PRIVACY POLICY

Version: 2.0 · Last updated: 8 October 2026

The short version

• Who we are. Pungent Ltd, a company in England, makes KGB Babushka. Write to us at info@kgbbabushka.com.
• No email, no password. Your account is anonymous. The app makes a random account ID for you. We never ask for your email or phone number.
• Your age and your guest book. Our server keeps whether you are an adult or a teenager. Your guest book stays on your phone unless you say yes to "Let me get to know you"; then a copy is kept on our server so the house knows you: your name and the year you were born, never the full date, and never the dragon page unless you say yes on that page too.
• Version 1.0 is free. There is nothing to buy, so we hold no payment details.
• We never sell your data. No ads. No tracking across other apps.
• The AI helpers ask first. Talking with Babushka uses xAI (Grok). The Council uses OpenAI. The Theatre's voice rooms, closed in version 1.0, use OpenAI for the live voice and xAI for the notes. Each one stays off until you say yes on its own card, which names the company. They are for adults (18+). You can turn each one off in Settings. If we ever move a helper to another company, we ask you again.
• No one trains AI on your words. The AI companies don't use what you send to train their models, and neither do we. xAI deletes what you send within about an hour.
• Babushka keeps notes about you. You can read, correct or delete every note in Settings. Your conversation with her is deleted a year after each message, or sooner if you delete it.
• Your Notebook is encrypted on your phone. Babushka reads none of it until you have said yes to her and then say "Let her"; only then is a readable copy of the notes you haven't marked Private kept for her (§5).
• Counting how the app is used. Adults in the US and the UK see a clear notice, and can switch counting off at any time; everyone else is asked once, with two equal buttons, and nothing is counted before a yes or after a no. Below your country's age for agreeing yourself, and under 13, nothing is counted. We never record your screen.
• Crash reports go to Sentry, in the EU, from the first time you open the app, so we can fix what breaks. They carry no name and never include what you write. You can switch them off.
• Your data lives in the EU (Ireland and Germany). The two AI companies, xAI and OpenAI, are in the United States.
• You are in charge. Download your data or delete your account in Settings, any time. An account nobody opens for a year is deleted for you.
• The village is for ages 13 and up. Under 13, only the lessons are open, and nothing leaves your phone except what the app needs to work (§13). The AI helpers are for adults only.
• We never report you to the police or anyone else for what you tell us about yourself. We disclose data only where the law makes us (§7).

The rest of this page is the detail.

1. Who we are

Pungent Ltd makes KGB Babushka and decides how your data is used. In data-protection language we are the controller.

This policy covers the KGB Babushka iPhone app and our website, kgbbabushka.com.

2. Age: 13 and over; the AI helpers are for adults

• The village is for ages 13 and up. If the date of birth you give, or Apple's age range, shows you are under 13, every lesson in the village stays open to you, and nothing else is offered: the AI helpers stay closed, no card asks you to agree to anything, nothing about how you use the app is counted, and no crash reports are sent once the app knows your age. Your guest book, your Notebook, your reflections and anything you record stay on your phone. Only what the app needs to work leaves it (§13). A parent can ask us to delete their child's account and everything in it: write to info@kgbbabushka.com with the account code shown at the bottom of Settings.
• The AI helpers are for adults (18+). That is Babushka's chat, the Theatre's voice rooms and the Council. Under 18, the door shows a card that says so, and the rest of the village stays open. For photos and the Theatre, our server also refuses anyone not recorded as 18 or over; for the chat and the Council, the app's own door does.
• 13 to 17: the most private settings. We don't count how you use the app, and we don't choose lessons from your behaviour, unless you say yes on the card (§6.1).
• Below your country's age for agreeing yourself, we don't ask at all. In the EU and EEA the law sets an age below which a parent must agree to apps like ours using your data with your consent. It is 16 in Croatia, Germany, Hungary, Ireland, Liechtenstein, Luxembourg, the Netherlands, Poland, Romania and Slovakia; 15 in Czechia, Denmark, France, Greece and Slovenia; 14 in Austria, Bulgaria, Cyprus, Italy, Lithuania and Spain; and 13 in Belgium, Estonia, Finland, Iceland, Latvia, Malta, Norway, Portugal and Sweden. In Canada we use 14 everywhere, because Quebec's law does; where the app cannot tell your App Store country, 16. Below that age we don't offer counting or lessons chosen from your behaviour, and your guest book stays on your phone. We use your App Store country, not your phone's language, to know which age applies.
• How we know your age. When you arrive, the app asks your date of birth: day, month and year. The date stays on your phone (a correction, below, is the one exception). Our server keeps whether you are an adult (18 and over) or a teenager (13 to 17) and, if your guest book is copied (§3.2), the year you were born, never the day or the month. An AI helper's door asks for the year if the app doesn't have it yet. We don't ask for ID, and we never guess your age from your face or voice. Until we know your age, we don't count how you use the app.
• Correcting a teenager's age, once. If you told the app you are 13 to 17 by mistake, Settings lets you correct it once. You enter your full date of birth again; our server checks that it makes you 18 or over and does not keep the date. The change applies after 24 hours, or at once if Apple's age range says you are 18 or over: the app sends only whether it does, which decides the timing and is not kept. We keep only the outcome (adult or teenager) and the dates of the correction, for as long as your account exists. Changing from adult to teenager is always allowed.
• Apple's age range. Where Apple says the law of your region requires it (today, for example, Texas and Brazil), the app also asks Apple for your age range, on Apple's own screen. Apple shares only a range, such as "13 to 15" or "18 or over". We use it on your phone, to apply the age rules above, and we never store it. When you correct your age, the app sends only whether Apple's range says 18 or over; it decides the correction and is not kept. If it shows you are younger than the date you gave us, we follow the younger age.

3. What we collect, and why

3.1 Your account

We don't ask for your email, phone number or a password. There are no purchases in version 1.0, so we hold no payment or purchase records.

3.2 The guest book

The guest book is the book you fill in when you arrive in the village. You decide what to write.

• On your phone. The whole book is kept on your phone.
• A copy on our server, only with your yes. If "Let me get to know you" is on (§6.1) when you write in the book, a copy goes to our server so the house can know you: your name (it is optional, and the page says so), the year you were born and whether that makes you an adult or a teenager (the full date stays on your phone), the answers you picked or wrote, and your alias. It never includes the 18+ shelf. The dragon page stays on your phone unless you say yes to sharing it on that page. With a no, below your country's age for agreeing yourself (§2), or under 13, nothing from the book leaves your phone.
• Your alias, the agent name stamped on the last page. If you are 18 or over and have said yes to Babushka's card, xAI suggests it (§4) and our server reserves it so that no one else can take it. Otherwise the names are made on your phone. No other player sees your alias.
• How long. Switching "Let me get to know you" off stops new copies. The copy already kept stays until you delete your account, or ask us to delete it.

3.3 What you do in the village

Under 13, only your progress leaves your phone (and the few things §13 lists); the rest of this table stays on it, or is never collected (§13).

3.4 What you tell Babushka, and the other AI helpers

See §4 and §5.

3.5 Usage counts and crash reports

See §6.

3.6 What we don't collect

• Your exact location. No GPS. We use your App Store country and the country of your connection instead; when we count how you use the app (§6.1), PostHog estimates the city you are in from your internet address (§6.1).
• Your contacts, camera or photo library. Once the Theatre's Studio opens, the app can add a take card to your photos if you ask. It can't see your photo library: when you show Babushka a photo, you pick that one photo in the system's own picker, and only it is sent (§4).
• Your calendar. The app does not use it.
• Your voice, in Babushka's chat. When you hold the microphone to talk to her, your phone turns speech into text. Only the text is sent.
• An advertising ID. We don't use one.
• Your emotions from your face, voice or typing. We never try to guess them.

4. The AI helpers

Three parts of the village run on AI from other companies. In version 1.0 two of them are open, Babushka and the Council; the Theatre's voice rooms are closed, and the Theatre rows below say how they work once they open. Each one stays off until you agree. The first time you open that room, a card names the company and says what goes to it. Each card has its own yes, and nothing is sent until you tap it. "Not now" keeps only that room closed; the rest of the village works as before. If we ask again on Babushka's card (see "If we change an AI company" below) and you choose "Not now", her replies and her overnight notes pause until you say yes; nothing is deleted. Every answer, a yes or a "Not now", is recorded with the version of the words you were shown. The AI helpers are for adults (18+).

You can turn each one off at any time: Settings → Privacy & account → What Babushka may know. Turning one off closes that room, and nothing more is sent to that company.

Babushka does not search the web in this version. She answers from what she already knows, and she cannot open a link you paste.

Photos you show Babushka are for adults. Your yes on her card covers them, and you can switch photos alone off, and back on, at any time in Settings → Babushka → What she may do.

Photos and child abuse images. A photo that our safety check reads as possibly showing someone under 18 in a sexual way is refused and deleted at once. We never keep a refused picture, and no one on our team ever looks at one.

When our check reads a photo as clearly showing a child in what US law defines as child sexual abuse material (sexually explicit conduct, or a lascivious exhibition of the body: 18 U.S.C. §2256), photos close for that account, a person on our team decides from the record alone, and we report it to the National Center for Missing & Exploited Children (NCMEC), the US clearinghouse, which passes reports to the police where the person is. These are the only photos we report. A drawing, not a photograph, that our check reads as clearly sexualising a child is refused and photos close for that account, but it is not reported. A photo of a child with nothing sexual in it, such as a bath or a rash, is refused gently, with a suggestion to show a worry to a doctor or a pharmacist; photos stay open, nothing is reported, and no record says why it was refused. The report says what we hold: your account ID, the time and your App Store country. It never includes the picture, because we have not kept it. What a report contains is kept for a year, because US law treats a report as a request to keep its contents, even if the account is deleted in that year; then only that record is kept, locked away, and everything else is deleted as usual. If the account is deleted before we have decided, we keep only the flag (never a picture), locked away, until a person decides: it is then reported, or deleted. xAI, the company whose AI checks photos, has its own child-safety reporting.

The Council's figures are AI simulations. The historical figures on the Council are written by an AI from public sources. They are not the real people. Neither the people nor their estates are connected with us, and none of them has endorsed the app.

What the companies may and may not do.

• None of them may train their AI on what you send. xAI doesn't train on it. OpenAI doesn't train on it.
• xAI keeps nothing. We use xAI's Zero Data Retention. What you send is deleted about an hour after the reply.
• OpenAI may keep what you send for up to 30 days, to detect abuse, then deletes it.
• Each company works under a data-processing contract with us. They may use your words only to do the job above.

Babushka is an AI. She is a character, not a person. She is not a doctor or a therapist.

Where the conversation is kept. Your conversation with her, and the Council's answers, are stored on our servers (§8), not by the AI companies. That's how the thread is still there when you come back.

Health, relationships and other sensitive topics. People tell Babushka about their health, their relationships, their sex life, their feelings and their beliefs. The law calls this sensitive or special category data. When you say yes on her card, you give your explicit consent for her to read such things, and to remember them, only to talk with you. We use them for nothing else. Before she keeps a sensitive note about you, she asks you in the conversation (§5).

Her overnight thinking. Between conversations, Babushka may read your conversation and her notes again, to update what she knows and think about what to say next. This also runs through xAI, under the same rules, and only while her room is open for you.

Where the helpers aren't available.

• Every AI helper is closed (Babushka's chat and photos, the Council, the Theatre and the guest book's suggested names) in Thailand, Morocco, Armenia, Nigeria, Kenya, Saudi Arabia, Argentina and Uruguay.
• Babushka's chat and photos are closed, and the app does not offer the Council, in China, Iran, Cuba, North Korea and Syria.
• The Council and the Theatre's scenes are closed, because OpenAI does not serve these places, in Russia, Belarus, Hong Kong, Macao, Venezuela, Kosovo, Anguilla, the British Virgin Islands, Montserrat and the Turks and Caicos Islands. Babushka's chat is open there.

We go by your App Store country and by the country your connection comes from: if either is on a list, that helper stays closed. Where a helper is closed, the app says so or does not offer it, nothing you type is sent to any AI company, and the rest of the village works.

If we change an AI company. We ask again only for a new AI company or a new kind of data. If we move a helper to a different company, or want to send it a new kind of data, we update this policy, and the app asks you again, on a card that says what changed, before anything goes to it. Your earlier yes covers only the company and the data it named.

5. Babushka's notes about you

• Everyday notes. She keeps short notes about you, like "is learning Spanish" or "has a dog called Kuzya", so she knows you from one day to the next. This is on once you agree to her card. You can turn it off in Settings → Babushka → The dossier.
• Sensitive notes need your yes. Before she keeps a note about your health, your body, your sex life or your beliefs, she asks you in the conversation. If you say no, she doesn't keep it and doesn't ask again. There is a switch for this in the dossier too.
• You can see every note. Settings → Babushka → The dossier shows each note, when she wrote it, and where it came from.
• You can correct a note. Your correction wins. She won't guess the old version again: to make sure of that, the old words are kept out of her sight, as a guard. The same happens to a note you tear out in Your file or with her "forget" card, which you can also put back. Deleting a note in the dossier, or asking her to forget everything, erases its words for good.
• You can delete one note, or ask her to forget everything (Settings → Babushka → Ask her to forget everything).
• You can delete the whole conversation (Settings → Babushka → Delete the conversation). This deletes it here and on our servers.
• Your Notebook. Your notes are locked on your phone (§3.3). Babushka reads none of them until you say "Let her": the Notebook asks you once, the first time you open it after saying yes to her card, and Settings → Babushka → Babushka may read my notes is the same switch. It is off until then. With your "Let her", the app keeps a readable copy of each note you haven't marked Private on our server, so that she can bring up what you wrote, and she reads them only while your yes on her card stands. Mark a note Private, delete it, or turn the switch off, and her copy is deleted. Your "Let her", and turning it off, are recorded with the time. Under 13, your notes never leave your phone.
• How long. Each message of your conversation is deleted automatically 365 days after it was sent. Her notes stay until you delete them or your account.

6. Counting how the app is used, and crash reports

6.1 Usage counts

What we count. Which parts of the app you open, what you tap there and for how long; lessons, games and snacks started, finished, answered (right or wrong) and left; your answers on our permission cards; errors you meet; how long the app takes to start and to load, and whether a video stalls; how many messages you send to the AI helpers and how long their replies take (never what either side says); the app version; your device model, iOS version, language setting, time zone, screen size and network type (Wi-Fi or mobile); your App Store country; and whether you are an adult or a teenager (never your birth year). Counts are linked to a random app ID, not to your name. They never include what you write or say. From your phone's internet (IP) address, PostHog also estimates roughly where you are (the country, region, city and postcode area, never your exact position), and then discards the address instead of storing it.

Who counts. PostHog, an analytics service, in the EU (Germany). In Settings this is the switch "Help us improve the app". PostHog also receives anonymous daily totals from our own database, such as how many lessons were finished on a day: statistics with no account ID, in which any group of fewer than five people is left out. The second switch, "Let me get to know you", lets us keep the activity in §3.3 in our own database, to choose your next lessons, and a copy of your guest book (§3.2); it is always a yes-or-no choice.

How we ask. It depends on where you are and on your age.

• Adults (18 and over) whose App Store account is in the United States or the United Kingdom: once the app knows your age, it shows a clear notice that says what we count and why, with an OK button, and counting starts after it. You can stop it at any time with the switch "Help us improve the app" in Settings → Privacy & account → What Babushka may know, and nothing more is counted after that. (Until the notice reaches your version of the app, you see the yes-or-no card below instead.)
• Everyone else (the EU and the EEA, every other country, teenagers anywhere, and anyone whose App Store country the app cannot tell): once the app knows your age, a card asks you once, with two buttons of equal weight: yes or no. Nothing is counted before a yes, and nothing after a no. Choose one by one on the card lets you say yes to one of the two switches and no to the other. You can change your answer at any time in the same place in Settings.
• Anyone below their country's age for agreeing yourself (§2), and anyone under 13: nothing is shown, nothing is counted, and the switches stay off.
• Before we know your age: nothing is counted, and nothing is shown.

What a no, or the switch turned off, leaves. The app still keeps your progress, because the game runs on it (§3.3), and our server still turns progress into anonymous totals with no account attached, such as "this lesson was finished 4,000 times" (§9). Nothing new is collected for counting.

What we record for the people we count. Which screens you open and how long you stay on each, linked to the random app ID. We use it mainly as totals, to see patterns like "most people stop at this step", and we may look at one person's own path through the app to find where it goes wrong for them. We never connect it to your name.

Screen recordings. The app never records your screen, in any version, test versions included.

6.2 Crash reports

If the app crashes or freezes, a technical report goes to Sentry, in the EU (Germany). It says which part of the code failed, and includes your device model, iOS version, app version, a random install ID, and the last few network addresses the app called (these can include your random account ID). It never includes a screenshot or anything you wrote, and in the App Store version no name or account is attached to it. Crash reports start the first time you open the app, before any card asks you anything, so we can see a crash on the way in. They are on unless you switch them off: Settings → Privacy & account → What Babushka may know → Crash reports (in a test version they stay on, §6.3). Once the app knows you are under 13, none are sent, in any version of the app, and the switch stays off (§13); before it knows anyone's age, a crash report can be sent, with no name attached.

6.3 Test versions of the app

If you test a pre-release version (TestFlight), we record more, so we can find problems: every screen you visit, how long you stay, where you leave the app, and how long parts of the app take to load, linked to your random account ID, and crash reports carry that ID too. This starts when you first open the test version, because each tester agrees in writing before installing it, and we tell testers in the invitation; our record of your permissions notes that written yes. You can switch it off in the test version too (Settings → Privacy & account → What Babushka may know), and then nothing more is counted. Crash reports stay on in a test version. A test version never records your screen either.

7. Who handles your data for us

These companies process data only on our instructions, under a data-processing contract. This table is the current list; if it changes, we change this page first.

Apple delivers the app and tells the app your App Store country. Apple's App Attest and DeviceCheck tell our server that the app is genuine and running on a real iPhone (§3.1). Apple is responsible for its own use of data; see Apple's privacy policy.

Public archives. If you play a historical recording in the Theatre's Great Speeches, your phone streams it straight from the public archive that holds it (for example the US National Archives or the John F. Kennedy Presidential Library), which sees your internet address as any website would. We send them nothing else.

Nobody else. We don't give your data to advertisers or data brokers.

Only where the law makes us. We never report you to the police or emergency services for anything you tell us about yourself, and we never contact your family. We disclose data only where a law that applies to us requires it:

• a valid court order or other legal demand that binds us;
• in the United States, the duty to report apparent child sexual abuse material to the National Center for Missing & Exploited Children (18 U.S.C. §2258A). US law requires it of US-based providers; we are a UK company and follow it as if it applied to us, for the photos in §4;
• in the EU, the duty to tell the authorities when we become aware that a crime threatening someone's life or safety is likely (Digital Services Act, Art. 18);
• in the UK, information that might help prevent an act of terrorism (Terrorism Act 2000, s.38B).

We tell you when the law allows us to.

If the company is sold, your data could pass to the buyer, who would have to keep to this policy or tell you about any change first.

8. Where your data is, and when it leaves the UK and EU

• Stored in the EU. Our database is in Ireland (Supabase). Usage counts and crash reports are in Germany (PostHog, Sentry).
• Sent to the United States. Only what goes to the AI helpers (§4), and, where we use DeviceCheck, the device token our server shows Apple (§3.1).
  • xAI and OpenAI are not certified under the EU–US Data Privacy Framework. Transfers to them use the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are part of their data-processing contracts with us.
• Supabase, PostHog, Sentry and Cloudflare are US-based companies. If any of them reaches your data from outside the UK or EU, for example for support, the EU Standard Contractual Clauses in its data-processing contract cover it, with the UK Addendum for UK data in Supabase's, Sentry's and Cloudflare's. Sentry and Cloudflare are also certified under the EU–US Data Privacy Framework.
• The UK and the EU recognise each other's protection, so data can move between them.

9. How long we keep things

If you delete the app without deleting your account, your data stays on our servers until the account has gone 12 months without being opened; then it is deleted. Because your account is anonymous, we can't find it again for you once the app is gone. So please delete your account in the app first (Settings → Privacy & account → Delete account).

10. What we never do

1. We never sell your data, and never share it for advertising. There are no ads in the app.
2. We never track you across other apps or websites. We don't use an advertising ID.
3. We don't train AI models on your conversations. We don't collect, use or sell personal data to train large language models. If we ever want to, we will ask you separately. Only adults will be asked. Nothing will be ticked for you, and saying no will change nothing else. Nothing collected before your yes will be used.
4. The AI companies may not train on your words either (§4).
5. No one on our team reads your conversations as a matter of course. A person sees part of one only when you send us a report (and only the part you chose), when our safety check stops one of her replies (we see her reply, not your words), or when the law requires it. Our small team can reach the database to keep the service running, and that access is limited.
6. We never report you to anyone for what you tell us, even when a safety check fires: not the police, not emergency services, not your family (§15). The only disclosures we make are the ones the law requires (§7); for photos, that means the reports about child abuse images in §4.
7. We never guess your emotions from your face, voice or typing.

11. Your rights, and how to use them

Most of this you can do yourself, in the app, right now.

Deleting your account deletes everything we hold about you on our servers, and the copies on your phone, except, if we made one, what a report to NCMEC contains, locked away until a year after the report, or a child-safety flag still waiting for our decision (§4, §9), and the minimal proof of your permission choices, kept three years with no way back to you (§9). Copies at the AI companies expire as in §9. Usage counts and crash reports are not linked to your account, so we can't pick yours out. Nor is the feed's own log of what it chose to show, which carries no account ID and is deleted after two years (§9).

Writing to us. Email info@kgbbabushka.com. Because your account is anonymous, we may ask you to make the request from inside the app, or to send the account code shown at the bottom of Settings, so that we act on the right account. We won't ask for anything more than we need.

How fast. We answer within one month. If a request is complex, we may take up to two more months, and we'll tell you why. It's free.

Complaints. If you're unhappy, please tell us first. You can always complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live or work in the EU.

12. Our legal reasons (UK and EU GDPR)

No decision with legal or similarly serious effects on you is made by automated means alone. Lesson suggestions and the safety checks are automated. One automated result has an effect: a photo that our check reads as clearly showing a child in sexual content, or a drawing it reads as clearly sexualising a child, closes photos for that account at once. Whether it is reported to NCMEC (§4) is decided by a person.

13. Children and teenagers

• Under 13: the lessons, and only what the app needs. If the date of birth you give, or Apple's age range, shows you are under 13, every lesson in the village stays open to you. The AI helpers stay closed, and an AI door never asks your age again. No card asks you to agree to anything, nothing is counted, and no crash reports are sent once the app knows your age. Your guest book, Notebook, reflections and recordings stay on your phone, and nothing is saved to your FLOW, your star map, your snack shelf or the people you have met.
• What leaves the phone under 13, because the app cannot work without it: the random account ID; your progress (where you are in a lesson, the lessons and quizzes you finish, the games and snacks you answer, your UP and rank), so the game keeps count and the feed can offer your next lesson; the list of what the feed offered you, so it does not repeat itself (kept as §9 says); the record that the Terms were accepted, with the app build (§9); and the security key that shows our server the app is genuine (§3.1). Your feed is the plain one, never chosen from your behaviour.
• How that ID is used. Only to run the app for you: to keep your progress yours, to show you your own progress and your next lesson, and to keep the app working and secure. We never use it, or anything kept with it, to contact anyone, to advertise or to build a profile, and none of it goes to the AI companies, PostHog or Sentry. A parent can ask us to delete the account and everything in it: write to info@kgbbabushka.com with the account code from Settings.
• Before anyone's age is known. When the app is first opened it makes a random account ID, before it knows anyone's age. We use that ID only to run the app for that person: to keep their progress and settings theirs, and to keep the app working and secure. We never use it to contact anyone, to advertise or to build a profile. Until the app knows the age, a crash report can be sent to Sentry, with no name attached (§6.2).
• 13 to 17: the village only, with the most private settings (§2, §6.1). No AI helpers.
• Below your country's age for agreeing yourself (§2): nothing is offered for you to agree to.
• AI companions may not be suitable for some young people. That is one reason ours are for adults only.

14. If you live in the United States

Everyone. We don't sell your personal information and we don't share it for targeted advertising, under any state's law. There is nothing to opt out of, but we honour a Global Privacy Control signal anyway. Whatever state you live in, you can ask to know what we hold, get a copy, correct it and delete it, and you won't be treated worse for asking. Use the in-app controls (§11) or email info@kgbbabushka.com. You can use an authorised agent; we'll ask for proof. If we refuse a request, you can appeal by emailing us with "Appeal" in the subject. We answer appeals within 45 days.

California. In the last 12 months we collected: identifiers (a random account ID, the security key for the app on your iPhone, and the name you wrote in the guest book, if it was copied to us); whether you are an adult or a teenager, and the year you were born if your guest book was copied (§3.2); internet and app activity (§3.3, §6); audio only if you turn on Save takes to my account (§3.3), or once the Theatre's voice rooms open (they are closed in version 1.0); inferences (Babushka's notes, lesson suggestions); and sensitive personal information: the contents of your messages to the AI helpers, which may reveal health or sex life. We collected it from you and from your use of the app, for the purposes in §3–§6, and disclosed it only to the companies in §7. We use sensitive personal information only to provide the service you asked for, so we don't offer a "limit the use" link. Our crisis protocol, which California law requires us to publish, is at kgbbabushka.com/crisis/; §15 is its summary.

Connecticut. We don't collect, use or sell personal data to train large language models. We process sensitive data only with your consent (§4, §5).

Washington and Nevada. Some of what Babushka holds, such as a note about your health, is "consumer health data" under their laws. Our Consumer Health Data Privacy Policy is at kgbbabushka.com/consumer-health-data/.

Other states with privacy laws (such as Virginia, Colorado, Texas, Oregon and others) give you the rights above. Where a state requires consent for sensitive data, the cards in §4 and §5 ask for it.

15. Safety, and what happens in a crisis

Every message you send Babushka is checked automatically for signs that you may be in danger. The check runs on xAI, the same company as her chat, under the same rules. Beside it runs a fixed set of rules on our own server, with no AI. The plainest statements of danger, such as a stated plan to end one's life, a plan to jump from a height today, or having taken ten or more pills, always get the crisis reply, whatever the check says. A wider set of rules catches the plainest words of danger when the check cannot run, or while her chat is closed or paused.

If the check or a rule fires, she answers with words a person wrote in advance, and the app shows a card that points to findahelpline.com, a free directory of helplines for nearly every country (its page for your country, where it has one), and, if your App Store account is in the United States, to 988, the Suicide & Crisis Lifeline (call or text). We print no other helpline numbers. If you tell her you have already taken an overdose, she first tells you to call your emergency number now (for example 999 in the UK, 911 in the United States and Canada, 112 in the EU) or to get someone to take you to an emergency department. The fixed rules and the card work even when the check, or the whole connection to xAI, is down or switched off.

We never contact the police, emergency services or your family about what you tell her about yourself. We show you where help is. The only disclosures we ever make are the legal duties in §7, which are about crimes, never about someone who is struggling.

We record that the check fired, the kind of concern, and when. This stays with your account until you delete it. From July 2027, California law requires us to report once a year how many times we pointed people to crisis services, as counts with no names and no content.

Our full crisis protocol, which California law requires us to publish (Business and Professions Code §22602), is at kgbbabushka.com/crisis/.

16. How we protect your data

• Everything travels encrypted (HTTPS).
• Our database and its backups are encrypted where they are stored.
• Access rules in the database stop one account from reading another's.
• Your Notebook is encrypted on your phone, with a key in your iCloud Keychain. Reflections kept in the cloud are encrypted on your phone with a key in your iCloud Keychain.
• Your conversation, Babushka's notes and her copy of your Notebook are not end-to-end encrypted, because she has to read them to answer. They are protected on our servers and reached by our team only as §10 says.
• The keys to the AI companies stay on our servers, never on your phone.

If a breach puts you at high risk, we'll tell the ICO within 72 hours and tell you as soon as we can, in the app, in plain words.

Our website has no analytics, sets no cookies and loads nothing from other companies; even its font is served from our own site. Cloudflare hosts it (§7).

17. Changes to this policy

We put each new version on this page, with its date. Earlier versions stay readable: the April 2026 version is at kgbbabushka.com/privacy/2026-04/.

• Small changes, like clearer wording, take effect when we publish them.
• Bigger changes to what we do with data we already hold, like a new use of it or a new company handling it, come with a notice in the app at least 30 days before they apply, with a short summary of what changed. A new feature that asks you for something new (such as signing in with an email) says so on its own screen before you use it, and this page changes the day it ships. Where the law needs your permission, we ask again, and a new AI company is always asked about again (§4). A change never quietly widens what we do with data we already have.

We don't have your email, so the app is where we tell you.

18. Contact

info@kgbbabushka.com · Pungent Ltd, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom · EU representative: being appointed (§1) · ICO registration: registration in progress (application ref C2053707) · Person in charge of the protection of personal information (Quebec): the Director, Pungent Ltd, at the same addresses

Version 2.0 replaces the April 2026 policy. It adds the AI helpers, the guest book, usage counts, crash reports, anonymous accounts and the retention table, and drops email accounts and purchases.