Privacy Policy

About Kids Podcasts

Kids Podcasts (kidspodcasts.com and the Kids Podcasts mobile app) helps parents and guardians discover age-appropriate podcasts, build playlists, and hand a child a listening experience limited to content the grown-up has approved. The website is used by grown-ups; the child-facing experience is the mobile app, which only ever shows what a parent has approved. We never sell a child's personal information or use it to target ads at children. (Podcasts you approve may include their own ads from the publisher.)

Kids Podcasts is operated by Morrill Creative LLC, a United States company, which is the “data controller” of the personal information described here. Contact: hello@kidspodcasts.com.

Who creates accounts

Family Portal accounts are for adults. You must be 18 or older to create one. Children do not create accounts, log in with an email, or provide information to us directly — a parent sets up each child profile and chooses what that child can hear.

Information we collect

From the parent / account holder

• Your email address, used for sign-in (we email you a one-time code — there are no passwords).
• If you choose to connect a Yoto account, the access tokens needed to send playlists to your Yoto library. You can disconnect at any time, which deletes those tokens.
• If you subscribe to premium through Apple, the transaction identifiers Apple provides so we can recognize your subscription. Apple handles your payment details — we never see them.
• If you opt in to our email updates, your email address on that list (you can unsubscribe any time).

About a child — only what the parent enters or generates by using the app

• A profile: the first name (or nickname) you give the child, an age range, an avatar, and an optional 4-digit unlock PIN (stored only as a secure one-way hash).
• The content you approve for that child: podcasts, episodes, and playlists.
• Listening activity used to run the app's features: playback position (so a child can resume), and minutes listened per day (so daily limits work; we keep only about two weeks of this day-by-day history). This is tied to the child profile, not to any outside identity.
• Download and playback preferences you set.

We deliberately keep this minimal. We never ask a child for an email, a birthdate, a photo, a precise location, or contact information, and the app has no chat, comments, or other way for a child to share information publicly or with other users.

Automatically, to keep the Service working

Like every website, our servers see the IP address of requests. We use IP addresses for security and abuse prevention in two ways: rate-limit counters store them only as truncated, hashed values that expire within hours; and a security log of sign-up attempts records the IP address, browser user agent, and attempt outcome for up to 30 days, so we can investigate and block automated abuse (such as fake-signup attacks). These records stay in our own infrastructure, are never shared, and are never used for marketing or profiling. Standard server logs are also held briefly by our hosting provider.

Stored in your browser

Playlists you build on the website without signing in, and settings like your language choice, are stored locally in your browser, not on our servers.

Why we process it (legal bases)

• To provide the Service you asked for (performance of a contract): accounts, child profiles, approvals, playlists, playback, premium features.
• Our legitimate interests: keeping the Service secure, preventing abuse, fixing problems, and understanding aggregate usage — always in ways that don't override your rights.
• Your consent: optional things like the email list and connecting a Yoto account. You can withdraw consent at any time.
• Parental consent governs all child-profile information: it exists only because a parent entered it or enabled it (see COPPA below).

Children's privacy (COPPA)

We've designed Kids Podcasts so that a grown-up is in control of any information connected to a child. Because account holders must be adults and a parent personally creates each child profile and approves all content, the limited information we hold about a child is provided by, and with the consent of, that child's parent or guardian.

As a parent or guardian, you can at any time:

• Review and edit a child's profile and approved content, in the Family Portal or the app.
• Delete a child profile, which permanently removes that child's profile and all of their associated data (approvals, playlists, and listening records).
• Delete your entire account from the Family Portal, which permanently removes your account and every child profile and record associated with it.

We retain a child's information only while the profile exists; deleting the profile or the account removes it. If you have any question about your child's data or want us to help you delete it, email hello@kidspodcasts.com.

Your rights

Wherever you live — and specifically if you are in the European Economic Area, the United Kingdom, or a US state with a privacy law — you can ask us to:

• Access the personal information we hold about you and your family, and receive a portable copy of it (we provide a machine-readable export);
• Correct anything inaccurate;
• Delete it — the Family Portal's delete controls do this immediately and completely, or we'll do it for you on request;
• Restrict or object to processing based on our legitimate interests;
• Withdraw consent for anything consent-based (like the email list), without affecting the rest of the Service.

Email hello@kidspodcasts.com and we'll respond within one month. We don't discriminate against you for exercising any right. If you're in the EEA or UK and believe we haven't resolved a concern, you also have the right to lodge a complaint with your local data protection supervisory authority.

Where your data is processed

We are based in the United States and our service providers process data on servers in the US. If you use the Service from outside the US, your information is transferred to the US. Our major providers participate in recognized transfer frameworks (such as the EU–US Data Privacy Framework) and/or offer standard contractual clauses, and we keep the data itself minimal, as described above.

How long we keep things

• Account, profiles, approvals, playlists — until you delete them or your account (deletion is immediate and permanent).
• Day-by-day listening history — about two weeks, then automatically purged.
• Rate-limit counters (hashed IPs) — minutes to hours.
• Sign-up security logs (IP address, browser info, attempt outcome) — 30 days, then automatically purged.
• Yoto tokens — until you disconnect Yoto or delete your account.
• Instagram messages — processed to reply, not retained beyond the interaction.

Analytics & cookies

We keep this light on purpose. The website uses Vercel Analytics and Vercel Speed Insights — privacy-friendly, aggregate measurements of page visits and load performance that do not use advertising cookies, do not track you across other sites, and are not used to build profiles of anyone, least of all children. We do not use Google Analytics or any advertising trackers.

Advertising

We show no ads — not to children and not to grown-ups. There are no ad placements anywhere in the app or on the website, no advertising SDKs, and no behavioral-advertising or tracking technology of any kind, and we never use anyone's personal information for advertising. Separately, individual podcasts may contain ads inserted by their own publishers; that content is the publisher's and is outside our control.

Third parties we rely on

• Supabase — secure database and authentication hosting for accounts and profiles.
• Vercel — website and app-backend hosting, plus the privacy-friendly analytics noted above.
• Upstash — datastore for our public playlist catalog and aggregate counters.
• Apple — App Store distribution and premium subscription billing (Apple is its own controller of your payment information).
• Resend — delivery of sign-in links and, if you opt in, our email updates.
• Yoto — only if you connect a Yoto account. When you send a playlist to Yoto, the episode audio and playlist title are uploaded to your own Yoto library at your request. We share no child profile information with Yoto.
• Podcast hosts — podcasts are delivered from their publishers' servers over public RSS. Playing or downloading an episode contacts that publisher's servers directly (which, like any podcast app, reveals the device's IP address to them). We are not responsible for those publishers' privacy practices.

These providers process data for us under their standard data-processing agreements. We do not sell personal information to anyone, and we do not “share” it for cross-context behavioral advertising.

How your information is protected

Data is stored with our hosting providers and encrypted in transit. Child unlock PINs are stored only as one-way hashes. Connected-account tokens are kept server-side and are removed when you disconnect or delete your account. If a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires.

Instagram messages

If you message our Instagram account (@kidspodcasts), we process your message text solely to reply with podcast recommendations, and do not retain the conversation beyond the interaction. We do not share it with third parties.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above.

Contact

Questions, or a request about your family's data? Email hello@kidspodcasts.com. Kids Podcasts is operated by Morrill Creative LLC.