Cookie Notice
Last updated: August 20, 2026
This notice lists the cookies and browser storage Kivvie sets on kivvie.app, what each one is for, and how long it lasts. It also covers the third-party cookies that YouTube sets when a video plays, which we do not control. It sits alongside our Privacy Policy and Terms of Service.
The short version:
We use cookies to keep you signed in, and to measure how the site is used. We do not use advertising cookies, we do not run ad-network trackers, and we do not use cookies to build profiles of children.
1. Cookies We Use
1.1 Strictly Necessary: Sign-In
These keep you signed in and keep your session secure. Kivvie cannot work without them, so they are set whenever you sign in and are not optional.
| Cookie | Purpose | Set by |
|---|---|---|
next-auth.session-token__Secure-next-auth.session-token | Holds your signed-in session so you do not have to log in on every page. The __Secure- version is used over HTTPS. | Kivvie (first party) |
next-auth.csrf-token | Protects sign-in and sign-out requests against cross-site request forgery. | Kivvie (first party) |
next-auth.callback-url | Remembers which page to return you to after Google sign-in completes. | Kivvie (first party) |
Signing in also involves Google, because Kivvie uses Google OAuth. Google may set its own cookies on Google's domains during that step. That is covered by the Google Privacy Policy, not by this notice.
1.2 Analytics: PostHog
We use PostHog to understand how the website is used, so we can fix problems and improve the product. Analytics loads on the live kivvie.app site only. It is switched off in the internal builds we use for development and testing, where no analytics cookie is set at all.
| Cookie | Purpose | Lifetime |
|---|---|---|
ph_<project key>_posthog | Stores a visitor identifier and session identifier so repeat visits are not double counted. Before you sign in this is a random value. Once you sign in, it is set to your Kivvie parent profile identifier, so we can recognise a returning parent and connect an error report to an account we can help. It never contains your name, your email address, or any child's details. | 12 months |
PostHog also keeps related values in your browser's local storage, such as the active feature flags for your session. Clearing site data removes both the cookie and the local storage entries.
What we switch off in PostHog:
- Session replay is disabled - we do not record your screen
- Autocapture is disabled - we do not silently log every click and form interaction
- Rage-click tracking is disabled
- Surveys are disabled
- Web performance autocapture is disabled
- Profiles are created for signed-in users only, not for anonymous visitors
Every analytics event passes through a redaction filter before it leaves your browser. That filter is built on a deny-list: it drops properties whose names match known sensitive patterns, including passwords, access and refresh tokens, API keys, payment card fields, child PINs, search text, and identifiers for child profiles, channels, and videos. It also scans text values for email addresses and token-like strings and replaces them, and strips query strings from web addresses on sign-in, checkout, and callback pages. Because the filter matches on known patterns rather than inspecting every possible value, we treat it as a safety net that backs up our main rule, which is not to attach sensitive data to analytics events in the first place.
1.3 Video Playback: YouTube
Kivvie plays videos through YouTube's player. When a video loads, YouTube may set its own cookies on YouTube domains to support playback. These are third-party cookies controlled by Google, not by Kivvie, and are governed by the Google Privacy Policy and the YouTube Terms of Service.
2. What We Do Not Use
- No advertising cookies - Kivvie shows no advertisements, so there are no ad cookies, ad identifiers, or frequency-capping cookies
- No ad-network or data-broker trackers - we do not load third-party marketing pixels or tags
- No cross-site tracking - we do not track you across unrelated websites
- No cookie-based profiling of children - children use the mobile app, which does not use website cookies to build behavioural profiles
3. How to Control Cookies
You can clear or block cookies at any time in your browser settings. Every major browser lets you delete existing cookies, block new ones, or block third-party cookies only.
Two things worth knowing before you do:
- Blocking the sign-in cookies listed in section 1.1 will sign you out and prevent you from signing back in. Kivvie cannot keep you logged in without them.
- Blocking the analytics cookie does not affect any Kivvie feature. Everything keeps working.
Most browsers also offer a private or incognito window, which discards all cookies when you close it.
4. Changes to This Notice
If we add, remove, or change a cookie, we will update this page and the "Last updated" date above.
5. Contact Us
Questions about cookies or anything else in this notice? Email us at [email protected]. Kivvie is operated by M2V2 Solutions Pty Ltd, Australia.