Privacy Policy

Rusty is operated by FOUR STAR GROUP INC (“Rusty,” “we,” “us”). We are the operator responsible for the personal information collected through the Rusty iOS app and the website at www.userusty.com (together, the “Service”).

Rusty is offered in the United States first. The section titled “Other Companies That Handle Information” covers every other company that handles information through the Service and how to contact us about any of them.

The current Rusty app provides one parent-managed tutoring experience. This policy also explains how Rusty handles information retained from its retired adult Brain Training product.

Rusty Tutoring — the primary service

• For children ages 4–12, managed entirely by a parent or legal guardian who owns the account.
• Collects child profile information and, when separately authorized, processes live child voice. Everything else in this policy about children applies here.

Retired Rusty Brain Training — historical records

• The former product was an adult cognitive-training experience for people 18 and older. It was not directed to children.
• Brain Training access, exercises, and purchase surfaces are no longer offered in the current app, and Rusty does not collect new training activity through that retired experience.
• Historical adult records remain separate from child profiles and the tutoring voice pipeline. They remain subject to the access, export, correction, and deletion rights described below.

• Only an adult can create an account. A child never creates a login, never gives an email address, and never sets a password.
• Children are profiles inside a parent’s family — not separate accounts. The parent creates, edits, archives, and deletes each child profile.
• The adult account comes first. Before Rusty creates a cloud learner or starts live voice, the adult must sign in, set a parent PIN, review the direct notice, complete the authorization step shown in the app, and make the required consent choices. See “Adult Authorization Before Child Cloud Features”.

From the parent

• Account information — your email address and, if you sign in with Apple or Google, the identifier and name you allow that provider to share. We never receive your Apple or Google password.
• Family setup — a family name you choose, plus country/region, language, and time zone.
• Adult-authorization result — purchase and server-verification metadata needed to show which authorization route completed and when. Apple processes payment details; Rusty does not receive a full card number. If the app specifically offers the alternate Kids Web Services route, Rusty stores the provider reference and result, not the identity details used on the provider’s page.
• Your consent choices and the history of changes to them, so we can show what you agreed to and when.
• Optional contact preference — if you opt in, an email address for account and privacy-policy updates.
• Purchase and subscription status — whether the family uses Free or has an active Premium or Family plan, plus transaction, receipt, entitlement, and usage information needed to provide the selected plan. Apple processes payment; we never receive your full card number.

About the child

• Profile basics — first name or a nickname, age, grade or year, and a chosen avatar.
• Learning preferences and goals — subjects you or your child pick, interests, session length, and low-distraction preferences.
• Learning activity — which activities ran, what the child answered in structured activities, how long a session lasted, which skills were practiced, and structured evidence of progress.
• Live voice, while a session is running — the child’s speech is streamed to our AI provider to understand what they said and speak back. See “AI Voice and Text Processing”.
• Safety events — if Rusty detects a possible safety concern, it records a category and a short non-verbatim note so it can alert you. It does not save your child’s exact words.

Historical information from retired adult Brain Training

Rusty no longer collects new activity through Brain Training. Depending on how a former adult user used the product, retained historical records may include:

• Account information — your email, username and display name, sign-in provider identifier, and any optional self-described identity or goal label you provided.
• Onboarding answers — the goals, self-reported AI-usage level, and daily-practice commitment you selected when setting up.
• Referral or creator code — any code you previously entered from a creator or partner.
• Training results — exercises completed, scores, accuracy and speed, benchmark results, session dates and durations, current and longest streak, and your last active date.
• Historical network-social records — a previously generated friend code, connections, challenges, and weekly activity counts may remain stored with an existing adult account. Those retired features are unavailable, and Rusty does not show the records to children or other users. They are removed when you delete the account, subject to the limited retention described below.
• Guest progress — results previously held against a temporary device identity and one-time transfer token may remain until their ordinary expiry if they were never claimed by an account.
• Verbal Fluency results — if you used the former adult spoken-response exercise, Rusty saved the prompt, the full transcript of your spoken answer, the recording length, your scores, measured speaking metrics, and the written coaching. The audio itself was not kept. See “AI Voice and Text Processing”.

Analytics and install attribution

• Product events stay in Rusty’s own systems. They go to Rusty’s own server and are stored in Rusty’s Supabase database. No analytics company receives those product events, and Rusty includes no session-recording SDK.
• Events carry typed values — screen names, counts, durations, outcomes. The app provides no way to attach free text, and the server filters again on arrival.
• No child is identified. The analytics identifier is a random per-install value before sign-in and the adult account holder’s identifier afterwards. A child profile identifier is never used as an analytics identifier and never sent as a property. A child’s name, age, interests, voice, learning content, and safety records are never sent to analytics.
• Meta starts only after Apple’s tracking choice. On the first active screen, before Meta initializes or transmits, iOS asks whether you allow Rusty to track activity across other companies’ apps and websites. After that choice, Meta App Events sends a one-time App Install event and a minimal app-activation/session attribution signal. On later cold launches, it may send the minimal activation/session signal again; it does not resend the App Install event. Meta may receive the Meta app identifier, Rusty’s bundle and version information, an anonymous app-install identifier, device and operating-system details, network information such as IP address, event time, and the device’s limited-ad-tracking status.
• The Meta integration is deliberately restricted. Rusty keeps advertiser tracking and IDFA collection off until Apple’s prompt is answered. They are enabled only after Allow and remain disabled after Ask App Not to Track. Automatic event logging and automatic purchase logging remain disabled for everyone. Rusty does not set a Meta user ID or intentionally send Meta custom events, account details, names, ages, interests, child or family profile identifiers, lesson activity, answers, voice or transcripts, safety records, purchase details, receipts, or subscription information.
• This is not described as “no tracking.” The Meta SDK’s privacy manifest and this install/activation behavior are treated as tracking, and Rusty therefore uses Apple’s App Tracking Transparency framework. For people who decline, Meta’s configured SKAdNetwork and Aggregated Event Measurement paths provide delayed, aggregated campaign measurement without enabling advertiser tracking or IDFA collection. Rusty does not show ads in the app or use its first-party product events to build advertising profiles. Meta processes the limited install and cold-launch activation data under its own terms and privacy policy for advertising measurement.
• Product events may remain after account deletion with the former adult account UUID as an orphaned identifier. The deleted account record is no longer present, and the event still contains no child profile identifier, child content, voice, or safety record. We are reviewing the operational retention window for these events.

Website visitors and creator applicants

• Website request data — our hosting provider may process IP address, browser and device information, requested page, date and time, and security or error logs to deliver and protect the website. We use Vercel Web Analytics for aggregate visitor, page-view, download, challenge-progress, and outbound app-link measurement. Challenge events include only the day number, content type, asset name, and a short campaign source label; they do not include answers or child profile information. Rusty does not run advertising analytics or session recording on the website.
• Browser storage — the website may use session storage to remember that an introductory animation has already played during that browser session. The free challenge uses local storage to remember completed day numbers and a short campaign source label on that device. It does not store a child's name, answers, age, voice, or learning content, and it is not used for advertising or cross-site tracking.

What Rusty deliberately does not collect

These are product decisions enforced in the software, not just promises:

• No saved recordings of your child’s voice. Audio is streamed for the live conversation and is not written to our storage.
• No saved transcripts of what your child said.
• No free-text answers typed by a child are stored. Where a child picks an answer, we store the fixed choice, not free writing.
• No photos or homework uploads. The camera and photo library are not used by Rusty at all.
• No drawings are saved. The whiteboard stays on the device, and Rusty does not interpret it.
• No precise location or contacts; no IDFA or advertiser-identifier collection unless the device user first chooses Allow in Apple’s tracking prompt; no third-party product analytics or session recording. The limited Meta one-time install and recurring cold-launch activation attribution described above is separate from Rusty’s product analytics.

Before Rusty uploads a child profile or processes live child voice, the app shows the direct notice and requires an adult-controlled authorization step plus affirmative consent choices. Activity-only practice remains available when voice is not enabled or the weekly voice allowance has been used.

A Free account includes one cloud learner and 10 shared voice minutes per local week. That allowance renews weekly and is not a consumable purchase. Premium and Family are optional monthly App Store subscriptions with the limits shown in the app; Family supports up to four learner profiles. Apple processes paid transactions, and Rusty’s server verifies them and records limited transaction metadata.

Rusty also retains an alternate route using Kids Web Services (KWS), operated by Epic Games, Inc. It applies only when the app specifically displays that route. KWS receives the adult’s email and related verification metadata but no child profile or learning information. Rusty receives the result rather than the private identity details used on KWS’s pages.

This policy describes the routes Rusty actually uses; it does not represent that Rusty is certified, endorsed, or approved by the FTC or a COPPA safe-harbor program. Rusty is obtaining separate legal review of the purchase-based method against the current rule.

Rusty’s tutoring is powered by an AI model. We use Google’s Gemini models on Google Cloud to understand what your child says, generate Rusty’s spoken reply, and notice possible safety concerns during a session.

What is sent to Google

• The child’s live speech while a voice session is open.
• A small amount of context: the name Rusty should use, age, grade, and — only if you turned personalization on — saved goals, interests, and learning preferences.
• Rusty’s own instructions and the results of activities your child completed.

Your child’s device never holds Google credentials. Sessions are routed through Rusty’s own server, which holds the credential and configures the session.

How long Google keeps it

Google states that it does not use this content to train or fine-tune its AI models. Separately, Google runs automated abuse monitoring:

Rusty also uses Google to generate short spoken instructions on some screens. The same terms apply.

Historical Brain Training processing — Verbal Fluency

Verbal Fluency was an adult-only exercise in the retired Brain Training product. When a former user chose to run it, Rusty recorded a short spoken answer after iOS granted microphone access, then returned a clarity score, measured speaking metrics, and written coaching. Rusty no longer offers or runs this exercise.

• What happened to the recording. A short audio clip was recorded on the adult’s device and sent over an encrypted connection to our backend. It was transcribed by OpenAI, and the transcript was then scored for clarity by a language model reached through OpenRouter. Rusty did not keep the audio file itself.
• What is saved to your account. The full transcript of what you said, the prompt, the recording length, scores, measured metrics (word count, speaking rate, filler words, repetition), and written coaching may remain with the historical adult account. These records are not shown in a child profile or to other users.
• Who else can see it. Nobody. These records are protected per-account at the database level. Verbal results are not shown to children or other users.
• Providers and their terms. OpenAI and OpenRouter processed this content as service providers in order to return the result. Rusty did not use adult speech or transcripts to train a model or for advertising. Their own terms governed any short-term retention used to operate and abuse-monitor their APIs; Rusty did not claim a zero-retention arrangement for that retired feature. They receive no new Brain Training content now that the experience is retired.
• Do not read the children’s zero-retention statement as covering this. That arrangement is specific to Google and to children’s tutoring sessions. Historical Verbal Fluency processing used different providers, on different terms, for adults only.
• Deleting it. A verified account-deletion request removes historical verbal sessions along with the rest of the adult training history, subject to the limited retention described below.

• Run the tutoring session and the activities inside it.
• Decide what to teach next, based on what your child has actually demonstrated.
• Show you plain-language summaries of what happened in a session.
• Show a parent handoff and keep a minimal safety record when a narrow rule fires.
• Keep the Service secure, prevent abuse, and fix problems.
• Measure which Meta advertising campaigns lead to app installs and attribute the minimal activation/session signal sent on first and later cold launches.
• Provide and reconcile subscriptions, and meet our legal obligations.

We keep children’s personal information only as long as is reasonably necessary for the purpose it was collected for. We do not keep it indefinitely. The full schedule is on our Child Data Retention page. In summary:

Historical adult Brain Training records

An adult account profile, training results, streaks, benchmarks, and Verbal Fluency sessions — including transcripts — may remain with the historical account so Rusty can protect the records and honor access, export, correction, or deletion requests. Historical friend connections and challenge records may also remain stored, but those retired features are unavailable and the records are not shown to children or other users. A verified account-deletion request removes this information, subject only to narrowly required legal, fraud-prevention, security, and backup retention. Guest progress held against a temporary device identity expires if it is never claimed by an account.

Website and creator applications

Website request and security logs are kept only as long as reasonably needed to deliver, secure, and troubleshoot the site under our hosting provider’s configured retention. Browser session storage ends with the browser session or when you clear it. Creator applications are kept while we evaluate the application and, if accepted, while needed to manage the creator relationship; applicants may request deletion at any time by emailing the privacy address above. We are documenting a fixed stale-application deletion window before expanding that program.

Meta install and activation attribution

Rusty does not keep a separate copy of the Meta App Install or app-activation/session attribution events. Meta controls its own event retention and deletion practices under Meta’s terms and privacy policy; Rusty does not claim a Meta retention period it cannot verify. Contact us at privacy@userusty.com if you want help understanding or exercising rights related to this attribution.

At any time, and without giving a reason, you can:

• Review the personal information Rusty holds about your child, and export it as a file.
• Correct your child’s profile details.
• Refuse further collection — turn off voice, personalization, or summaries, or archive the profile.
• Revoke your consent, which stops the affected processing going forward.
• Delete an individual child’s information, or your entire account and family.

Most of this is self-service in the app under Parent Settings → Account and the selected child’s privacy controls. You can also email privacy@userusty.com. Because these requests concern a child’s information, we take reasonable steps to confirm we are dealing with the child’s parent before acting. Full instructions are on our Contact & Privacy Rights page.

If you revoke consent for something a feature depends on, that feature stops working. If you revoke consent for voice, Rusty’s spoken tutoring stops; the rest of the profile remains until you delete it.

We use administrative, technical, and physical safeguards intended to protect children’s personal information, including encryption in transit and at rest, restricted access, family-level database isolation, sibling separation, and controls that keep a child-linked device from parent settings and other children. We review these safeguards and the service providers that handle child information on a recurring basis.

No system is perfectly secure. If a breach affects children’s personal information, we will notify affected parents and any regulators as required by law.

If we materially change how we collect, use, or disclose children’s personal information, we will send you a new direct notice and obtain your consent again before the change applies to your child. We will also update the date at the top of this page.

The companies below handle information for the limited purposes described in this policy. Most act as service providers under terms that require them to protect the information and limit its use. Meta’s one-time install and recurring cold-launch activation attribution role is different: Meta processes the limited app, device, and network data under its own terms and privacy policy for advertising measurement. Rusty does not intentionally send Meta account, child-profile, learning, voice, safety, or purchase information. The current list, with what each one receives, is on our Service Providers page.

They include Supabase (accounts, database, server functions), Google (Gemini on Google Cloud, for live child speech when authorized), Epic Games / Kids Web Services (the alternate adult-authorization route when displayed — it receives adult information only), Apple (sign-in and payments), RevenueCat (subscription entitlements), Meta (one-time app-install and recurring cold-launch activation/session attribution for campaign measurement only), OpenAI and OpenRouter (historical transcription and clarity scoring for the retired adult Verbal Fluency exercise only; they receive no new Brain Training content and never receive a child’s information), Resend (account and notification emails), and Vercel (website hosting, security logs, and aggregate website analytics).

Historical adult network-social records

The retired Brain Training product previously included friend codes, friend connections, head-to-head challenges, and leaderboards. Those features are no longer available. Rusty does not display historical network-social records to children or other users. Records may remain with an existing adult account so Rusty can protect the data and honor privacy requests; they are removed through verified account deletion, subject to the limited legal, security, fraud-prevention, and backup retention described above.

You may contact us at privacy@userusty.com about any of them, and we will respond to questions about all of our providers’ practices.

Email privacy@userusty.com. You may also contact the U.S. Federal Trade Commission at ftc.gov.

Rusty is not certified, endorsed, or approved by the Federal Trade Commission or by any COPPA safe-harbor program, and we do not claim to be. This policy describes our actual practices.