Legal
Service Providers
Last updated: September 13, 2026
This page lists the companies that handle information through the Rusty app and website, what each one does, and which information it can receive. It also identifies providers that historically processed adult Brain Training data before that interface was retired.
Providers That Can Receive a Child's Information
| Company | What it does for Rusty | What it receives | Where |
|---|---|---|---|
| Google LLC | Gemini AI models on Google Cloud — understands the child's speech, generates Rusty's spoken reply, and helps notice safety concerns | Live speech during a session; the name Rusty uses, age, grade; interests only if personalization is on | United States |
| Supabase, Inc. | Database, authentication, file storage, server functions, first-party product events, and creator-application storage | Family account, child profiles, learning records, consent and authorization records; historical adult Brain Training records and creator-application fields where applicable | United States |
| Apple Inc. | App distribution, Sign in with Apple, payment processing, and the adult-controlled purchase used by the current authorization route | Purchase and receipt data; the identifier and email you allow Apple to share. Rusty does not send Apple child profile or learning data. | United States |
Providers That Handle Adult Information or Historical Adult Records
| Company | What it does for Rusty | What it receives | Where |
|---|---|---|---|
| Epic Games, Inc. | Kids Web Services — alternate adult-authorization route, only when that route is displayed in the app | Adult email address, coarse region, language, and a random reference code. No child profile or learning information. | United States |
| Google LLC | Sign in with Google, for the parent account only | The identifier and email you allow Google to share | United States |
| RevenueCat, Inc. | Manages family subscription status and entitlements | A pseudonymous account identifier and subscription state. No child learning data. | United States |
| Resend (Plus Five Five, Inc.) | Sends account emails and, when enabled, parent notifications | Parent email address and the message content | United States |
| Vercel Inc. | Hosts and protects the public Rusty website | Visitor IP address, browser/device and request information, requested page, time, and security or error logs. No child learning data is collected through the website. | United States and other locations used by Vercel's hosting network |
| OpenAI, L.L.C. | Historically transcribed spoken answers in the retired adult Verbal Fluency exercise | Previously received an audio clip an adult chose to record, and nothing else. It receives no new Brain Training data. Never a child's voice or child profile information. Rusty did not use the content to train models. | United States |
| OpenRouter, Inc. | Historically routed clarity-scoring requests for the retired adult Verbal Fluency exercise | Previously received the transcript of an adult's spoken answer and the exercise prompt. It receives no new Brain Training data. Never a child's voice, transcript, or profile information. Rusty did not use the content to train models. | United States |
The former Brain Training interface is discontinued. No current app path sends adult audio, transcripts, or scoring requests to OpenAI or OpenRouter. They remain listed here to explain prior processing associated with historical adult records that may still be subject to an access, export, correction, or deletion request.
Install and Cold-Launch Activation Attribution
| Company | What it does for Rusty | What it receives | Where |
|---|---|---|---|
| Meta Platforms, Inc. | One-time app-install attribution, recurring cold-launch activation/session attribution, and Meta advertising campaign measurement | Meta app identifier; Rusty bundle and version information; an anonymous app-install identifier; device and operating-system details; network information such as IP address; event time; and tracking-choice status. Meta initializes only after Apple's ATT decision. Advertiser tracking and IDFA collection are enabled only after Allow and remain disabled after Ask App Not to Track. Automatic event and purchase logging remain disabled. Rusty sets no Meta user ID and intentionally sends no custom, account, child, learning, voice, safety, or purchase data. | United States and other locations used by Meta under its terms and privacy policy |
Before Meta initializes or transmits, iOS presents Apple’s tracking prompt on the first active screen. After that decision, the App Install event is sent once and a minimal activation/session signal may be sent on later cold launches. This is not described as an adult-only integration. Rusty does not keep a separate copy of the events, and Meta controls their retention and deletion practices. The Meta SDK’s privacy manifest and its one-time install plus recurring cold-launch activation behavior are treated as tracking. If permission is declined, advertiser tracking and IDFA collection remain disabled and Meta uses the configured SKAdNetwork/Aggregated Event Measurement path for aggregated measurement.
What We Do Not Use
Rusty has no advertising network that displays ads inside the app, no social-media plug-ins, no session-recording SDK, and no third-party product-analytics SDK. The only advertising measurement SDK is the narrowly configured Meta App Events integration described above.
Product analytics stays first-party. Structured product events are stored only in Rusty’s own Supabase database. No analytics company receives those product events, and none is sent to Meta.
Changes to This List
If we add a provider that can receive a child’s personal information, we will update this page. If the change is material to what we collect, use, or disclose, we will also send you a new direct notice and ask for your consent again, as described in our Privacy Policy.