First Followers Direct Parent Notice and Consent
Publication status: Published September 22, 2026. Timeframes identified as targets remain planning estimates, as explained below.
Notice version: 2026-09-22.1 Effective date: September 22, 2026
Direct notice
Your permission comes first
First Followers is operated personally by Devon Allary, 1502 rue Noel Lareau, Chambly, Quebec J3L 5M7, Canada. Contact devonallary1@gmail.com or +1 514-601-6435.
We use the adult contact information you provide during setup to send this notice and obtain your permission. We need your verified permission before collecting personal information from your child through the app. Joining our adult waitlist, accepting the app's Terms, or signing in does not provide that permission by itself.
What the family features collect and do
We collect the child nickname, age band, avatar, language, and learning settings you choose; linked-device identifiers and access credentials; assignments, quiz results, help requests, lesson timing and progress; submitted answers and drawings; notes your child chooses to share; and your reviews, comments, approved feedback, and Screen Time settings and records. We also process prayer invitations you write and your child's completion acknowledgement.
These records let you assign Bible lessons, review available work, communicate through family activities, and manage Screen Time on compatible devices. Your child can see the assignments, invitations, and feedback intended for them. Comments labelled parent-only stay in the guardian experience. Journal entries follow the separate explanation below.
Screen Time processing uses Apple's opaque selection tokens, device authorization and technical status, and app-managed time budgets and usage. It does not give us your child's general browsing, message, location, or app-use history. Ordinary network requests may also expose an IP address and necessary technical metadata to our hosting provider. Optional notifications use a device notification token.
We do not ask children to provide their full name, exact birth date, contact details, location, photos, or voice recordings. Free-form submissions can still reveal personal information, including religious beliefs and family circumstances. Please avoid unnecessary identifying information in writing and drawings.
We do not provide public child profiles, public posting, stranger messaging, or child-to-child chat. We do not sell child information, use it for targeted advertising, or train public or third-party AI models on it. Progress describes learning activities, not a child's faith or worth. Private writing and sharing a personal note are not conditions for earning a lesson-completion reward.
Who receives it
- Authorized guardians in your household can see submitted work and shared notes, results, progress, prayer acknowledgements and Screen Time information.
- Apple Inc. and Apple Canada Inc. provide sign-in, purchases, notifications and Screen Time platform functions.
- Google Cloud (Google Cloud Canada Corporation and Google LLC) hosts the API and permission service in Montréal and serves the website through Firebase. Supabase Pte. Ltd. hosts the database in Canada (ca-central-1).
- Plus Five Five, Inc. (Resend) sends adult permission and confirmation emails and processes their delivery data in the United States. These messages contain no child names, answers, drawings or progress.
- Devon Allary handles adult support directly through Gmail (Google LLC). Cloudflare, Inc. manages DNS and forwards incoming privacy email. Please do not email private child work or journal entries.
The Privacy Policy lists provider contacts and explains restricted access, legal disclosures and processing locations. Some provider operations occur outside Canada. Child records are not made public or sent to unrelated families, churches or schools through these features. Third-party generative-AI processing of child records is disabled; staff-created lesson media is separate. A future disclosure requires an accurate updated notice and any additional permission required by law.
Local private journal
The private prayer journal stores encrypted entries on the child's device. Cloud sync is disabled. Journal entries do not appear in guardian lesson reports. The child's passphrase or recovery code unlocks the journal; a guardian account does not. Its storage directory is excluded from device backups. Disconnecting the device does not itself erase local entries. Use the journal's delete controls. We must approve a parental-rights process before offering cloud sync.
How long information stays
The selected launch schedule is:
- Submitted answers, drawings and copied response text: 7 days from server receipt, with earlier deletion on a valid request.
- Guardian review text: 7 days from the decision. Shared notes and prayer invitations/acknowledgements: 7 days from the last edit to the note or invitation. Copied response text can disappear sooner with its source.
- Minimized learning completions and reports: 365 days, or earlier with profile or household deletion. Inactive child profiles begin removal after 365 days without a profile update or recent learning activity.
- Screen Time operational history: a planning target of 365 days; unacknowledged rule-relay data: a target of 7 days. These limits still need end-to-end verification.
- Local private journal: no server collection or sync. Entries remain on the device until deleted there; no automatic age-based local erasure.
- Verified deletion requests: target active-system purge within 30 calendar days. Backup copies: target rolling expiry within 30 days. Backup expiry and complete erasure are not yet verified; these are planning estimates, not confirmed provider guarantees.
The active-database sweep runs hourly and removes due records on the next successful run. The Privacy Policy explains the different purposes, exceptions and local deletion steps. A shorter retention period applies whenever the information is no longer needed. We do not retain child records indefinitely simply because no one asks us to delete them.
Your choices
You can ask to review, correct, export, or delete your child's information and refuse further collection or use. Use Parent Settings > Privacy and consent record or contact devonallary1@gmail.com. We verify requests proportionately before giving access to child information.
The current in-app withdrawal action starts deletion of the whole household. To stop one child and request deletion of that profile, use Remove child in that child’s settings. Contact us for other scoped requests. Refusing necessary processing may prevent that child's online participation; declining an optional feature does not remove unrelated core features. Removing the app or account does not cancel an Apple subscription; manage that separately with Apple.
If you do not complete consent within 7 days, we delete the contact and setup information collected only to obtain it and do not activate child collection. Any separate adult waitlist subscription follows its own notice and choices.
To give permission, complete the email permission steps described below and then select the applicable choices below. Read the full Privacy Policy.
How to give or withdraw permission
Enter the parent email in the app, read the documents, and confirm the separate Terms, parental authority and processing choices. We email this notice and a link valid for seven days. Opening the link does not give permission: confirm the choices on the page and select Give parental permission. No signed form, ID upload or purchase is needed.
You can then continue in the app. About 24 hours later, we send a confirmation with this notice and a withdrawal link. You do not need to reply again. The email withdrawal link stops further child data collection for the household without automatically deleting existing records. Use Parent Settings to export or delete records. The existing in-app withdrawal-and-deletion action still deletes the household. Cancel any Apple subscription separately.
If the confirmation cannot be sent within 48 hours of your permission, child data collection pauses until delivery succeeds or you withdraw and complete permission again. Contact us for help. These are our service timeframes, not government-prescribed waiting periods.
Resend sends these adult transactional emails and processes your email address, notice, permission links and delivery records in the United States. Emails contain no child names, responses, drawings or progress. We do not use open or click tracking. Our contact copy used only to obtain permission is deleted after seven days if permission is incomplete, or within 30 days after permission or withdrawal. Resend normally retains email data for 30 days. Separately collected adult account contact data follows the account’s disclosed purposes and retention.
We retain a record of the documents you accepted, your language, the permission and confirmation dates, and any withdrawal. Email withdrawal links remain available for up to one year. The in-app privacy controls and our privacy contact remain available after that.