Privacy Policy

Kids Social

Last updated: 12 August 2026

Version 2.1

1. Introduction

Kids Social ("the App," "we," "us," or "our") is a parental control application that lets parents and legal guardians curate YouTube content for their children. Parents create an account, approve specific YouTube channels and videos, and provide a supervised, view-only "Kids Mode" in which a child can watch only the content their parent has approved.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and the rights you have. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), the U.S. Children's Online Privacy Protection Act (COPPA), and the privacy requirements of the Apple App Store and Google Play.

Kids Social is a tool for parents, not an app operated by children. Only parents and legal guardians create accounts and configure the App. Children interact exclusively through a supervised, view-only Kids Mode in which they cannot type, search, register, log in, comment, upload, or enter any personal information.

2. Who We Are (Data Controller)

The data controller responsible for your personal information is:

If you have any question about this policy or about how your data is handled, or if you wish to exercise any of your rights, please contact us using the details above. Data-protection queries should include "DATA REQUEST" in the subject line so we can prioritise them.

3. Summary at a Glance

This summary is for convenience only; please read the full policy for detail.

Question	Short answer
Who has an account?	Only parents/guardians. Children never register or log in.
What do we collect from parents?	Email, password (stored only as a secure hash), an optional PIN (also hashed), the content you approve, your settings, a device identifier for security, and your subscription status.
Do we collect data from children?	We do not ask children for, or let children enter, any personal information. We do record which approved videos are watched, for how long — linked to the parent's account — so parents can see activity and children can re-watch recent videos.
Do we sell your data or show ads?	No. We never sell or rent your data, and the App contains no advertising or analytics tracking SDKs.
How long do we keep watch history?	A maximum of 14 days, then it is deleted automatically.
Can you delete everything?	Yes. You can delete your account and all associated data from within the App at any time.
Where is your data stored?	On our secure server located in Germany (European Union).

4. The People This Policy Covers

Parents / Guardians (our users and the data subjects). Adults who register with their own email address, approve content, configure settings, manage the subscription, and oversee their child's viewing.

Children (supervised viewers). Children watch parent-approved videos in Kids Mode. They do not create accounts, provide personal information, or use any data-entry feature. The App is listed in the Parental Controls / Utilities category on Google Play and the Apple App Store, not in any children's category.

5. Information We Collect

5.1 Information you provide as a parent

• Email address — collected at registration. Used to create and secure your account, to authenticate your logins, for account recovery, and for essential service messages.
• Password — collected at registration and stored only as a one-way cryptographic hash (bcrypt, 12 rounds). We never store, see, or have any way to recover your plain-text password.
• Parent PIN (optional) — if you set a PIN to protect Parent Mode, it is stored only as a bcrypt hash. We never store or see your plain-text PIN.

5.2 Information generated as you use the App

• Content choices — the channels and videos you approve, the content requests you create, and your Shorts settings. This is linked to your parent account.
• Watch history — when a child watches a video in Kids Mode, the App records which video and channel were watched, whether it was a short or a regular video, when it was watched, and for how long. This is linked to your parent account (there is no separate child identity), and it is used so that you can review activity and so that your child can re-watch recently viewed videos. Video titles are not stored in these records. Watch history is automatically and permanently deleted after 14 days.
• Screen-time schedule — if you configure allowed viewing times, those settings are stored against your parent account.

5.3 Information collected automatically

• Device identifier — to enforce our limit of two devices per account and to protect against unauthorised access, we store a device identifier generated by your device, together with the platform (iOS or Android) and the time of last login. This identifier is used only for account security and device management. It is not an advertising identifier and is not used to track you across other apps or websites or to serve advertising.
• IP address (transient) — when your device communicates with our server, your IP address is processed momentarily to deliver the response and to protect the service against abuse (for example, rate-limiting repeated login attempts). We do not store your IP address in your account record or use it to build any profile.
• Diagnostic / crash data — if the App or our server encounters an error, limited technical diagnostic information (such as the error, device type, and operating-system version) is sent to our error-monitoring provider, Sentry, so we can find and fix problems. This is configured not to attach your email or identity. On rare occasions an error message could incidentally contain personal data; where that happens it is used solely to diagnose the fault and is subject to short retention.

5.4 Information we do NOT collect

• Names, ages, dates of birth, or postal addresses of any parent or child.
• Any information typed or provided by a child — children never register, log in, type, or search in the App.
• Photographs, videos, audio recordings, or biometric data.
• Precise or approximate location / geolocation data.
• Phone numbers or contact lists.
• Advertising identifiers or cross-app tracking identifiers.
• Payment card numbers, bank details, or billing addresses — all payments are handled entirely by Apple or Google (see Section 8). We receive only your resulting subscription status.

6. How the YouTube Player Works and What Google Collects

Video playback in Kids Social happens through YouTube's official embedded player, loaded in privacy-enhanced mode (the youtube-nocookie.com domain). We chose this mode deliberately because it reduces the data YouTube collects and ensures any advertising shown in the player is non-personalised, and because views inside our App do not influence a viewer's browsing experience or recommendations on YouTube itself.

However, we want to be transparent that privacy-enhanced mode reduces but does not eliminate data collection by Google. In particular, when a video is played, Google/YouTube may receive the device's IP address, may store an identifier in the device's local storage, and may set cookies at the point of playback. This data is collected and controlled by Google/YouTube, not by Kids Social; we have no access to it and cannot switch it off. It is governed by Google's own Privacy Policy. Because our App is directed to children, we have configured playback to use privacy-enhanced mode and we do not permit personalised advertising within the App.

We also use the YouTube Data API v3 (with a server-side API key, on the administrator side only) to retrieve public information about channels and videos — titles, descriptions, thumbnails, durations, and publish dates — to build the library that parents browse. Users of the App do not sign in with a Google or YouTube account, and no YouTube user-account data is accessed, collected, or stored. By using Kids Social you also agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.

7. How We Use Your Information and Our Lawful Bases

Under the UK GDPR and EU GDPR we must have a lawful basis for each use of your personal data. The table below sets these out.

Purpose	Data used	Lawful basis
Create and secure your account; authenticate logins; account recovery	Email, password hash, PIN hash, device identifier	Performance of a contract with you; our legitimate interest in securing accounts
Provide the core service (determine what your child can watch)	Approved content, content requests, settings	Performance of a contract
Show you your child's activity; allow your child to re-watch recent videos	Watch history (max 14 days)	Performance of a contract; consent, which you may withdraw at any time by deleting the data or your account
Enforce screen-time schedules you set	Screen-time settings	Performance of a contract
Manage your subscription and access level	Subscription status, RevenueCat identifier	Performance of a contract
Keep the service safe and reliable; prevent abuse; diagnose faults	IP address (transient), device identifier, diagnostic/crash data	Legitimate interests in the security and integrity of the service
Send essential service emails (e.g. password reset)	Email address	Performance of a contract
Comply with legal obligations and respond to lawful requests	As required	Compliance with a legal obligation

We do not use your data for behavioural advertising, and we do not carry out any automated decision-making that produces legal or similarly significant effects on you.

We only send you essential service emails — such as password resets and important account or security notices. You cannot opt out of these while you hold an account, because they are necessary to provide the service. We do not currently send marketing or promotional emails; if we introduce them in future, we will rely on your consent and always give you a clear way to opt out.

8. Subscriptions and Payments

Kids Social offers optional subscriptions. All payments are processed entirely by Apple (App Store) or Google (Google Play) through their in-app purchase systems, in accordance with their own privacy policies. We do not collect, process, or store any payment card details or billing information. We use RevenueCat to manage subscription entitlements; RevenueCat receives an app-specific user identifier and the purchase/renewal events needed to tell us whether your subscription is active. We receive only your resulting subscription status.

9. Who We Share Your Information With

We do not sell, rent, or trade your personal information, ever. We share limited data only with the service providers ("processors") that are necessary to run the App. Each acts on our instructions under a contract, and we share only what is needed for their specific function.

Provider	Purpose	Data involved
Contabo (hosting)	Hosts our server and database in Germany (EU)	All stored account data (at rest on the server)
Sentry (error monitoring)	Helps us find and fix crashes and errors; configured to the EU region	Technical diagnostic/error data (configured without your identity)
Resend (email delivery)	Delivers essential service emails such as password resets	Your email address and the content of the message
RevenueCat (subscriptions)	Manages subscription entitlements	An app-specific user identifier and purchase events
Apple / Google (payments & distribution)	Process payments and distribute the App	Payment handled entirely by them; we receive only subscription status

We may also disclose personal data if required to do so by law, to enforce our Terms of Service, to protect the rights, safety, or property of AGRSOFT LTD or others, or in connection with a corporate reorganisation, merger, or sale (in which case we will ensure your data remains protected under this policy).

10. International Data Transfers

Your account data is stored on our server in Germany, within the European Union. Some of our processors may process limited data outside the UK or European Economic Area (for example, certain providers are based in the United States). Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards recognised under the UK GDPR and EU GDPR — such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses — so that your data continues to receive an equivalent level of protection. You can ask us for more information about the specific safeguards that apply using the contact details in Section 2.

11. Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy, and we operate the following retention rules:

• Watch history: automatically deleted 14 days after it is recorded, using a database time-to-live rule. No action is required from you.
• Account data (email, password hash, PIN hash, approved content, settings, device identifiers, subscription status): retained for as long as your account remains active, and deleted when you delete your account (see Section 13).
• Backups: our host takes an encrypted full-server backup image once per day and retains each image for up to 10 days before it is automatically and permanently deleted. When you delete your account, your data is removed from the live database immediately; any copy present in a backup image is purged automatically within 10 days as those images rotate out.
• Diagnostic / error data: retained by our error-monitoring provider only for a limited period for troubleshooting, then deleted.
• Legal retention: we may retain limited information where legally required by law.

12. How We Protect Your Information

We maintain administrative, technical, and organisational measures appropriate to the sensitivity of the data we hold, including:

• Passwords and PINs are stored only as bcrypt hashes (12 rounds) — never in plain text.
• All communication between the App and our server is encrypted using HTTPS/TLS.
• Sessions are secured using signed JSON Web Tokens verified on our server.
• Accounts are temporarily locked after repeated failed login attempts to defend against brute-force attacks; rate limiting protects our authentication endpoints.
• The YouTube API key is held only on our server and is never exposed to the mobile app.
• Data is stored on a secured server within the European Union, with request-size limits and security headers enforced.

No method of transmission or storage is completely secure, but we work to protect your data and to review our measures regularly.

13. Account Deletion

You can delete your account at any time from within the App (Parents Mode → Settings → Account → Delete Account). Deletion requires your current password for confirmation and cannot be undone. When you delete your account, we immediately and permanently remove from our live systems:

• your user record (email, password hash, PIN hash, and all settings);
• all approved-content records;
• all content-request records;
• all watch-history records;
• all Kids Mode playlist records.

Any copy of this data contained in a routine backup image is purged automatically within 10 days as backups rotate, as described in Section 11. Deleting your Kids Social account does not automatically cancel an active subscription; to stop further charges you must cancel through your Apple App Store or Google Play account before deleting your account.

You can also find step-by-step deletion instructions, including how to request deletion if you cannot sign in, at https://kidssocialapp.com/delete-account.

14. Children's Privacy

Protecting children is the entire purpose of Kids Social, and we take our responsibilities under COPPA, the UK GDPR (including the Age Appropriate Design Code) and the EU GDPR seriously.

Kids Social is designed so that the parent is the sole account holder. Children do not register, log in, type, search, comment, upload, or provide any personal information. We do not knowingly collect personal information directly from a child. The watch-history records described in Section 5.2 reflect what was viewed on the account, are linked to the parent's account rather than to any child identity, are used only to give parents visibility and to let a child re-watch recent videos, and are deleted automatically after 14 days.

Where a child's viewing activity is treated as personal information under applicable law, the parent or guardian provides and controls that information on the child's behalf, consents to its limited processing as described here, and can review or delete it at any time from within the App or by deleting the account. We do not use children's data for advertising, profiling, or any purpose beyond operating the features described in this policy, and we do not disclose it to third parties except the processors listed in Section 9 that are necessary to run the service.

How parental consent works. Only a parent or legal guardian can create and control a Kids Social account. When you register, you confirm that you are at least 18 years old (or the age of majority where you live) and that you are the parent or legal guardian of any child who will use Kids Mode. By creating and configuring the account, you provide consent — on your child's behalf — to the limited processing described in this policy. Where you take out a subscription, payment is handled through your Apple App Store or Google Play account, which further supports that the account holder is an adult. You can review or delete your child's activity data, or delete the account entirely, at any time.

The App accesses YouTube through an API client that is treated as child-directed under YouTube's API Services Developer Policies. Consistent with those policies, the App takes no "write" actions on YouTube (no uploading, commenting, or playlist creation on YouTube), uses privacy-enhanced playback, and does not use personalised advertising. Please also see Section 6 regarding data that Google/YouTube receives during playback.

If you believe a child has provided us with personal information without your consent, contact us using the details in Section 2 and we will delete it promptly.

15. Your Rights

Depending on where you live, you have some or all of the following rights over your personal data. We provide these rights to all users regardless of location.

• Access — to know what personal data we hold about you. Much of it is visible in the App (your email under Account, your approved content, and your activity screens); you can also request a copy from us.
• Rectification — to correct inaccurate data. You can change your password and PIN in the App at any time.
• Erasure — to delete your account and all associated data at any time (see Section 13).
• Restriction and Objection — to ask us to limit or stop certain processing, including processing based on legitimate interests.
• Portability — to receive a copy of the data you provided in a portable format; contact us to request this.
• Withdraw consent — where we rely on consent, you can withdraw it at any time, without affecting processing already carried out.
• Complain to a regulator — see Section 16.

For residents of California and other U.S. states with privacy laws: you have the right to know what personal information we collect and how we use it, to request deletion, and to be free from discrimination for exercising these rights. We do not "sell" or "share" your personal information as those terms are defined under U.S. state privacy laws.

To exercise any right, contact us using the details in Section 2. We may need to verify your identity before acting. We will respond within 30 days (and within any shorter period required by applicable law).

16. Supervisory Authority and Complaints

If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a data-protection regulator. In the United Kingdom this is the Information Commissioner's Office (ICO), ico.org.uk. If you are in the European Economic Area, you may complain to the supervisory authority in your country of residence.

17. Third-Party Terms and Policies

• YouTube Terms of Service
• Google Privacy Policy
• YouTube API Services Terms of Service
• Apple App Store and Google Play privacy policies (for payments and distribution)
• RevenueCat, Sentry, and Resend privacy policies (for the functions described in Section 9)

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, where changes are material, notify you in the App or by email. Your continued use of Kids Social after changes take effect constitutes acceptance of the updated policy.