Children’s Privacy

FirstSteps is designed for and directed at parents and guardians, who must be adults (at least 18, or the age of majority where they live). It is not intended for use by children, and children do not create accounts or interact with the service directly. All information about a child is entered and controlled by the responsible adult who holds the account.

When you add a child profile, you confirm that you are the parent or legal guardian and that you consent to us processing that child’s information to provide the service to you. Because this data can include health details, we rely on your explicit consent. You are always in control: you can view, edit, export or delete a child’s data at any time from within the app, and doing so withdraws your consent for that data.

The U.S. Children’s Online Privacy Protection Act (COPPA) governs the online collection of personal information from children under 13. FirstSteps does not knowingly collect information directly from children. Information about a child is provided by a parent or guardian acting on the child’s behalf, and is used only to deliver the service to that parent. We do not require a child to disclose more than is needed, and we do not condition participation on disclosing unnecessary information.

Under the GDPR, information about a child is treated with special protection, and health data is a special category requiring explicit consent. Our lawful basis for processing a child’s information is the parent’s explicit consent together with our contract to provide the service. Where a jurisdiction sets a specific digital age of consent, the parent or guardian provides consent on the child’s behalf.

We never use a child’s information, or any health information, for advertising, behavioural profiling, or sale. We do not run third party advertising or analytics SDKs. A child’s data is never made public and is never exposed in the community or in direct messages: the optional community and messaging features operate under a separate adult profile and never share a child’s tracked record.

The parent community and direct messaging are used by adults, under an adult profile. Anything a parent chooses to write, photograph or send to another parent is that parent’s own content, sent under their control, and is covered by the Privacy Policy. We encourage parents to take care before sharing a child’s photos, full name, location or health details with other members. Adults can block or report other members and report specific messages; our team reviews reports and prioritises anything raising a child safety concern.

We collect only what is needed to provide the features you choose to use, and you decide what to enter. When you delete a child profile or your account, that child’s data is removed from our active systems immediately, subject only to narrow legal retention described in the Privacy Policy.

You can review or delete a child’s information at any time, or ask us to help. To exercise any right, or if you believe a child’s data has been provided to us without proper authority, contact info@firststepsco.com and we will act promptly.