Privacy policy for Kidoio Kids

This document describes the privacy practices of Kidoio Kids — the kid-side companion app to Kidoio for Parents. Kidoio Kids is a Made for Kids 4+ app on the App Store and follows Apple's Kids Category guidelines, COPPA, and applicable child privacy laws.

Kidoio Kids is designed to be used by children under parental supervision. The app is paired with a parent's Kidoio for Parents account. Children themselves do not create accounts, do not provide personal information, and do not interact with the open internet. The parent curates a watchlist of approved videos; the child plays a short pre-watch question, watches the approved video on YouTube via an in-app player, and earns stars for completion.

1. What we collect from children

1.1 — Information collected automatically by the kid app

• Anonymous performance & crash data. Apple's standard anonymous crash and performance reports are sent to Apple. These are not linked to any identity. No third-party analytics SDKs are present in the kid app.
• Watchlist sync. The kid app fetches the approved-videos list from the parent's account using a short-lived token issued by the parent. The token is the only identifier the kid app sees, and it cannot be used to infer a real-world identity.
• Comprehension answers. When a child completes a pre-watch or post-watch comprehension question, the answer (multiple-choice index, no free-text) is sent back to the parent's account and stored against the parent's record — not against any child identifier.

2. Apple's Kids Category compliance

Kidoio Kids is submitted to the App Store under the Kids Category, Made for Kids, ages 5 and under. The app meets all Kids Category requirements:

• No third-party advertising. Apple-served Apple-curated ads are also disabled.
• No third-party analytics. No Firebase, Mixpanel, Amplitude, Segment, or similar SDKs.
• No external links opened by the child. The only outbound network calls are to kidoio.com (to fetch the approved watchlist) and to YouTube (to play approved videos in an in-app player).
• Parental gate before any sensitive action. The Kidoio Kids app does not have any sensitive actions on the kid side, but if one is added in a future version, a parental gate will guard it.
• No in-app purchases on the kid side. The kid app cannot make purchases. Subscriptions and credit packs (if any) are managed only via the Kidoio for Parents app, behind the parent's Apple ID.
• Privacy policy specifically for children — this document.

3. COPPA notice (US users)

The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before an online service collects personal information from children under 13.

Kidoio Kids does not collect personal information from children. The kid-side app has no account, no sign-in, no name, no email, no contact form, and no upload of any kind. The only data the kid app exchanges with our backend is (a) the parent-issued watchlist token, (b) the indexed answers to a multiple-choice comprehension question, and (c) standard crash/perf telemetry that Apple anonymises.

Because no personal information is collected from a child, COPPA's verifiable parental consent requirement does not attach to the kid-side app. The parent's Kidoio for Parents account, which does hold a name and age band entered by the parent, is governed by our main privacy policy and the parent provides that information voluntarily as the account holder.

If you are a parent in the United States and you believe a Kidoio service has nonetheless collected personal information from your child, contact hello@kidoio.com and we will delete it within 30 days.

4. Third parties the kid app talks to

Strictly limited:

• Kidoio backend at kidoio.com — hosted on Railway. The kid app fetches the parent's approved watchlist and posts comprehension answers.
• YouTube (in-app player). Approved videos are played via the official YouTube iframe embed. YouTube's own privacy policy applies to playback. We do not pass any child identifier to YouTube; the embed plays in privacy-enhanced mode (youtube-nocookie.com) where supported.
• Apple Push Notification Service. The kid app does not request push notifications. APNs is not used by the kid side.

No data is shared with Google, Stripe, Resend, Gemini, Google Analytics, Google AdSense, or any of the other third parties listed in our parent privacy policy. Those integrations live entirely in the Kidoio for Parents app, behind the parent's account.

5. Retention and parental control

• The parent can remove a child profile at any time from the Kidoio for Parents app. This deletes all comprehension answers, watch history, and any record associated with that profile.
• The parent can delete the entire Kidoio account from the Kidoio for Parents app's Settings → Delete Account flow. Account deletion removes all child profiles and associated comprehension answers within 30 days.
• Watchlist tokens issued to the kid device expire automatically and can be revoked from the parent's account.

6. Security

• All traffic between the kid device and our backend uses HTTPS (TLS 1.2+).
• Watchlist tokens are short-lived and signed with a backend secret.
• The kid app does not store any personal data on the device beyond the watchlist cache and an opaque session token.
• The kid app does not include any third-party analytics, ad SDK, or social SDK that could exfiltrate data.

If we discover a security incident affecting child data, we will notify the parent who owns the account within 72 hours, and where applicable will notify the relevant data protection authority.

7. Parent rights and contact

As the account holder, the parent has full control over their child's profile in the Kidoio service. The parent can at any time:

• Review the child's watchlist, comprehension answers, and any data stored against their profile, via the Kidoio for Parents app.
• Revoke the kid device's watchlist access by deleting the kid session from the parent app.
• Remove the child profile from their account.
• Delete their entire Kidoio account.
• Request access to, correction of, or export of any data we hold about their child by emailing hello@kidoio.com. We respond within 30 days.

8. International users

Kidoio Kids is operated from the European Union by GODERUS UAB. Our backend may process data in the United States and other jurisdictions where our infrastructure provider operates. Because the kid app does not collect personal information from children, GDPR's special protections for children's data are not triggered on the kid-app side; the parent's account is governed by our main privacy policy.

9. Changes to this kids policy

If we materially change the data-collection posture of the Kidoio Kids app, we will notify the parent via the Kidoio for Parents app and post a notice here at least 30 days before the change takes effect. Any change that would expand collection from children would require explicit, verifiable parental consent.

10. Contact

Questions, complaints, or data requests:

Email  hello@kidoio.com
Web  kidoio.com

This kids-specific privacy policy supplements our main privacy policy for the parent-side service. Where the two documents conflict for the Kidoio Kids app on a kid device, this document controls. This policy is provided for informational purposes and does not constitute legal advice. Kidoio is operated by GODERUS UAB. By using the Service, you accept this Privacy Policy.