Privacy policy

NGO “Ukraine Rising” (“Organization,” “we,” “us,” or “our”) operates the Cloudberry Dreams mobile application and associated digital services (collectively, the “Service”).

Cloudberry Dreams is an evidence-informed digital wellness tool designed to help children manage fears, nightmares, and emotional distress using Imagery Rehearsal Therapy (IRT) techniques. Because our Service processes children's data and health-related wellness metrics, we uphold strict global data protection standards, including:

• EU & UK General Data Protection Regulation (GDPR / UK GDPR)
• US Children's Online Privacy Protection Act (COPPA)
• Ukrainian Law “On Protection of Personal Data” (No. 2297-VI)
• Israeli Privacy Protection Law (5741-1981) & applicable Middle Eastern data privacy regulations

To protect children's privacy, our Service is structured exclusively for setup and administration by parents or legal guardians:

• No Direct Registration by Minors: Children under the age of 18 (or the age of majority in your jurisdiction) are not permitted to register an account independently.
• Parental Supervision: All account management, child profiles, sleep diary inputs, and interactive AI story prompts must be executed by or under the direct supervision of a parent or guardian.
• Verifiable Parental Consent: By creating an account and registering profile details about a child, you affirm that you are the child's legal parent or guardian and explicitly consent to the processing of data as set forth in this policy.

We collect only the minimum necessary information required to operate and optimize the IRT features of the Service.

A. Data provided voluntarily by parents

• Account Credentials: Parent/guardian email address, encrypted authentication credentials, and system preferences.
• Child Profile Information: Child's first name (or pseudonym), age, and preferred narrative themes used exclusively to customize therapeutic AI stories.
• IRT & Wellness Data: Descriptions of nightmares or fear topics provided by the parent, fear intensity ratings, sleep diary entries, and progress logs tracked over time.

B. Technical and application data (collected automatically)

• Device Identifiers: Mobile device model, operating system version, app version, unique installation identifiers (e.g., IDFV, Android ID), standard language settings, and IP address.
• Diagnostic & Analytics Data: Crash logs, system performance metrics, and feature interaction data (processed in pseudonymized or aggregated forms).
• Coarse Location Data: General geographic location (city or country level) derived strictly from IP addresses for security, regional compliance, and localization. We do not collect precise GPS coordinates.

In accordance with international privacy laws, we rely on the following legal grounds to process your personal data:

• Performance of Contract: Processing necessary to deliver account functionality and core IRT features requested by you.
• Explicit Parental Consent: Processing special category data (child profiles and sleep/fear tracking metrics) based on your explicit authorization during signup.
• Legitimate Interests: Monitoring infrastructure stability, enforcing account security, preventing misuse, and improving app performance.
• Legal Obligations: Complying with mandatory statutory, regulatory, or tax requirements.

We process collected data solely for the following operational and therapeutic purposes:

• IRT Story Generation: Utilizing secure artificial intelligence services to generate positive, safe, alternative narrative scripts tailored to the child's specific fear topics.
• Account Administration & Support: Sending critical operational alerts, processing password resets, and addressing user support tickets.
• Platform Integrity: Safeguarding servers against cyber threats and maintaining application reliability.
• Note: We do not sell user data, nor do we build marketing profiles based on child information.

A. US COPPA compliance

We do not knowingly collect personal data directly from children under 13 without verifiable parental consent. Parents maintain total control over their child's profile and may review, update, or request deletion of this data at any time.

B. Global child data safeguards

Child profiles are strictly segregated from public features and are never connected to third-party ad networks or commercial profiling tools.

We do not rent, sell, or monetize personal data. We engage third-party service providers (“Data Processors”) strictly to support core operations, under binding contractual terms enforcing privacy standards:

• AI & Natural Language Processors: Anonymized story prompts are processed via enterprise AI APIs (e.g., OpenAI, Google Cloud AI) solely to draft IRT narratives. Contracts explicitly prohibit these providers from using your prompts to train public AI models.
• Cloud Infrastructure & Hosting: Encrypted cloud infrastructure (e.g., AWS, Google Cloud) hosting backend services under enterprise security protocols.
• Technical Analytics: Privacy-centric telemetry services operating on pseudonymized technical identifiers to monitor app stability.
• We may disclose data if legally required by a valid subpoena, court order, or official governmental request, or where disclosure is essential to prevent physical harm or safeguard legal rights.

As Ukraine Rising operates internationally, personal data may be stored or processed outside your home jurisdiction (including in the EU, the US, or Ukraine). When transferring data across international borders:

• For EU/UK users, transfers rely on Standard Contractual Clauses (SCCs) or recognized adequacy mechanisms.
• For users worldwide, we enforce organizational and contractual safeguards to ensure data protection.

We employ industry-standard technical and organizational security measures, including:

• Encryption: End-to-end TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest.
• Access Controls: Strict role-based permissions ensuring only authorized personnel access system infrastructure.
• System Audits: Routine vulnerability assessments and security reviews.
• While we take rigorous precautions, no digital system can be guaranteed 100% secure. In the event of a data breach impacting your rights, we will notify affected users and applicable regulatory authorities as required by law.

• Account Data: Retained for as long as your account remains active.
• Sleep & IRT Data: Retained for up to two (2) years to facilitate longitudinal therapeutic progress tracking, after which it is permanently anonymized or deleted.
• Account & Data Deletion: You may request account deletion directly within the mobile application settings or by emailing privacy@cloudberry.kids. Upon receipt of your request, all personal profiles, child data, and sleep logs will be permanently purged within 30 calendar days, subject to legal retention mandates.

Depending on your country of residence, you maintain specific rights over your personal data:

• Right of Access & Rectification: Request details of processed data or correct inaccuracies.
• Right to Erasure (“Right to be Forgotten”): Request full deletion of your account and child profiles.
• Right to Data Portability: Obtain an export of your personal data in a structured, machine-readable format.
• Right to Withdraw Consent: Revoke parental consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: File a grievance with your local supervisory body (e.g., the Ukrainian Parliament Commissioner for Human Rights, the Israeli Privacy Protection Authority, or EU Data Protection Authorities).
• To exercise any of these rights, contact us at privacy@cloudberry.kids.

Cloudberry Dreams is designed as a safe digital space for families. We do not run third-party advertisements, nor do we employ cross-app behavioral tracking software (such as Apple IDFA or Google Advertising ID tracking for ad targeting).

We may update this Privacy Policy periodically to reflect app updates or regulatory changes. Material updates will be communicated via in-app notifications or direct email at least 14 days prior to taking effect. Continued use of the Service following the effective date constitutes acceptance of the revised policy.

For privacy inquiries, rights execution requests, or compliance matters, please contact:

NGO “Ukraine Rising” (ukrainerising.org)

Direct Contact Email: privacy@cloudberry.kids