14. Changes to this policy
If we change this policy, we will update the effective date at the top and, for material changes — especially anything affecting children's data — notify account holders by email or in-app notice before the change takes effect. We will never reduce protections for children's information without fresh, verifiable parental consent.
Questions, requests, or concerns about privacy:
GoRegulate — British Columbia, Canada
Email: ceo@goregulate.ca
Phone: +1 778 522 4603
We aim to respond to every privacy inquiry within 7 days.