1. Introduction
Kidlyoo is a parental control app for Android, made by Nastrum AI. This policy explains what data we collect when you use Kidlyoo, why we collect it, where it is stored, and how long we keep it.
Kidlyoo is designed for parents. The parent owns the account and is the data subject. Children do not sign up for Kidlyoo, do not have logins, and do not enter personal information of their own.
2. What data we collect
| Data | Why | Where | How long |
|---|---|---|---|
| Parent email and hashed password | Authentication | Supabase Auth | Until account deletion |
| Child profile (name, avatar, age, colour) | App functionality | Supabase Postgres | Until you delete the profile or the account |
| Approved video list (YouTube IDs, titles, thumbnails) | App functionality | Supabase Postgres | Until you remove the video or delete the account |
| Approved Android apps (package names, icons) | Per-device app functionality | Supabase Postgres | Until you remove the app, revoke the device, or delete the account |
| Watch history (video, timestamp, duration) | Reports | Supabase Postgres | Until you clear history or delete the account |
| Device identifier (random UUID) | Per-device approval scoping | Supabase Postgres | Until you revoke the device |
| Crash reports | Debugging | Google Play Console | Per Google's retention policy |
Anything not on this list is not collected: location, contacts, microphone, camera, SMS, calendar, browsing history outside Kidlyoo, or anything from other apps your kid uses.
3. What we don't do
- We don't sell data.
- We don't share data with advertisers.
- We don't put third-party analytics SDKs in the Kidlyoo Android app.
- We don't track your kid across other apps or services.
- We don't profile children.
- We don't display ads in Kidlyoo.
The Kidlyoo Android app contains no analytics SDK. This website is currently served without third-party analytics. If we add analytics later, this page will be updated and you will be asked for cookie consent on your next visit.
4. Children's data - special handling
- Kidlyoo is a parental tool. The parent owns the account and is the legal data subject.
- The parent provides any data about their child (name, age, avatar). We treat this as the parent's data, held under the parent's account.
- We do not directly collect data from children. Children do not sign up, do not have logins, do not enter personal information.
- A parent can delete their child's profile or all watch history at any time, in-app.
- Parents in jurisdictions covered by COPPA (US), GDPR-K (EU/UK), UAE PDPL, or India's DPDP Act have their full statutory rights.
5. Third parties
- Supabase - database, auth, storage. Data stored on AWS infrastructure. supabase.com/privacy
- YouTube IFrame Player - playback. YouTube sees standard playback signals (video ID, watch time) tied to the device's IP address. policies.google.com/privacy
- Google Cloud Messaging / FCM - planned, only if you opt in to notifications.
- Google Play Billing - when Premium ships. Handles payments. We never see your card details.
- Cloudflare Pages - this website only. Standard server logs. cloudflare.com/privacypolicy
6. Your rights
- Export your data - email support@kidlyoo.com.
- Delete your account - in-app, or email us.
- Correct any wrong information - in-app.
- Opt out of optional features (notifications, analytics on this site).
- Lodge a complaint with your local data protection authority.
In-app account deletion permanently removes everything within 7 days. Backups are purged within 30 days.
7. Security
- HTTPS / TLS for all network traffic.
- Supabase Row-Level Security so no account can read another's data.
- Hashed and salted PINs at rest.
- Hashed passwords (handled by Supabase Auth).
- No production data on developer laptops.
8. International transfers
Supabase and AWS may store data in regions outside your country. Standard contractual clauses apply where required. If you have a region-specific question, email us.
9. Changes to this policy
We will update the "Last updated" date at the top of this page and notify users in-app for material changes.
10. Contact
Email support@kidlyoo.com. A postal address for formal correspondence is available on request.