Privacy policy

Last updated 19 September 2026

NorAI is a voice-first AI friend for children aged 6–14, set up and supervised by a grown-up. This page says what NorAI keeps, who else receives it, and what you can do about it. It describes how the app works today; where something isn't built yet, it says so.

“NorAI”, “we” and “us” mean the people who run NorAI. Questions and requests go to hello@norai.world.

Who uses NorAI

Accounts belong to grown-ups. A parent or guardian signs in, sets a PIN, and creates a profile for each child. A child never signs up and never gives us an email address. Everything we hold about a child exists because a grown-up in their family created it, and every grown-up in the family can see it and delete it, as described below.

A family can have up to four grown-ups, who share it as equals. Each of them sees everything about the children: every profile, conversation and safety record. Each also sees the other grown-ups' names and email addresses, so you always know who else can read your child's conversations.

What we keep

About you

• Your email address and name, from Google or from the address you sign in with. We never see or store a password.
• Your dashboard PIN, stored only as a salted one-way hash. Each grown-up has their own.
• Where your safety alerts should go, and how serious something must be before we email you. Each grown-up chooses their own.

About your family

• Its AI key and voice key, if one of you adds them, encrypted, with which grown-up added each. We show only their last four characters, and decrypt them only at the moment of a call.
• When Google's free-tier data terms were accepted, if your family uses a free-tier Google key. The grown-up who adds that key is the one who accepts them.
• If one of you subscribes, the family's plan and the identifiers Stripe gives it. Card details go to Stripe and never reach NorAI.
• Invitations: the address a grown-up invited, who invited them, and when. Each is deleted 30 days after it was accepted, cancelled or ran out.
• A record of who did what in the family: invited, joined, left or removed a grown-up, unlinked a device, added or asked to remove a child, cleared a conversation, asked to delete the family. It holds grown-ups' names only: never an invited address, and never a child's name or words. Every grown-up in the family can see it, and it is deleted with the family.
• Each device linked as a child's screen: the browser's own description of itself, such as “Chrome on Android”, when it was linked and by which grown-up.

About each child, as you enter it

• A display name, birth date, school grade, interests, language and reading level, and the buddy's name and look.
• Their settings: daily time budget, schedule, safety level and voice choices.

From conversations

• The text of what your child says and what the buddy answers, so you can read every word in the dashboard.
• Safety records. When the safety layer flags or blocks something, we record what kind of thing it was, how serious, and what NorAI did, with up to 200 characters of the words involved so you can see what it was about.
• Daily usage, and the topics your child talks about, which the dashboard shows you.

Voice. When your child talks, the recording is turned into text and then discarded. We never store audio.

Who else receives it

• The AI provider your family chose, Anthropic (Claude) or Google (Gemini), on your family's own key. To answer, it receives your child's name, age, grade, interests and language, the buddy's name, and the last ten messages of the conversation. Anything the safety layer stops on the way in, including anything that sounds like a crisis, never reaches it. When you refresh topics, up to 150 recent messages are sent to summarise them. What the provider may do with this is set by your agreement with it: Anthropic, and Google on a paid key, don't use it to train their models, but Google's free tier may use it, and people at Google may read some of it. That is why the dashboard asks you to accept this before it saves a free-tier key. Until your family adds a key, its free trial questions go to Anthropic (Claude) on NorAI's own account instead, which receives the same things and does not use them to train its models.
• A speech-to-text service (Groq or OpenAI), when it is switched on, receives each recording to transcribe it. When it is off, your child's browser does the recognition itself, under that browser maker's own terms.
• A text-to-speech service (your family's own OpenAI or Google voice key, the Family plan's OpenAI voice, or your Google AI key) receives only the buddy's reply, never what your child said. A reply to anything that sounds like a crisis is always spoken by the device itself.
• Resend, which sends our email, receives each address and its message: a sign-in link, a PIN reset, or a safety alert giving your child's display name, what kind of thing happened and when. Safety alerts go to every grown-up in the family, each by their own setting. Alerts never quote your child; the exact words stay in your dashboard. Resend also sends family notices to the grown-ups (someone was invited, joined, left or was removed, or a deletion was asked for, cancelled or carried out), and invitations: the invited address, the name and email address of the grown-up who invited them, and a link. An invitation is sent before the person invited has agreed to anything.
• Stripe, if one of you subscribes, receives that grown-up's email address and name, and handles payment. The family has one customer record at Stripe, carrying the email address of whoever subscribed first, which moves to a grown-up who stays if that grown-up leaves. Whenever a grown-up leaves or is removed, every card saved on it is taken off, so nobody is charged on a card whose owner has left.
• Google, if you sign in with Google, tells us your email address and name. The sign-in page, and only that page, loads Google's button from Google.
• Supabase stores the database, in Frankfurt, Germany, and handles sign-in.
• Vercel runs the app. Requests are processed in Frankfurt, Germany.

We don't sell data, show ads, or use analytics or tracking tools. NorAI doesn't train AI models on anything your family says.

In your browser

Only what the app needs to work, and nothing that tracks you:

• norai_home, a cookie linking this device to your family as a child's screen, for a year. Any grown-up in the family can unlink it.
• norai_child, a cookie saying which child is using this device, for a year.
• norai_dash, a cookie saying you entered your PIN recently, for 30 minutes and renewed as you use the dashboard.
• Supabase's sign-in session, while you are signed in.
• In local storage: an unfinished setup form (including your child's name and birth date) until setup finishes, an invitation you opened while you sign in to accept it, when a new chat was started, the text size, and the chosen device voice.

Because none of it tracks you, there is no cookie banner.

How long we keep it

Until you delete it. Nothing expires on its own, except invitations, as above.

• Clear a child's history and their conversations and topics are deleted. Their safety record is kept unless you untick that option, so you can still see what the safety layer did. While another grown-up shares the family, the safety record always stays: no grown-up can erase what a child said before the others have seen it.
• Delete a child and their profile, settings, conversations, safety records and usage are deleted. If you are the family's only grown-up, and have been for seven days, that happens at once. Otherwise the other grown-ups are emailed and it happens seven days later, unless one of you cancels it.
• Remove a key and it is deleted straight away.
• Download everything (Account → Your data) and you get one file with your account and alert settings, and the family's record: each child's profile and settings, every conversation, the safety record, usage and topics, and the plan. Other grown-ups appear by name only, never their addresses. It never contains a PIN or a key.
• Remove just my profile (Account → Your data, with your PIN), when others share the family, and your account and sign-in are deleted at once. The children and everything about them stay with the other grown-ups. A Family plan is set to end with the period already paid for; any grown-up who stays can keep it by adding their own card. Nobody is charged on a card whose owner has left.
• Delete everything (Account → Your data, with your PIN) and every child's profile, conversation and safety record, the family's keys, settings and activity record, and your sign-in are deleted, and a Family plan ends that day. If you are the family's only grown-up, and have been for seven days, it happens at once. Otherwise it happens seven days later: the other grown-ups are emailed straight away, nothing changes in the meantime, and any of you can cancel it. The other grown-ups keep their own sign-ins. We send an email to confirm it happened.
• Remove another grown-up: any grown-up in the family can, with their PIN. The one removed can no longer see the family, the devices they linked are unlinked, the record of alerts sent to them about these children is deleted, and everyone, including them, is emailed. Their own sign-in stays.
• Delete an account with no family, one whose setup never finished or that was removed from a family, from the link on the setup page. No PIN is needed: there is no family data behind it.

Stripe keeps the payment records the law requires it to keep, and our email and hosting providers keep their own logs for a limited time.

Keeping it safe

• Keys are encrypted with AES-256-GCM. The PIN is hashed with scrypt, and five wrong tries lock it for 15 minutes. On a child's screen, where any grown-up's PIN works, wrong tries count once for the whole family.
• Nothing in a browser can read the database; only NorAI's server can.
• Every connection is encrypted, and the pages run under a strict security policy.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you.

Your rights

You can see, correct, download or delete your data and your child's at any time, almost all of it in the dashboard yourself; for anything else, email hello@norai.world. While other grown-ups share your family, deleting the children's data waits seven days and their safety records can't be erased on their own, as described above. Depending on where you live, you can also complain to a data protection authority: in Switzerland the FDPIC, in the EU the authority in your country.

Changes

If this policy changes, the date at the top changes too, and if the change matters we will email you before it takes effect.