Privacy Policy — Goji Chat
Goji Chat is an app from Narrow Road Studios LLC for ages 8 to 14. The iOS
bundle id is com.narrowroad.gojiChat. The Android id is com.narrowroad.goji_chat. One app has a parent mode and a child
mode. This policy covers Goji Chat. The studio privacy policy is separate and does not restate this page.
Accounts
- Parent sign-in. A parent signs in with an email one-time code. The server stores the parent's auth user id and the email from the sign-in token. A child device cannot become a parent.
- Child profile. The child does not create an email account in the app. A parent creates a child with a display name and an optional age. The age is empty, or it is from 8 through 14. The stored child record has no email, no phone, and no Apple ID.
- Invite. Creating a child produces a 6-character invite code that stops working 14 days after the parent creates the child. The child device signs in anonymously and then redeems the invite code. The device link stores the anonymous auth user id, the child id, a device label whose value is device, and the time the code was redeemed.
On the device
Full threads stay on the device in a Hive box named goji_chat, one message list per child id. The app also caches children, settings, the session, and alerts in that box. The app reads messages only from that local store. This policy does not say the server can erase that box.
On the server
- Supabase. Supabase provides auth, the database, and the chat edge function.
- Settings. The server stores parent settings and reads them. The settings hold standing values, faith notes, a Socratic homework switch, topic blocks, and notify rules. The Socratic homework switch defaults to on. The server always appends the Socratic homework instruction to the xAI system prompt. Topic blocks are dating, violence_news, celebrity_gossip, and scary_content. Notify rules are crisis, self-harm, sexual, violence, hate, abuse, block, and other. Those rules default to on, except other, which defaults to off.
- Alerts. The server stores an alert only for a flagged turn. An alert stores a kind, flags, a reason, a user snippet, an assistant snippet, a context snippet of up to four earlier turns, a created time, a read time, and a pushed-at time. Each snippet is limited to 800 characters. The server has no chat-transcript table. A parent can read and update alerts for that parent's children.
- Push. If a notify rule says to notify, the server records the pushed-at time and does not deliver a push. The app does not collect a push token.
TODO: This page does not link a Supabase privacy policy.
TODO: Push notifications are not implemented, and this policy does not say a push is delivered.
Chat and xAI
A chat request requires the child's signed-in session. The device sends the message list and may send an app user id. That id is the parent id from the signed-in session. The device sends only user and assistant messages. System-role messages from the device are dropped. The server also drops any other role. The server keeps the last 24 turns and cuts each turn's content to 4000 characters.
If an xAI key is set, the server sends the chat completion to xAI at api.x.ai with model grok-3-mini. That request is a system prompt plus those chat turns. The system prompt includes the safety rules and the Socratic homework line. It includes faith notes when they are not empty, and standing values when they are not empty. It includes the blocked-topic labels and a JSON output contract. The server looks up the child display name from the device link. It does not put that name, the child's age, or the parent email into the xAI request. Words the child typed can still appear in the turns that are sent. If the xAI key is unset, the server returns a mock reply and does not call xAI.
TODO: We have not checked whether the hosted server has an xAI key set.
TODO: This page does not link an xAI privacy policy.
TODO: We have not checked whether the live server matches commit c9c5adcc or a newer or older deploy.
Purchases
The app's dependencies do not include a purchases SDK, Sentry, or Firebase. The app does not send a card number or a store receipt. If a RevenueCat secret is set, the server requires the app user id to equal the parent id. The server then asks RevenueCat whether that parent id has an entitlement named pro that is present and unexpired. A positive result is kept in server memory for 15 minutes. If the RevenueCat secret is unset, the server skips the check. This policy does not say RevenueCat receives a purchase. Docs name the products goji_chat_pro_monthly and goji_chat_pro_yearly. The entitlement and the offering are both named pro. The revival plan dated 23 October 2026 says those subscriptions are set up in App Store Connect. The app repo does not wire StoreKit.
RevenueCat's privacy policy is at revenuecat.com/privacy.
TODO: We have not checked whether the hosted server has a RevenueCat secret set.
TODO: This policy does not yet say what Apple or RevenueCat receive once StoreKit is wired.
Children
A child uses the app through a profile the parent creates. This page is product framing, not legal advice. This policy does not state COPPA compliance, Kids Category status, or that xAI's terms allow use under 13.
TODO: Verifiable parental consent is not implemented as a named flow.
Deletion and retention
Deleting the parent auth user deletes the parent row, then the children, the device links, the settings, and the alerts. Invite codes stop working 14 days after the parent creates the child. This policy states no other retention interval. Local Hive data stays on the device. This policy does not say that deleting the server account erases the on-device box.
TODO: We do not know how long xAI keeps prompts and replies.
TODO: We do not know how long Supabase keeps auth logs, database rows, or edge logs beyond deletion of the parent auth user. This policy states no purge interval.
TODO: The app has no control for deleting the server-side account, and this policy does not yet say how a parent asks for that deletion.
Changes
If our data practices change, we will update this page and the effective date above.
Contact
Narrow Road Studios LLC. Email hello@narrowroadstudios.com. The studio privacy policy is at narrowroadstudios.com/privacy. The studio site is at narrowroadstudios.com.