Privacy Policy

We built Kivvie around privacy and child safety. This policy explains what we collect, how we use it, and how we protect it. For a plain-English overview of the app, see our whitelist parental control feature or read about how we remove YouTube Shorts. Our Terms of Service covers the legal agreement between you and Kivvie.

1. Information We Collect

1.1 Account Information

When you sign in with Google, we collect:

• Email address - To identify your account, send important service notifications, and newsletters (you can opt out)
• Name - To personalize your experience
• Profile picture - Optional, for account identification
• Birthdate - Used only for age verification during sign-up to comply with COPPA. We verify you are 18+ but do not store your birthdate after verification.

Important: We never see your Google password. Authentication goes through Google's OAuth 2.0 system. We get temporary access tokens to search YouTube channels on your behalf. Those tokens are not stored permanently or shared with anyone.

Age Verification (COPPA Compliance)

To ensure proper parental consent as required by COPPA, we verify that all users are 18 years or older during the sign-up process. We access your birthdate from your Google account for this one-time verification. Your birthdate is not stored after verification is complete. Users under 18 years of age cannot create accounts or use Kivvie.

1.2 Child Profile Information

For each child profile you create, we may store:

• Child's name or nickname - Only stored within your account, never shared externally
• Age or birthdate - Optional, used only to provide age-appropriate content recommendations
• Profile picture - Optional, for profile identification within the app
• Approved channels - List of approved YouTube channels for each child
• Content settings - Preferences for Shorts and comments visibility
• Viewing preferences - Optional settings to personalize the experience
• Watch history and duration - We may collect which videos a child watches and how long they watch, solely to display this information to parents in the dashboard. This data is never used for algorithmic recommendations, advertising, or shared with third parties

Important: All child information is controlled entirely by parents and stored securely. We never share children's information with third parties.

1.3 Usage Information

We may collect:

• Device information (type, operating system)
• App usage statistics (features used, session duration)
• Error logs and crash reports (to improve service stability)

1.4 Payment and Billing Information

If you subscribe to a paid plan, payments are processed by Airwallex Pty Ltd (ABN 29 609 653 312), a PCI DSS Level 1 certified payment processor. We do not collect, see, or store your full card number, CVV, or other sensitive payment credentials.

What we receive and store:

• Transaction records -- Subscription type, amount paid, currency, and payment date
• Subscription status -- Your current plan, billing period, and renewal date
• Payment processor identifiers -- Customer and subscription IDs used to manage your billing with Airwallex

What we never see or store:

• Your full credit or debit card number
• Your CVV or security code
• Your card PIN

Your card details are entered directly into Airwallex's secure payment form and transmitted to Airwallex via encrypted connections. Airwallex's handling of your payment data is governed by their Privacy Policy.

Children and payments: Payment and billing features are only accessible to parent/guardian accounts. Child profiles cannot access billing information or make purchases.

2. How We Use Your Information

We use collected information to:

• Provide the service - Authenticate your account, sync settings across devices, and deliver video content
• Maintain security - Protect your account from unauthorized access
• Improve functionality - Identify and fix bugs, optimize performance
• Communicate with you - Send essential service updates, newsletters, product announcements, and respond to support requests

Marketing Communications: We may send you newsletters and promotional emails. You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or updating your email preferences in your account settings. Service-related emails (e.g., security alerts, account notifications) cannot be opted out of.

We never sell your data to third parties or use it for third-party advertising.

3. YouTube API Services and Google Privacy Policy

Kivvie uses YouTube API Services to search for channels and display video content. By using Kivvie, you agree to be bound by the Google Privacy Policy.

Important YouTube API disclosures:

• We access YouTube data only to search for channels and retrieve video metadata
• We do not store YouTube video content on our servers
• Your YouTube viewing history through Kivvie is subject to Google's privacy practices
• You can revoke Kivvie's access to your Google account at any time through your Google Account settings

4. Data Storage and Security

Here is how we protect your data:

• Encryption - All data is encrypted in transit (HTTPS) and at rest
• Authentication - OAuth 2.0 through Google. We never see your password
• Access controls - Internal access policies and audit logging
• Security monitoring - We monitor for vulnerabilities on an ongoing basis

Your data is stored securely using Supabase infrastructure with automatic backups and redundancy.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

We may share limited information only in these circumstances:

• With your consent - When you explicitly authorize data sharing
• Service providers - Trusted partners who help operate our service (e.g., hosting, authentication) under strict confidentiality agreements
• Legal requirements - When required by law or to protect rights and safety

6. Children's Privacy (COPPA & Australian Law Compliance)

Kivvie is for children but managed by parents. We comply with COPPA (Children's Online Privacy Protection Act), Australian Privacy Act 1988, and Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024.

Our Approach to Children's Privacy:

• Children can't create accounts - All accounts require parental authentication via Google. Children never provide information directly
• Parents control everything - Child profiles are created and managed only by verified parents or legal guardians
• We collect very little - Just what parents provide: name or nickname, optional age, and content preferences
• No tracking for algorithms - We may collect watch history and duration so parents can see it in the dashboard, but we never build behavioral profiles or use it for recommendations
• No ads - Kivvie does not show advertisements to children
• No third-party sharing - Children's information is never sold or shared with third parties

Australian Social Media Age Restrictions:

Kivvie is not a social media platform as defined by Australian law. It is a parent-controlled content filtering service that:

• Does not allow children to create accounts independently
• Does not enable peer-to-peer interaction or social networking features
• Is a video viewing platform where parents control all content
• Offers optional Channel Packs -- community-recommended channel bundles, not sponsored or paid
• Complies with the Privacy Act 1988 and the upcoming Children's Online Privacy Code (expected December 2026)

Parental Rights:

Parents have full control and can:

• Review all information collected about their children
• Request deletion of child profiles and all associated data at any time
• Refuse further collection or use of their child's information
• Control exactly what content their children can access

7. Your Choices

You may:

• Request your data - Ask for a copy of the information we hold about you
• Correct information - Ask us to update or correct inaccurate data
• Delete your account - Request deletion of your account and associated data, subject to our data retention obligations
• Revoke permissions - Remove Kivvie's access to your Google account through your Google Account settings

We will make reasonable efforts to respond to requests but are not obligated to comply where doing so would conflict with legal requirements or our legitimate operational needs.

8. Data Retention

We retain your information only as long as necessary to provide our service:

• Account data is retained while your account is active
• When you delete your account, personal data is removed, except where we are required or permitted by law to retain it
• Billing records -- Transaction records (amount, date, subscription type) may be retained for up to 7 years after the transaction to comply with tax and accounting obligations under Australian law, even if you delete your account

9. International Data Transfers

Your data may be processed in countries where our service providers operate. All transfers comply with applicable privacy laws.

10. Changes to This Privacy Policy

We may update this policy at any time. Changes are effective when posted. The "Last updated" date at the top of this page reflects the most recent revision. It is your responsibility to review this policy periodically. Continued use of Kivvie after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Questions about this policy? Email us at admin@kivvie.app.