Star Steps · Last updated 31 July 2026
Star Steps is operated by Nathaniel Wray. Contact: n8wray@gmail.com · 518-410-4919 · mystarsteps.com. For anything about your data, email is the fastest route and it reaches the person who built the app.
Star Steps is intended for children aged 3–12 and is therefore a child-directed service under the US Children's Online Privacy Protection Act (COPPA). We also follow the equivalent protections for children under the UK/EU GDPR.
Everything below is used to run the app for you. None of it is used for advertising, profiling for marketing, or sold to anyone.
| What | Examples | Why |
|---|---|---|
| Child profile | First name or nickname, age, avatar, communication mode (verbal / AAC / mixed / non-speaking), special interests, chosen subjects | To personalise activities, adjust difficulty appropriately, and avoid measuring a child on something that reflects how they communicate rather than what they know |
| Learning activity | Answers given, correct/incorrect, response time, skills practised, mastery estimates, session length | To adapt difficulty to your child and to show you their progress |
| Wellbeing signals | Self-reported mood, regulation zone, engagement estimates | To pace sessions kindly — for example, ending before a child hits a wall — and to give you context in the parent area |
| Learning goals | IEP goals and progress notes you or a teacher/therapist enter | To track progress against goals and produce progress summaries you can use |
| Account | Parent/educator email address, parent PIN (stored only as a salted hash — never in readable form), plan status | To sign you in, protect the adult area, and manage any subscription |
| AI companion (optional, off by default) | What the child types or says to "Cosmo" during a chat session | To generate a reply. See The AI companion below |
Star Steps includes an optional AI companion. It is switched off by default and can only be enabled by an adult in the parent area, which is protected by the parent PIN. It can be switched off again at any time.
When it is enabled and your child chats with Cosmo, the conversation text is sent through our server to Anthropic's Claude, which generates the reply. That means this content is processed by a third-party AI provider. We instruct the model never to solicit personal information from a child, and responses pass through a safety layer before being shown. We do not use these conversations to train any AI model. Because this involves sharing a child's input with a third party, we ask for a separate, explicit consent for it — you can decline and still use everything else in Star Steps.
We do not sell data. We do not share it with advertisers or data brokers. We share it only with the service providers that make the app work:
We may disclose information if legally required to do so, or to protect a child's safety.
Data is stored on Google Cloud infrastructure in the United States. We keep your child's information for as long as your account is active. If you delete a profile or your account, we delete the associated data. If an account is inactive for an extended period we may delete it after notifying you at your registered email address.
Accounts are protected by authentication, and the adult area by a parent PIN that is stored only as a salted hash and verified on our server — never held in readable form and never checked on the device alone. Access to each family's data is enforced by server-side rules so that one account cannot read another's. Entitlements and PINs can only be written by our server, not by the app. No system is perfectly secure, but we take this seriously and fix what we find — including issues we discover ourselves.
As a parent or guardian you may, at any time:
Email n8wray@gmail.com and we will action it. We aim to respond within a few days and will not charge you for this.
If a school, clinic, or district uses Star Steps with students, the organisation acts as the educational authority and is responsible for the appropriate consent under COPPA and applicable education-privacy law (such as FERPA in the US). We process student data only to provide the service, never for advertising, and never to build a profile for marketing purposes. Written agreements are available on request.
Star Steps is being studied independently to check whether its "mastery" estimates hold up. Data is included in research only if you have explicitly opted in to research participation, which is separate from ordinary use and can be withdrawn. Research datasets are de-identified before analysis: no names, no free text, and identifiers replaced with random research codes.
If we make a material change — particularly anything affecting children's data — we will update the date at the top and notify account holders by email before it takes effect.