Privacy Policy

This Privacy Policy explains how Trish (“Trish,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the Trish iOS mobile application and related services (the “Service” or “App”). Trish is operated by Joshua Rohricht, a sole proprietor doing business as “Trish,” located at 40 E Oak St 1610, Chicago, IL 60611.

Trish is a voice-based, AI-powered homework coaching app designed for elementary school children (approximately grades 1–6). The App is directed to children and is subject to the Children's Online Privacy Protection Act (“COPPA”) and the Federal Trade Commission's COPPA Rule, including the amendments that took effect June 23, 2025 (the “2025 COPPA Amendments”). This Policy is written to comply with those requirements. If you are a parent or legal guardian, please read this Policy carefully before creating an account or a child profile.

If you have any questions about this Policy or our privacy practices, contact us at trishapp@trishapp.com or by mail at the address above.

1. Who Can Use Trish

Trish does not permit children to create their own accounts. Only a parent or legal guardian who is at least 18 years old may register for a Trish account. Once registered, the parent may create one or more child profiles for use by their own child(ren) under their supervision. All references in this Policy to “you” in the context of account registration and consent refer to the registering parent or guardian.

We collect personal information from children only in the manner and to the extent described in this Policy, and only after we have obtained verifiable parental consent as described in Section 5.

2. Information We Collect

a. Information about the parent (account holder). When you create a Trish account, we collect your email address and password. Your password is collected and managed through our authentication provider, Supabase Auth, and is stored in encrypted (hashed) form — Trish does not have access to your plaintext password.

b. Information about your child (child profile). When you create a child profile, we collect your child's first name or a nickname, and their grade level. We do not require or collect a child's last name, date of birth, home address, phone number, or photograph.

c. Session data. As your child uses Trish, we collect and generate: the subject of the homework session, the questions attempted, whether answers were correct or incorrect, and an AI-generated summary of the session (created by our AI vendor, Anthropic, based on the interaction). We do not store full conversation transcripts — only these condensed, AI-generated summaries.

d. Voice audio (biometric information). To let your child answer questions out loud, Trish captures your child's spoken voice during a session and streams it in real time to Google Cloud Speech-to-Text for transcription into text. A child's voice is a biometric identifier under the 2025 COPPA Amendments and under applicable state biometric privacy laws. We treat it accordingly:

• Voice audio is used solely to transcribe your child's spoken answers so the AI coach can respond.
• Trish does not store or retain any voice audio or voiceprint after transcription. Audio exists only transiently, in memory, for the length of time needed to complete the transcription.
• Under our configuration with Google Cloud Speech-to-Text, Google does not retain the audio after transcription and does not use it to train Google's models.
• We do not use voice audio for voice recognition, speaker identification/verification, or any biometric identification purpose. It is used exclusively for speech-to-text conversion.

e. Worksheet images. If a parent or child submits an image of a homework worksheet for the AI coach to analyze, that image is transmitted to our AI vendor (Anthropic) for analysis. We do not retain worksheet images after the analysis is complete.

f. User settings. We collect and store preferences you set, such as whether you'd like to receive post-session email summaries, and your child's preferred voice playback speed.

g. Payment information. Trish subscriptions are billed entirely through Apple's In-App Purchase / StoreKit system. Trish never receives, processes, or stores your payment card number or other payment credentials. Apple's collection and use of payment information is governed by Apple's own privacy policy.

h. Information we do not collect. For clarity, Trish does not collect or store: voice recordings or audio after transcription is complete; full verbatim conversation transcripts (only AI-generated summaries); worksheet images after they have been analyzed; or payment card information of any kind.

i. Automatically collected / technical data. Trish does not use any third-party analytics or advertising SDKs. We do not currently collect device advertising identifiers, behavioral analytics, or usage-tracking data beyond what is minimally necessary for the App's core operation (such as standard server request logs retained briefly for security and reliability purposes).

3. Verifiable Parental Consent

Before we collect, use, or disclose any personal information from a child, we obtain verifiable parental consent from the registering parent. We do this through a combination of methods consistent with the FTC's COPPA Rule:

• Account creation. A parent must create and verify an account using their own email address before any child profile can be created.
• Payment-based verification. Because Trish is a paid subscription service billed through Apple, the parent must complete a monetary transaction through Apple's payment system, which verifies the account holder is an adult with a valid payment method and provides transaction notification to the account holder — a recognized method of verifiable parental consent under the COPPA Rule.
• In-app consent screen. During onboarding, parents are presented with a clear, standalone notice describing what information will be collected from their child, how it will be used, and how it will be disclosed, before any child profile is created.

A parent may revoke consent at any time and request deletion of their child's data using the methods described in Section 8.

4. How We Use Information

We use the information described in Section 2 to: operate and provide the Service, including generating AI coaching responses and Socratic-method guidance; transcribe a child's spoken answers so the AI coach can respond appropriately; generate session summaries and track homework progress over time; personalize the experience (e.g., grade-appropriate coaching, voice speed); send parents optional post-session summary emails; maintain the security, integrity, and reliability of the Service; enforce rate limits to prevent abuse; process subscription payments (via Apple); and comply with legal obligations, including COPPA.

We do not use your child's personal information for behavioral advertising, and we do not build advertising profiles of children.

We do not use your child's voice, transcripts, worksheet content, or session data to train artificial intelligence or machine learning models — ours or our vendors'. Under the 2025 COPPA Amendments, using a child's data for AI training is considered a use that is not “integral” to providing the Service and would require separate, additional verifiable parental consent beyond what is needed to provide the Service itself. Trish does not engage in this practice. Our AI vendor, Anthropic, processes session data solely to generate real-time coaching responses and summaries for your child's session, under commercial terms that prohibit using API customer content to train Anthropic's models. If this ever changes, we will provide advance notice and obtain separate, affirmative verifiable parental consent before any such use begins.

5. Third Parties We Share Information With

We share limited personal information with the following categories of service providers (“subprocessors”), solely as necessary to operate the Service. We do not sell children's (or parents') personal information, and we do not share it with third parties for their own independent marketing or advertising purposes.

Disclosures integral to the Service. Each of the disclosures above is necessary to provide the specific features of Trish that the parent has signed up for (e.g., we cannot deliver spoken AI coaching without a text-to-speech vendor, and we cannot let a child answer aloud without a speech-to-text vendor). Under the 2025 COPPA Amendments, disclosures that are integral to providing the service the parent requested may be covered by the consent obtained at sign-up and do not require a separate opt-in. We do not currently make any disclosures of children's personal information that are not integral to the Service (such as for advertising or data monetization). If we ever begin such a disclosure, we will first obtain separate, verifiable parental consent specific to that disclosure.

We may also disclose information if required by law, subpoena, or other legal process, or to protect the safety of a child, our users, or the public, or in connection with a merger, acquisition, or sale of business assets (in which case affected parents will be notified and this Policy will continue to apply to previously collected information unless and until parents are given notice and choice consistent with COPPA).

6. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, consistent with the data retention requirements of the 2025 COPPA Amendments. Our retention practices are as follows:

• Voice audio: Not retained. Processed transiently for transcription only and discarded immediately afterward.
• Worksheet images: Not retained. Used transiently for analysis and discarded immediately afterward.
• Parent account data (email, authentication credentials): Retained for as long as the account is active. If a parent deletes their account, this data is removed from our active, production systems immediately, and may persist in encrypted daily database backups for up to approximately 14 days before being fully purged, consistent with our infrastructure provider's backup retention schedule.
• Child profile, session records, and AI-generated summaries: Retained for as long as the associated child profile or parent account remains active, so your child's coach can build on prior sessions. If a parent uses the in-app “Delete Child Data” flow, this data is removed from our active, production systems immediately, and may persist in encrypted daily database backups for up to approximately 14 days before being fully purged, consistent with our infrastructure provider's backup retention schedule.
• User settings: Retained for as long as the associated account or child profile exists, and deleted along with it.
• Rate-limiting identifiers (Upstash): Retained only for the brief window needed to enforce rate limits (on the order of minutes to hours), then automatically expired.
• Operational and error logs: We maintain limited operational logs (such as error codes and system diagnostics) for debugging, reliability, and security purposes. These logs do not contain voice audio, transcripts, worksheet images, or other sensitive personal information, and are retained only as long as necessary for troubleshooting.

We do not retain children's personal information indefinitely, and we do not repurpose it for reasons unrelated to why it was originally collected. We maintain a written data retention policy internally that sets out, for each category of children's personal information we collect, the business need for retaining it and the timeframe for its deletion; the summary above reflects that policy.

7. Data Security

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information — including children's personal information — appropriate to its sensitivity and to the size and complexity of our operations. These safeguards include encryption of data in transit and at rest, access controls limiting who can view personal information, and reliance on infrastructure providers (Supabase/Lovable) that maintain their own security programs. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect information under our control and to hold our vendors to appropriate security commitments.

8. Parental Rights and Choices

As a parent, you have the right to:

• Review the personal information we have collected from your child.
• Delete your child's data. Use the “Delete Child Data” option in the app's settings to permanently delete your child's profile, session records, and AI-generated summaries. You may also request this by emailing trishapp@trishapp.com.
• Delete your account. Use the “Delete Account” option in the app's settings to delete your parent account and all associated child profiles and data, or email us at trishapp@trishapp.com.
• Refuse further collection or use of your child's information, by declining to use the App further or by deleting your child's profile.
• Revoke consent previously given, at any time, with the effect of terminating your child's ability to use the Service going forward.

We will honor deletion requests within the timeframes described in Section 6. We may retain limited information as required to comply with legal obligations, resolve disputes, or enforce our agreements, but we will not use retained information for any other purpose.

9. Biometric Data — Additional Disclosures

Because your child's voice is processed by the App and qualifies as a biometric identifier, we provide the following additional disclosures:

• What we collect: Real-time audio of your child's spoken answers during a coaching session.
• How it is captured: Through your device's microphone, only while your child is actively using a session feature that requires spoken input.
• Purpose: Solely to transcribe speech to text so the AI coach can understand and respond to your child.
• Retention: Not retained by Trish in any form (audio or voiceprint) after transcription completes.
• No secondary use: We do not use voice data for identification, verification, profiling, advertising, or any purpose other than the transcription described above.
• Sharing: Voice audio is shared only with Google Cloud Speech-to-Text for the sole purpose of transcription, under a configuration in which Google does not retain the audio or use it for model training.

10. Illinois Biometric Information Privacy Act (BIPA) Notice

Because your child's voice qualifies as a biometric identifier, and Illinois's Biometric Information Privacy Act (“BIPA”) applies to the collection of biometric identifiers from any individual, including where the operator is not based in Illinois, we provide the following notice consistent with BIPA's requirements, applicable to all users regardless of location:

• Purpose of collection: Your child's voice audio is captured solely to transcribe spoken answers to text in real time, enabling the AI coach to respond during a homework session.
• Written consent required: We do not capture a child's voice audio until the parent has provided affirmative, written (electronic) consent through our in-app parental consent screen, presented before any child profile can be used with voice features.
• Retention and destruction schedule: Voice audio is not stored. It is processed transiently, in memory, for the sole purpose of real-time transcription, and is permanently and irretrievably destroyed immediately upon completion of transcription (or, at the latest, once the initial purpose for collection — enabling that specific interaction — has been satisfied).
• No disclosure for profit; no unauthorized disclosure: We do not sell, lease, trade, or otherwise profit from voice data. We do not disclose voice audio to any party other than Google Cloud Speech-to-Text, solely for the purpose of transcription described above, and only under terms prohibiting Google's retention or use of that audio for model training.
• Security: Voice audio is protected using the same reasonable security measures described in Section 7 of this Policy while in transit.

If you have questions about our handling of biometric information or wish to exercise any rights available to you under BIPA or similar state biometric privacy laws, contact us at trishapp@trishapp.com.

11. No Sale of Data; No Behavioral Advertising

We do not sell children's or parents' personal information. We do not use children's personal information to serve targeted or behavioral advertising, and Trish does not currently integrate any third-party advertising network or analytics/tracking platform.

12. State Privacy Laws

Some U.S. states, including Illinois (where Trish is based), have their own biometric and general privacy laws that may apply in addition to COPPA, given that voice qualifies as biometric information in several state statutes. We are working to align our practices with these laws, including by minimizing biometric data collection and not retaining voice audio. Residents of states with additional statutory privacy rights (such as the right to access, correct, or delete personal information, or to know what categories of information are collected) may exercise those rights by contacting us at trishapp@trishapp.com; we will respond consistent with applicable law.

13. Children Outside the United States

Trish is intended for use by children and families located in the United States. We are not designed to and do not knowingly offer the Service to children located outside the United States. If you believe a child outside the United States has created a profile through a parent account, please contact us at trishapp@trishapp.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time, including to reflect changes in our practices or in applicable law. If we make material changes — particularly changes affecting how we collect, use, or disclose children's personal information — we will notify parents by email and/or through an in-app notice before the changes take effect, and, where required by COPPA, we will obtain new verifiable parental consent. The “Last Updated” date at the top of this Policy indicates when it was last revised.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your child's personal information, please contact us at: