Privacy Policy

Kimcura is a math-learning app designed for students in Chile, available for Android and iOS mobile devices. This Privacy Policy explains what personal data we process when you use Kimcura, what we use it for, who we share it with, and what rights you have.

This policy is effective as of July 16, 2026 and applies only to the Kimcura mobile app and this informational website. For any question or request about your data, write to us at contacto@kimcura.cl.

We collect only what the app needs to work:

• Account data: if you choose to sign in with Google, your email address, your Google display name and your Google profile-picture URL (the picture is stored but is not currently shown in the app). Every account — including guests — is assigned an internal identifier (UUID) and a random public username (for example, "blue-fox-1234"), which you can edit. You may also write an optional bio of up to 160 characters.
• Content you create: comments and replies on exercises (500 characters max), likes and saves.
• Progress and gameplay: your math skill-mastery vector (seeded from the grade and level you indicate when you start), your cumulative PvP duel win/loss tally, and the avatar cosmetics you own and wear.
• Usage telemetry: interaction events (impressions, dwell time, solves, wrong attempts, skips, scroll-backs, feed switches, app foreground/background), together with device model, operating system and app version (not a unique hardware identifier).
• Analytics (PostHog): an anonymous identifier generated by the SDK on your device, standard device context, and one event when you complete a challenge. It is never linked to your Kimcura account.
• Safety and moderation: user reports (reason, optional detail and a copy of the reported comment), user-to-user blocks, and sanctions applied by moderators (mutes and suspensions).
• Ephemeral multiplayer data: your position, pose, emotes (from a fixed list, no free text) and outfit in the 3D plaza are relayed in real time but never stored: they live only in memory for seconds.
• On-device-only data: XP, streaks, missions, attempt history, saved items, your onboarding answers (goal, pace and per-topic comfort), language preference and session tokens. These never leave your phone except through the flows described above.

We do not collect location, contacts, photos, audio, advertising identifiers or payment data.

We use your data to:

• Personalize your learning: your skill vector and usage telemetry feed the exercise recommender ("For You") and models that help us show you content at the right level.
• Power social and multiplayer features: your username, bio, avatar outfit, PvP tally and comments are shown to other players in the 3D plaza, on duel cards and in the feed.
• Keep the app safe: an automatic Spanish/English filter screens comments (profanity, contact details and links); flagged comments are hidden and a human team reviews reports through an admin dashboard.
• Manage your account: sign-in, account recovery and enforcement of suspensions.
• Product analytics: understand how the app is used so we can improve it. Usage telemetry is keyed to your internal user identifier; PostHog analytics, by contrast, uses an anonymous identifier not linked to your account.

We do not sell your data and we do not show ads.

We process your data under Law No. 19.628 on the Protection of Private Life, as reformed by Law No. 21.719, on the following bases:

• Performance of the service: the minimum data needed to provide the app — your user identifier, your skill vector and the progress of the exercises you solve.
• Consent: product analytics, behavioural telemetry, feed personalization, and the social and multiplayer features. None of this happens before you accept: the app starts with analytics off and sends no events until you authorize it. You can withdraw any of these consents at any time from the You tab, without writing to us and without losing access to the app.
• Legitimate interest: security, content moderation, abuse prevention, and preventing suspended accounts from re-registering.

We no longer rest analytics or behavioural telemetry on legitimate interest. For an app used by minors that balancing test did not seem sustainable to us: those uses now depend on consent, and the app works fully if you refuse.

We do not sell or transfer your data for commercial purposes. We share data only with these providers, all acting as processors:

• Supabase (infrastructure on AWS, us-east-1, USA): runs authentication and the main database where all account and app data lives.
• Google (only if you choose “Sign in with Google”): acts as identity provider; it knows you sign in to this app and gives us your email, name and profile photo URL.
• Microsoft Azure (file storage, USA): serves the app’s images, sounds and 3D models. It receives your IP address transiently while downloading them, like any server your phone fetches a file from. It receives no account data.
• PostHog Inc. (US cloud): product analytics, only if you accept. It receives a short list of named events — completing a challenge, viewing the subscription screen, starting or completing a purchase, running out of hearts — together with standard device context and an anonymous identifier generated by its SDK. We do not send screen views or taps. Your IP reaches their servers transiently and is used for approximate geolocation. We never link this data to your Kimcura account.
• RevenueCat Inc. (USA): manages Kimcura Plus subscription state. It receives an identifier for your account and whether your subscription is active. Payment is processed by the app store (Google Play or the App Store): neither RevenueCat nor we see your card details.

We may also disclose data if a competent Chilean authority requires it under the law.

This website uses no advertising, analytics or tracking cookies, and loads no third-party trackers. The only things that may remain in your browser are:

• Local preferences (localStorage): the language you view the site in and a record that you closed the cookie notice. They stay in your browser, are never sent to us or to anyone else, and you can delete them at any time from your browser settings.
• Strictly necessary security cookies (Cloudflare): this site is delivered through the network of Cloudflare, Inc. (USA), which acts as a content delivery network and a protection layer against attacks. To tell legitimate visitors apart from automated traffic, Cloudflare may set short-lived technical cookies such as __cf_bm or cf_clearance, and transiently receives your IP address while serving the pages. These cookies do not follow you across other websites and are not used for advertising.

Because all of the above is strictly necessary for the site to work and stay protected, the law does not require asking for consent: that is why the site's cookie notice is informational only and does not ask you to accept anything. If we ever added non-essential cookies (web analytics, for example), we would ask for your consent before turning them on.

The mobile app does not use browser cookies; the data it processes is described in the rest of this policy.

You can use Kimcura without an email or Google account by choosing “Continue as guest”. An anonymous account is still created on the server, with an internal identifier and a random username, but no email, no real name and no photo.

The age screen and consent apply exactly as they do to a registered account: being a guest does not skip age verification, and does not enable social features by default on under-14 accounts.

With analytics and social features accepted, the same activity data is collected as for a registered account. If you later sign in with Google, your guest account is linked to that identity and you keep your progress. You can delete your guest account from the app, just like a registered one.

Kimcura is aimed at school students, including minors, and we designed it to minimize the risks to them.

Age verification. On first launch we ask for your date of birth, before collecting any data. The question is neutral: it does not hint which answer unlocks more features, and cannot be retried.

Under 14. The law requires the authorization of a parent or legal guardian. If you declare you are under 14, the account is held pending: we ask for your responsible adult’s email, send them a confirmation link, and process no more of your data than strictly necessary until that adult confirms. The adult separately decides whether to enable social features.

Ages 14 to 17. You can consent on your own. Social features and analytics remain optional and are your choice.

Social features off by default on under-14 accounts. Comments, the 3D plaza with strangers and duels start disabled, and are only enabled if the responsible adult explicitly authorizes them.

On-device parental controls. In You ▸ Settings ▸ Parental controls, the responsible adult can set a 4-digit PIN that blocks social features (comments, the multiplayer plaza and duels) and requires the PIN before any in-app purchase can start. The PIN and the restrictions are stored only on the phone, in the system’s secure storage; they are never sent to our servers or to third parties. Removing the PIN lifts the restrictions.

No advertising: no ads, no ad SDK, and we do not read the device advertising identifier. No real name required: your public identity is a random username; the app can be used in full as a guest. No sensitive device data: we do not collect location, contacts, photos or audio.

Protection in social features: the moderation filter automatically blocks the exchange of contact details (phone numbers, social handles, links) in comments, and multiplayer emotes come from a closed list with no free text. User reporting and blocking are available, with human review.

If you are a parent or guardian and want to access, correct or delete the data of a minor in your care, or withdraw your authorization, write to contacto@kimcura.cl with the minor’s username.

Every purpose has a retention period, and an automated process applies it:

• Account and progress data: for as long as your account exists.
• Behavioural telemetry (events and sessions): 24 months. It previously had no retention limit; it does now.
• Moderation records (reports, blocks, sanctions): 24 months after the sanction ends.
• Suspended accounts: to prevent re-registration we store a hash of the email, not the email. It recognizes a re-registration attempt equally well and is not readable by anyone, including us.
• 3D plaza presence (position, emotes): memory only, gone within seconds.
• Data kept only on your device: until you uninstall the app or clear its data.

Deleting your account destroys all of the above except moderation records and the suspension hash. We want to be precise about those records: we keep them pseudonymized, not anonymous. That means they remain personal data and your right to erasure still applies to them — you can request their deletion by email and we will assess it case by case, weighing the protection of the other people involved.

We apply technical and organizational measures to protect your data:

• Our internal services communicate over encrypted (TLS) connections and the database connection requires SSL.
• The database enforces row-level access controls that prevent direct client access to service tables.
• We do not integrate advertising SDKs or third-party crash-reporting services.
• Social content goes through an automatic filter plus human review.

Our services do not deliberately log IP addresses, although standard infrastructure logs may capture them temporarily. No system is 100% secure; if an incident affecting your personal data ever occurs, we will notify you as required by law.

Under Law No. 19.628 as reformed by Law No. 21.719 you have the rights of access, rectification, erasure, objection and portability. Nearly all of them are exercised in the app, without writing to us:

• Access and portability: download a copy of everything we hold about you from You → Privacy. The file is JSON, a structured and commonly used format, and includes profile, comments, reactions, skill vector, telemetry, PvP record, cosmetics inventory and your consent history.
• Erasure: deleting your account in the app erases your identifying data and everything living outside the accounts table — comments, reactions, telemetry, skill vector, cosmetics, record and notifications. This was previously not the case and we said so; deletion is now complete.
• Objection: you can turn off feed personalization and analytics independently, at any time, with no loss of functionality.
• Rectification: username, bio and grade are editable from your profile.

The only exception to erasure is moderation records (reports, blocks and sanctions), which we keep pseudonymized and time-bound because they protect other people from conduct that already occurred. See “How long we keep your data”.

For anything else write to contacto@kimcura.cl, ideally from the email associated with your account or quoting your username. There is a named owner and we respond within the legal deadlines. You may also file a complaint with Chile’s Personal Data Protection Agency.

Your data is stored and processed in the United States: authentication and the main database run on Supabase (AWS, us-east-1), the app’s files on Microsoft Azure, analytics on PostHog’s cloud, and subscription state on RevenueCat. By using Kimcura, your data is transferred from Chile to those providers, which act as processors.

Law No. 21.719 requires a legal mechanism for these transfers. We are formalizing it alongside the processing agreements with each provider, to have it in place before the law takes effect on December 1, 2026. We publish the status of this work, unvarnished, on our Law 21.719 page.

The rights described in this policy apply regardless of where your data is stored.

We may update this policy when the app or applicable law changes. We will always publish the current version on this site with its effective date. If a change is significant — for example, new types of data collected or new providers — we will notify you inside the app before it takes effect.

For questions, rights requests or privacy complaints, write to contacto@kimcura.cl. Include the word "Privacy" in the subject line and your Kimcura username so we can locate your account. If you are writing as the parent or guardian of a minor, please say so in your message.