Privacy Policy

Rusty is operated by FOUR STAR GROUP INC (“Rusty,” “we,” “us”). We are the operator responsible for the personal information collected through the Rusty iOS app and the website at www.userusty.com (together, the “Service”).

Rusty is offered in the United States first. The section titled “Other Companies That Handle Information” covers every other company that handles information through the Service and how to contact us about any of them.

Rusty contains two separate experiences with different audiences and different data practices.

Rusty Tutoring — the primary service

• For children roughly ages 6–10, managed entirely by a parent or legal guardian who owns the account.
• Collects child profile information and, when separately authorized, processes live child voice. Everything else in this policy about children applies here.

Rusty Brain Training — Legacy Mode

• The original adult cognitive-training product. It is for adults 18 and older, is not directed to children, and we do not knowingly collect personal information from a child through it.
• It keeps working for people who already use it — including their account, progress, and subscription — but receives no new features.
• It creates no child profiles and does not use the tutoring voice pipeline. Opening it requires passing a parental gate, a simple grown-up check, because it contains purchases, web links, and adult-oriented content. Network friend codes, friend connections, head-to-head challenges, and leaderboards are disabled in the current version. That gate is not an identity check and is separate from the direct-notice, adult-authorization, authority-confirmation, and consent steps used before the tutoring service uploads child information.

• Only an adult can create an account. A child never creates a login, never gives an email address, and never sets a password.
• Children are profiles inside a parent’s family — not separate accounts. The parent creates, edits, archives, and deletes each child profile.
• On-device and cloud profiles work differently. A local profile can be created for one child without uploading child information. Before Rusty uploads child information or starts live voice, the adult must review the direct notice, complete the authorization step shown in the app, and make the required consent choices. See “Adult Authorization Before Child Cloud Features”.

From the parent

• Account information — your email address and, if you sign in with Apple or Google, the identifier and name you allow that provider to share. We never receive your Apple or Google password.
• Family setup — a family name you choose, plus country/region, language, and time zone.
• Adult-authorization result — purchase and server-verification metadata needed to show which authorization route completed and when. Apple processes payment details; Rusty does not receive a full card number. If the app specifically offers the alternate Kids Web Services route, Rusty stores the provider reference and result, not the identity details used on the provider’s page.
• Your consent choices and the history of changes to them, so we can show what you agreed to and when.
• Optional contact preference — if you opt in, an email address for account and privacy-policy updates.
• Purchase and subscription status — whether the family has a credited 10 Voice Minutes balance or an active Premium or Family plan, plus transaction, receipt, entitlement, and usage information needed to provide it. Apple processes payment; we never receive your full card number.

About the child

• Profile basics — first name or a nickname, age, grade or year, and a chosen avatar.
• Learning preferences and goals — subjects you or your child pick, interests, session length, and low-distraction preferences.
• Learning activity — which activities ran, what the child answered in structured activities, how long a session lasted, which skills were practiced, and structured evidence of progress.
• Live voice, while a session is running — the child’s speech is streamed to our AI provider to understand what they said and speak back. See “AI Voice and Text Processing”.
• Safety events — if Rusty detects a possible safety concern, it records a category and a short non-verbatim note so it can alert you. It does not save your child’s exact words.

From an adult using Brain Training (Legacy Mode)

• Account information — your email, username and display name, sign-in provider identifier, and an optional self-described identity or goal label.
• Onboarding answers — the goals, self-reported AI-usage level, and daily-practice commitment you pick when setting up.
• Referral or creator code — if you entered a code from a creator or partner, we store it so the referral can be credited.
• Training results — exercises completed, scores, accuracy and speed, benchmark results, session dates and durations, current and longest streak, and your last active date.
• Historical network-social records — a previously generated friend code, connections, challenges, and weekly activity counts may remain stored with an existing adult account. The current version disables these features and does not show those records to other users. They are removed when you delete the account, subject to the limited retention described below.
• Guest progress — if you train before creating an account, results are held against a temporary device identity and a one-time transfer token so they can move into your account when you sign up.
• Verbal Fluency results — when you use the adult spoken-response exercise, we save the prompt, the full transcript of your spoken answer, the recording length, your scores, measured speaking metrics, and the written coaching. The audio itself is not kept. See “AI Voice and Text Processing”.

Analytics and install attribution

• Product events stay in Rusty’s own systems. They go to Rusty’s own server and are stored in Rusty’s Supabase database. No analytics company receives those product events, and Rusty includes no session-recording SDK.
• Events carry typed values — screen names, counts, durations, outcomes. The app provides no way to attach free text, and the server filters again on arrival.
• No child is identified. The analytics identifier is a random per-install value before sign-in and the adult account holder’s identifier afterwards. A child profile identifier is never used as an analytics identifier and never sent as a property. A child’s name, age, interests, voice, learning content, and safety records are never sent to analytics.
• Meta starts only after Apple’s tracking choice. On the first active screen, before Meta initializes or transmits, iOS asks whether you allow Rusty to track activity across other companies’ apps and websites. After that choice, Meta App Events sends a one-time App Install event and a minimal app-activation/session attribution signal. On later cold launches, it may send the minimal activation/session signal again; it does not resend the App Install event. Meta may receive the Meta app identifier, Rusty’s bundle and version information, an anonymous app-install identifier, device and operating-system details, network information such as IP address, event time, and the device’s limited-ad-tracking status.
• The Meta integration is deliberately restricted. Rusty keeps advertiser tracking and IDFA collection off until Apple’s prompt is answered. They are enabled only after Allow and remain disabled after Ask App Not to Track. Automatic event logging and automatic purchase logging remain disabled for everyone. Rusty does not set a Meta user ID or intentionally send Meta custom events, account details, names, ages, interests, child or family profile identifiers, lesson activity, answers, voice or transcripts, safety records, purchase details, receipts, or subscription information.
• This is not described as “no tracking.” The Meta SDK’s privacy manifest and this install/activation behavior are treated as tracking, and Rusty therefore uses Apple’s App Tracking Transparency framework. For people who decline, Meta’s configured SKAdNetwork and Aggregated Event Measurement paths provide delayed, aggregated campaign measurement without enabling advertiser tracking or IDFA collection. Rusty does not show ads in the app or use its first-party product events to build advertising profiles. Meta processes the limited install and cold-launch activation data under its own terms and privacy policy for advertising measurement.
• Product events may remain after account deletion with the former adult account UUID as an orphaned identifier. The deleted account record is no longer present, and the event still contains no child profile identifier, child content, voice, or safety record. We are reviewing the operational retention window for these events.

Website visitors and creator applicants

• Website request data — our hosting provider may process IP address, browser and device information, requested page, date and time, and security or error logs to deliver and protect the website. Rusty does not run advertising analytics or session recording on the website.
• Browser storage — the website may use session storage to remember that an introductory animation has already played during that browser session. This is not used for advertising or cross-site tracking.
• Creator applications — if an adult submits the creator-program form, we receive the name, email, country, platform and handle, platform choices, follower range, content niches, experience, iPhone access, portfolio link, application answers, availability, and how the applicant heard about Rusty. Supabase stores the application so our team can review and respond to it.

What Rusty deliberately does not collect

These are product decisions enforced in the software, not just promises:

• No saved recordings of your child’s voice. Audio is streamed for the live conversation and is not written to our storage.
• No saved transcripts of what your child said.
• No free-text answers typed by a child are stored. Where a child picks an answer, we store the fixed choice, not free writing.
• No photos or homework uploads. The camera and photo library are not used by Rusty at all.
• No drawings are saved. The whiteboard stays on the device, and Rusty does not interpret it.
• No precise location or contacts; no IDFA or advertiser-identifier collection unless the device user first chooses Allow in Apple’s tracking prompt; no third-party product analytics or session recording. The limited Meta one-time install and recurring cold-launch activation attribution described above is separate from Rusty’s product analytics.

Before Rusty uploads a child profile or processes live child voice, the app shows the direct notice and requires an adult-controlled authorization step plus affirmative consent choices. Core on-device activities do not require child information to be uploaded.

The route currently shown by default is an Apple App Store purchase. The adult may choose10 Voice Minutes, Premium, or Family. Apple processes the transaction; Rusty’s server verifies it and records limited transaction metadata. 10 Voice Minutes is a consumable purchase that adds 10 non-expiring voice minutes to the signed-in Rusty family account. It does not renew. Premium and Family are monthly subscriptions with the limits shown in the app.

Rusty also retains an alternate route using Kids Web Services (KWS), operated by Epic Games, Inc. It applies only when the app specifically displays that route. KWS receives the adult’s email and related verification metadata but no child profile or learning information. Rusty receives the result rather than the private identity details used on KWS’s pages.

This policy describes the routes Rusty actually uses; it does not represent that Rusty is certified, endorsed, or approved by the FTC or a COPPA safe-harbor program. Rusty is obtaining separate legal review of the purchase-based method against the current rule.

Rusty’s tutoring is powered by an AI model. We use Google’s Gemini models on Google Cloud to understand what your child says, generate Rusty’s spoken reply, and notice possible safety concerns during a session.

What is sent to Google

• The child’s live speech while a voice session is open.
• A small amount of context: the name Rusty should use, age, grade, and — only if you turned personalization on — saved goals, interests, and learning preferences.
• Rusty’s own instructions and the results of activities your child completed.

Your child’s device never holds Google credentials. Sessions are routed through Rusty’s own server, which holds the credential and configures the session.

How long Google keeps it

Google states that it does not use this content to train or fine-tune its AI models. Separately, Google runs automated abuse monitoring:

Rusty also uses Google to generate short spoken instructions on some screens. The same terms apply.

Brain Training (Legacy Mode) — Verbal Fluency

Verbal Fluency is an adult-only exercise in Legacy Mode. You are given a prompt, you speak your answer, and Rusty returns a clarity score, measured speaking metrics, and written coaching. It runs only when you start it, and only after iOS has granted microphone access.

• What happens to your recording. A short audio clip is recorded on your device and sent over an encrypted connection to our backend. It is transcribed by OpenAI, and the transcript is then scored for clarity by a language model reached through OpenRouter. We do not keep the audio file itself.
• What is saved to your account. The full transcript of what you said, the prompt, the recording length, your scores, the measured metrics (word count, speaking rate, filler words, repetition), and the written coaching. This is what makes your progress history and benchmarks work, and it is visible only to you.
• Who else can see it. Nobody. These records are protected per-account at the database level. Verbal results are not shown to other users. Network social features are disabled in the current version.
• Providers and their terms. OpenAI and OpenRouter process this content as our service providers in order to return your result. We do not use your speech or transcripts to train any model, and never for advertising. Their own terms govern any short-term retention they perform to operate and abuse-monitor their APIs; we do not control that, and we do not claim a zero-retention arrangement for this feature.
• Do not read the children’s zero-retention statement as covering this. That arrangement is specific to Google and to children’s tutoring sessions. Verbal Fluency uses different providers, on different terms, for adults only.
• Deleting it. Deleting your account removes your verbal sessions along with the rest of your training history.

• Run the tutoring session and the activities inside it.
• Decide what to teach next, based on what your child has actually demonstrated.
• Show you plain-language summaries of what happened in a session.
• Show a parent handoff and keep a minimal safety record when a narrow rule fires.
• Keep the Service secure, prevent abuse, and fix problems.
• Measure which Meta advertising campaigns lead to app installs and attribute the minimal activation/session signal sent on first and later cold launches.
• Provide and reconcile subscriptions, and meet our legal obligations.

We keep children’s personal information only as long as is reasonably necessary for the purpose it was collected for. We do not keep it indefinitely. The full schedule is on our Child Data Retention page. In summary:

Brain Training (Legacy Mode)

Your adult account profile, training results, streaks, benchmarks, and Verbal Fluency sessions — including their transcripts — are kept while your account is active, so your long-term progress stays meaningful to you. Historical friend connections and challenge records may also remain stored, but network social features are disabled and those records are not shown to other users. Deleting your account removes all of this, subject only to narrowly required legal, fraud-prevention, security, and backup retention. Guest progress held against a temporary device identity expires if it is never claimed by an account.

Website and creator applications

Website request and security logs are kept only as long as reasonably needed to deliver, secure, and troubleshoot the site under our hosting provider’s configured retention. Browser session storage ends with the browser session or when you clear it. Creator applications are kept while we evaluate the application and, if accepted, while needed to manage the creator relationship; applicants may request deletion at any time by emailing the privacy address above. We are documenting a fixed stale-application deletion window before expanding that program.

Meta install and activation attribution

Rusty does not keep a separate copy of the Meta App Install or app-activation/session attribution events. Meta controls its own event retention and deletion practices under Meta’s terms and privacy policy; Rusty does not claim a Meta retention period it cannot verify. Contact us at privacy@userusty.com if you want help understanding or exercising rights related to this attribution.

At any time, and without giving a reason, you can:

• Review the personal information Rusty holds about your child, and export it as a file.
• Correct your child’s profile details.
• Refuse further collection — turn off voice, personalization, or summaries, or archive the profile.
• Revoke your consent, which stops the affected processing going forward.
• Delete an individual child’s information, or your entire account and family.

Most of this is self-service in the app under Parent Settings → Account and the selected child’s privacy controls. You can also email privacy@userusty.com. Because these requests concern a child’s information, we take reasonable steps to confirm we are dealing with the child’s parent before acting. Full instructions are on our Contact & Privacy Rights page.

If you revoke consent for something a feature depends on, that feature stops working. If you revoke consent for voice, Rusty’s spoken tutoring stops; the rest of the profile remains until you delete it.

We use administrative, technical, and physical safeguards intended to protect children’s personal information, including encryption in transit and at rest, restricted access, family-level database isolation, sibling separation, and controls that keep a child-linked device from parent settings and other children. We review these safeguards and the service providers that handle child information on a recurring basis.

No system is perfectly secure. If a breach affects children’s personal information, we will notify affected parents and any regulators as required by law.

If we materially change how we collect, use, or disclose children’s personal information, we will send you a new direct notice and obtain your consent again before the change applies to your child. We will also update the date at the top of this page.

The companies below handle information for the limited purposes described in this policy. Most act as service providers under terms that require them to protect the information and limit its use. Meta’s one-time install and recurring cold-launch activation attribution role is different: Meta processes the limited app, device, and network data under its own terms and privacy policy for advertising measurement. Rusty does not intentionally send Meta account, child-profile, learning, voice, safety, or purchase information. The current list, with what each one receives, is on our Service Providers page.

They include Supabase (accounts, database, server functions), Google (Gemini on Google Cloud, for live child speech when authorized), Epic Games / Kids Web Services (the alternate adult-authorization route when displayed — it receives adult information only), Apple (sign-in and payments), RevenueCat (subscription entitlements), Meta (one-time app-install and recurring cold-launch activation/session attribution for campaign measurement only), OpenAI and OpenRouter (transcription and clarity scoring for the adult Verbal Fluency exercise only — they never receive a child’s information), Resend (account and notification emails), and Vercel (website hosting and security logs).

Disabled network social features (Legacy Mode)

The current version of Brain Training disables friend codes, friend connections, head-to-head challenges, and leaderboards. Rusty does not display network-social records to other users. Historical records may remain stored with an existing adult account so we do not silently discard account data, but they are unavailable in the app and are removed when you delete the account, subject to the limited legal, security, fraud-prevention, and backup retention described above.

You may contact us at privacy@userusty.com about any of them, and we will respond to questions about all of our providers’ practices.

Email privacy@userusty.com. You may also contact the U.S. Federal Trade Commission at ftc.gov.

Rusty is not certified, endorsed, or approved by the Federal Trade Commission or by any COPPA safe-harbor program, and we do not claim to be. This policy describes our actual practices.