Privacy Policy

We built Kivvie around privacy and child safety. This policy explains what we collect, how we use it, and how we protect it. For a plain-English overview of the app, see our whitelist parental control feature or read about how we remove YouTube Shorts. Our Terms of Service covers the legal agreement between you and Kivvie.

1. Information We Collect

1.1 Account Information

When you sign in with Google, we collect:

• Email address - To identify your account, send important service notifications, and newsletters (you can opt out)
• Name - To personalize your experience
• Profile picture - Optional, for account identification
• Birthdate - Used only for age verification during sign-up to comply with COPPA. We verify you are 18+ but do not store your birthdate after verification.

Important: We never see your Google password. Authentication goes through Google's OAuth 2.0 system. We get temporary access tokens to search YouTube channels on your behalf. Those tokens are not stored permanently or shared with anyone.

Age Verification (COPPA Compliance)

To ensure proper parental consent as required by COPPA, we verify that all users are 18 years or older during the sign-up process. We access your birthdate from your Google account for this one-time verification. Your birthdate is not stored after verification is complete. Users under 18 years of age cannot create accounts or use Kivvie.

1.2 Child Profile Information

For each child profile you create, we may store:

• Child's name or nickname - Stored within your account and not sent to analytics providers
• Age or birthdate - Optional, used only to help parents choose appropriate settings and starter channel ideas
• Profile picture - Optional, for profile identification within the app
• Approved channels - List of approved YouTube channels for each child
• Content settings - Preferences for Shorts and comments visibility
• Viewing preferences - Optional settings to personalize the experience
• Watch history and duration - We may collect which videos a child watches and how long they watch, solely to display this information to parents in the dashboard. This data is never used for algorithmic recommendations or advertising

Important: All child information is controlled entirely by parents and stored securely. We do not sell children's information or share it for advertising.

1.3 Usage Information

We may collect:

• Device and technical information such as platform, operating system, app version, browser type, screen size, and coarse location inferred from IP address
• App and website usage statistics such as page views, features used, onboarding steps, channel search result counts, session duration, and playback reliability events
• Error logs, crash reports, and diagnostic events used to improve service stability
• Product analytics through PostHog, our analytics service provider. Session replay, surveys, web autocapture, rage-click tracking, web performance autocapture, and mobile lifecycle autocapture are turned off. We do not send child names, PINs, raw search text, OAuth tokens, payment credentials, raw child profile IDs, raw channel/video IDs, or hashed channel/video IDs to PostHog.

1.4 Payment and Billing Information

If you subscribe to a paid plan, payments are processed by Airwallex Pty Ltd (ABN 29 609 653 312), a PCI DSS Level 1 certified payment processor. We do not collect, see, or store your full card number, CVV, or other sensitive payment credentials.

What we receive and store:

• Transaction records -- Subscription type, amount paid, currency, and payment date
• Subscription status -- Your current plan, billing period, and renewal date
• Payment processor identifiers -- Customer and subscription IDs used to manage your billing with Airwallex

What we never see or store:

• Your full credit or debit card number
• Your CVV or security code
• Your card PIN

Your card details are entered directly into Airwallex's secure payment form and transmitted to Airwallex via encrypted connections. Airwallex's handling of your payment data is governed by their Privacy Policy.

Children and payments: Payment and billing features are only accessible to parent/guardian accounts. Child profiles cannot access billing information or make purchases.

2. How We Use Your Information

We use collected information to:

• Provide the service - Authenticate your account, sync settings across devices, and deliver video content
• Maintain security - Protect your account from unauthorized access
• Improve functionality - Identify and fix bugs, optimize performance
• Communicate with you - Send essential service updates, newsletters, product announcements, and respond to support requests

Marketing Communications: We may send you newsletters and promotional emails. You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or updating your email preferences in your account settings. Service-related emails (e.g., security alerts, account notifications) cannot be opted out of.

We never sell your data to third parties or use it for third-party advertising.

3. YouTube API Services and Google Privacy Policy

Kivvie uses YouTube API Services to search for channels and display video content. By using Kivvie, you agree to be bound by the Google Privacy Policy.

Important YouTube API disclosures:

• We access YouTube data only to search for channels and retrieve video metadata
• We do not store YouTube video content on our servers
• Your YouTube viewing history through Kivvie is subject to Google's privacy practices
• You can revoke Kivvie's access to your Google account at any time through your Google Account settings

4. Data Storage and Security

Here is how we protect your data:

• Encryption - All data is encrypted in transit (HTTPS) and at rest
• Authentication - OAuth 2.0 through Google. We never see your password
• Access controls - Internal access policies and audit logging
• Security monitoring - We monitor for vulnerabilities on an ongoing basis

Your data is stored securely using Supabase infrastructure with automatic backups and redundancy.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

We may share limited information only in these circumstances:

• With your consent - When you explicitly authorize data sharing
• Service providers - Companies that help us run Kivvie, including hosting, authentication, payments, analytics, and diagnostics providers, under confidentiality and data protection obligations
• Legal requirements - When required by law or to protect rights and safety

6. Children's Privacy (COPPA & Australian Law Compliance)

Kivvie is for children, but parents manage it. We build and operate Kivvie with child privacy and online safety laws in mind, including COPPA (Children's Online Privacy Protection Act), the Australian Privacy Act 1988, and Australia's online safety framework.

Our Approach to Children's Privacy:

• Children can't create accounts - All accounts require parental authentication via Google. Children never provide information directly
• Parents control everything - Child profiles are created and managed only by verified parents or legal guardians
• We collect very little - Just what parents provide: name or nickname, optional age, and content preferences
• No tracking for algorithms - We may collect watch history and duration so parents can see it in the dashboard, but we never build behavioral profiles or use it for recommendations or advertising
• No ads - Kivvie does not show advertisements to children
• No advertising sharing - Children's information is never sold or shared with advertisers or data brokers

Australian Social Media Age Restrictions:

Kivvie is designed as a parent-controlled filtering and viewing service, not as an age-restricted social media platform under Australia's Social Media Minimum Age obligation. It:

• Does not allow children to create YouTube accounts, social media accounts, or Kivvie parent accounts
• Does not provide public child profiles, messaging, comments, posting, following, friending, or peer-to-peer interaction
• Does not use child viewing data for recommender systems or behavioral ranking
• Provides a video viewing environment where parents control approved channels and child profiles
• Offers optional Channel Packs -- community-recommended channel bundles, not sponsored or paid
• May disclose limited information to regulators or law enforcement only when the law, a court order, or a valid regulatory notice requires it

Parental Rights:

Parents have full control and can:

• Review all information collected about their children
• Request deletion of child profiles and all associated data at any time
• Refuse further collection or use of their child's information
• Control exactly what content their children can access

7. Your Choices

You may:

• Request your data - Ask for a copy of the information we hold about you
• Correct information - Ask us to update or correct inaccurate data
• Delete your account - Request deletion of your account and associated data, subject to our data retention obligations
• Revoke permissions - Remove Kivvie's access to your Google account through your Google Account settings

We will make reasonable efforts to respond to requests but are not obligated to comply where doing so would conflict with legal requirements or our legitimate operational needs.

8. Data Retention

We retain your information only as long as necessary to provide our service:

• Account data is retained while your account is active
• When you delete your account, personal data is removed, except where we are required or permitted by law to retain it
• Billing records -- Transaction records (amount, date, subscription type) may be retained for up to 7 years after the transaction to comply with tax and accounting obligations under Australian law, even if you delete your account

9. International Data Transfers

Your data may be processed in countries where our service providers operate. All transfers comply with applicable privacy laws.

10. Changes to This Privacy Policy

We may update this policy at any time. Changes are effective when posted. The "Last updated" date at the top of this page reflects the most recent revision. It is your responsibility to review this policy periodically. Continued use of Kivvie after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Questions about this policy? Email us at [email protected].