Privacy Policy

Kivvie is operated by M2V2 Solutions Pty Ltd, a company registered in Australia, which is the data controller responsible for the personal information described here. We built Kivvie around privacy and child safety. This policy explains what we collect, how we use it, and how we protect it. For a plain-English overview of the app, see our whitelist parental control feature or read about how we remove YouTube Shorts. Our Terms of Service covers the legal agreement between you and Kivvie.

1. Information We Collect

1.1 Account Information

When you sign in with Google, we collect:

• Email address - To identify your account, send important service notifications, and newsletters (you can opt out)
• Name - To personalize your experience
• Profile picture - Optional, for account identification
• Birthdate - Used only for age verification during sign-up to comply with COPPA. We verify you are 18+ but do not store your birthdate after verification.

Important: We never see your Google password. Authentication goes through Google's OAuth 2.0 system. We get temporary access tokens to search YouTube channels on your behalf. Those tokens are not stored permanently or shared with anyone.

Age Verification (COPPA Compliance)

To ensure proper parental consent as required by COPPA, we verify that all users are 18 years or older during the sign-up process. We access your birthdate from your Google account for this one-time verification. Your birthdate is not stored after verification is complete. Users under 18 years of age cannot create accounts or use Kivvie.

1.2 Child Profile Information

For each child profile you create, we may store:

• Child's name or nickname - Stored within your account and not sent to analytics providers
• Age or birthdate - Optional, used only to help parents choose appropriate settings and starter channel ideas
• Profile picture - Optional, for profile identification within the app
• Approved channels - List of approved YouTube channels for each child
• Custom playlists - Playlist names, the child profile they belong to, selected YouTube video IDs, video order, and the time each video was added
• Public YouTube metadata - For playlist videos, we may store the title, thumbnail, description, channel ID and name, duration, view count, publication date, and language returned by YouTube. The playlist data Kivvie sends to a child's device leaves out the source channel identity and video description
• Content settings - Preferences for Shorts and comments visibility
• Viewing preferences - Optional settings to personalize the experience
• Watch history and duration - On paid plans only, we record which videos a child watches, keeping one entry per video containing the video title and identifier, the channel it came from, its thumbnail image address, the furthest point watched, the video length, how many times it was opened, and the first and last time it was watched. Views under 10 seconds are not recorded. Rewatching a video updates its existing entry rather than creating a new one, so this is a per-video record and not a session-by-session log. It exists solely to display this information to the parent who owns that profile in the dashboard Activity page. Recording begins when a paid plan starts; we do not record watch history on the free plan. If a paid plan ends, all watch history is permanently deleted. This data is never used for algorithmic recommendations or advertising, and is never shared with anyone outside your account. A parent can turn watch-history recording off for any child at any time in Settings, which stops future recording without affecting other paid features, and can erase a child's existing watch history at any time from the Activity page, on any plan

Important: All child information is controlled entirely by parents and stored securely. We do not sell children's information or share it for advertising.

1.3 Usage Information

We may collect:

• Device and technical information such as platform, operating system, app version, browser type, screen size, and coarse location inferred from IP address
• App and website usage statistics such as page views, features used, onboarding steps, channel search result counts, session duration, and playback reliability events
• Error logs, crash reports, and diagnostic events used to improve service stability
• Product analytics through PostHog, our analytics service provider. On our website, session replay, surveys, autocapture, rage-click tracking, and web performance autocapture are turned off, and analytics profiles are created only for signed-in users. We do not send child names, PINs, raw search text, OAuth tokens, payment credentials, raw child profile IDs, raw channel/video IDs, or hashed channel/video IDs to PostHog.
• Marketing measurement through Meta Pixel on public website pages only (homepage, pricing, blog, login, and similar). It records a PageView with ordinary browser signals so we can tell whether our parent-facing ads work. We do not send Advanced Matching fields such as email or phone. We do not send child names, ages, PINs, child profile IDs, approved channels, playlist contents, watch history, or any other child information to Meta. The pixel does not load on signed-in dashboard, onboarding, admin, or watch pages, and it is not in the child mobile app. Meta's handling of those page-view signals is covered by the Meta Privacy Policy.

1.4 Payment and Billing Information

If you subscribe to a paid plan, payments are processed by Airwallex Pty Ltd (ABN 29 609 653 312), a PCI DSS Level 1 certified payment processor. We do not collect, see, or store your full card number, CVV, or other sensitive payment credentials.

What we receive and store:

• Transaction records -- Subscription type, amount paid, currency, and payment date
• Subscription status -- Your current plan, billing period, and renewal date
• Payment processor identifiers -- Customer and subscription IDs used to manage your billing with Airwallex

What we never see or store:

• Your full credit or debit card number
• Your CVV or security code
• Your card PIN

Your card details are entered directly into Airwallex's secure payment form and transmitted to Airwallex via encrypted connections. Airwallex's handling of your payment data is governed by their Privacy Policy.

Children and payments: Payment and billing features are only accessible to parent/guardian accounts. Child profiles cannot access billing information or make purchases.

2. How We Use Your Information

We use collected information to:

• Provide the service - Sign you in, save and sync your choices, check playlist videos, and deliver video content
• Maintain security - Protect your account from unauthorized access
• Improve functionality - Identify and fix bugs, optimize performance
• Communicate with you - Send essential service updates, newsletters, product announcements, and respond to support requests

Marketing Communications: We may send you newsletters and promotional emails. You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or updating your email preferences in your account settings. Service-related emails (e.g., security alerts, account notifications) cannot be opted out of.

We never sell your data. Children's information is never shared with advertisers or sent to Meta. Public marketing pages load Meta Pixel so we can measure parent-facing ads with a PageView only. It does not run in the child app or on signed-in parent pages, and it never receives child data.

3. YouTube API Services and Google Privacy Policy

Kivvie uses YouTube API Services to search for channels, validate videos selected for custom playlists, retrieve public video metadata, and provide playback. The Google Privacy Policy explains how Google handles information from YouTube and its player.

Important YouTube API disclosures:

• We access YouTube data to search for channels and retrieve metadata for channel videos and specific videos selected by parents
• We store YouTube video IDs and public metadata so we can maintain custom playlists and check whether their videos remain available and eligible for playback
• We do not store YouTube video content on our servers
• Playback uses YouTube's player. YouTube may process device, playback, and usage information under Google's privacy practices
• You can revoke Kivvie's access to your Google account at any time through your Google Account settings

4. Data Storage and Security

Here is how we protect your data:

• Encryption - All data is encrypted in transit (HTTPS) and at rest
• Authentication - OAuth 2.0 through Google. We never see your password
• Access controls - Internal access policies and audit logging
• Security monitoring - We monitor for vulnerabilities on an ongoing basis

Your data is stored securely using Supabase infrastructure with automatic backups and redundancy.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

We may share limited information only in these circumstances:

• With your consent - When you explicitly authorize data sharing
• Service providers - Companies that help us run Kivvie, including hosting, authentication, payments, analytics, and diagnostics providers. They are bound by their own terms of service and privacy commitments to us, and may use the data only to provide their service to Kivvie. Section 9 explains where these providers are located and the current state of our transfer safeguards
• Legal requirements - When required by law or to protect rights and safety

6. Children's Privacy

Kivvie is for children, but parents manage it. We build and operate Kivvie with child privacy and online safety laws in mind, including COPPA (Children's Online Privacy Protection Act), the Australian Privacy Act 1988, and Australia's online safety framework. If you are in the European Economic Area or the United Kingdom, section 10 covers how the GDPR applies to children's information.

Our Approach to Children's Privacy:

• Children can't create accounts - All accounts require parental authentication via Google. Children never provide information directly
• Parents control everything - Child profiles are created and managed only by verified parents or legal guardians
• Limited child profile data - From parents, we collect a child's name or nickname, optional age, approved channels, custom playlist choices, and content settings
• No tracking for algorithms - We may collect watch history and duration so parents can see it in the dashboard, but we never build behavioral profiles or use it for recommendations or advertising
• No ads - Kivvie does not show advertisements to children
• No advertising sharing -- Children's information is never sold or shared with advertisers, data brokers, or Meta. Meta Pixel on public marketing pages does not receive any child data

Australian Social Media Age Restrictions:

Kivvie is designed as a parent-controlled filtering and viewing service, not as an age-restricted social media platform under Australia's Social Media Minimum Age obligation. It:

• Does not allow children to create YouTube accounts, social media accounts, or Kivvie parent accounts
• Does not provide public child profiles, messaging, comments, posting, following, friending, or peer-to-peer interaction
• Does not use child viewing data for recommender systems or behavioral ranking
• Provides a video viewing environment where parents control approved channels, individual custom playlist videos, and child profiles
• Offers optional Channel Packs -- community-recommended channel bundles, not sponsored or paid
• May disclose limited information to regulators or law enforcement only when the law, a court order, or a valid regulatory notice requires it

Parental Rights:

Parents have full control and can:

• Review all information collected about their children
• Request deletion of child profiles and all associated data at any time
• Refuse further collection or use of their child's information
• Control the approved channels and custom playlist videos their children can access

7. Your Choices

You may:

• Request your data - Ask for a copy of the information we hold about you
• Correct information - Ask us to update or correct inaccurate data
• Delete your account - Request deletion of your account and associated data, subject to our data retention obligations
• Revoke permissions - Remove Kivvie's access to your Google account through your Google Account settings

We respond to these requests as quickly as we can. We may decline only where the law requires or permits us to, for example where we must retain billing records for tax purposes. If you are in the European Economic Area or the United Kingdom, section 10 sets out additional rights and a binding one-month response deadline that we honour.

8. Data Retention

We retain your information only as long as necessary to provide our service:

• Account data is retained while your account is active
• Custom playlist names and video selections are retained while the playlist, child profile, or account exists. Deleting a playlist removes its video-selection records and its link to that child. Public YouTube metadata may remain in Kivvie's video records after the playlist is deleted, even if no current playlist uses that video
• Watch history -- Recorded on paid plans only. Entries are retained for as long as the child profile exists, so that longer-term summaries of a child's viewing remain available to the parent; there is no automatic expiry. You stay in control of this: deleting a child profile deletes that child's watch history immediately, a parent can erase it manually at any time from the Activity page on any plan, and switching watch-history recording off for a child in Settings stops any further entries being recorded. If a paid plan ends, existing entries are retained but are no longer viewable while the account is on the free plan
• Retired waitlist data -- Kivvie no longer operates a pre-launch waitlist. The remaining historical waitlist submissions were deleted on August 19, 2026, and we no longer collect or retain waitlist submission data
• When you delete your account, personal data is removed, except where we are required or permitted by law to retain it
• Billing records -- Transaction records (amount, date, subscription type) may be retained for up to 7 years after the transaction to comply with tax and accounting obligations under Australian law, even if you delete your account

9. International Data Transfers

Kivvie is operated from Australia by M2V2 Solutions Pty Ltd. If you use Kivvie from outside Australia, your information is transferred to and processed in Australia, and in the countries where our service providers operate. Our infrastructure and service providers currently include Supabase (hosting and database), Google Cloud (application hosting), PostHog (product analytics, United States), Meta (PageView measurement on public website pages, United States), Google (authentication and YouTube API services), and Airwallex (payment processing).

Australia has not been granted an adequacy decision by the European Commission. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on your explicit consent, given when you create an account and accept this policy, and on the necessity of the transfer to perform the service you have asked us to provide.

10. European Economic Area and United Kingdom (GDPR)

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation and the UK GDPR give you specific rights. This section explains them and how we handle your information.

Who is responsible for your data

The data controller is M2V2 Solutions Pty Ltd, a company registered in Australia. You can reach us about any privacy matter at [email protected].

If you are in the EEA or the UK and need to raise a data protection matter, contact us at the address above and we will handle it directly.

Why we are allowed to process your information

We rely on the following lawful bases:

• Performance of a contract - to create and run your account, store the child profiles, approved channels and playlists you set up, deliver video content, and provide support. Without this we cannot give you the service you signed up for
• Legitimate interests - to keep the service secure, prevent abuse, diagnose faults, and understand how the product is used so we can improve it. We limit what we collect for these purposes. Our analytics redacts known sensitive fields before data leaves your device, and we do not send child names, PINs, or raw child profile identifiers. When you are signed in, your parent profile identifier is sent to our analytics provider so we can count returning users and link errors to an account we can help
• Consent - for marketing newsletters, and for transfers of your data outside the EEA and the UK as described in section 9. You can withdraw consent at any time, and withdrawing it does not affect processing that already happened
• Legal obligation - to keep billing and tax records for the periods the law requires

Your rights

You have the right to:

• Access - get a copy of the personal information we hold about you
• Rectification - have inaccurate or incomplete information corrected
• Erasure - have your personal information deleted. You can do this yourself in the Kivvie mobile app: open the menu on the home screen, choose Delete Account, and confirm with your parent PIN. That permanently removes your account, all child profiles, approved channels, playlists and watch history, and cancels any paid subscription. There is no recovery once confirmed. Account deletion is not available on the website, so if you cannot use the app, email us and we will action it for you. The one exception is set out in section 8: billing records are kept for up to 7 years to meet Australian tax and accounting obligations
• Restriction - ask us to limit how we use your information while a concern is being resolved
• Portability - receive the information you gave us in a structured, commonly used, machine-readable format. Kivvie has no self-service export button today, so email us and we will prepare the file and send it to you
• Object - object to processing we carry out on the basis of legitimate interests, and object to direct marketing at any time
• Withdraw consent - withdraw any consent you have given, including for newsletters
• Complain - lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office. In the EEA it is the data protection authority for your country

To exercise any of these rights, email [email protected]. We will respond within one month of receiving your request. If your request is complex, we may extend this by a further two months, and we will tell you within the first month if that happens. There is no charge, and using these rights does not affect your account or the service you receive. If a request is clearly unfounded or excessive, the GDPR lets us charge a reasonable fee or refuse it, and we will explain our reasoning if that ever happens.

Because Kivvie accounts are created through Google sign-in, we will normally verify a request by confirming it comes from the email address on the account.

Children in the EEA and the UK

Kivvie accounts are held by parents and guardians, not by children. Only adults aged 18 or over can create an account, and children never provide information to us directly. All information about a child reaches us because a parent or guardian entered it.

Under Article 8 of the GDPR, the age at which a child can consent to online services on their own varies between 13 and 16 depending on the country. This does not change how Kivvie works: we require a parent or guardian to hold the account and provide consent in every country, which meets the strictest of these thresholds. A parent or guardian can review, correct, or delete any information relating to their child at any time, on any plan.

Retention periods are set out in section 8 above.

11. Changes to This Privacy Policy

We may update this policy at any time. Changes are effective when posted. The "Last updated" date at the top of this page reflects the most recent revision. It is your responsibility to review this policy periodically. Continued use of Kivvie after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

Questions about this policy? Email us at [email protected]. Kivvie is operated by M2V2 Solutions Pty Ltd, Australia, which is the data controller for the information described in this policy.