DRAFT – needs legal review before publication. Not legal advice. Placeholders in
[BRACKETS]must be filled in. Last updated: DATE. German version:privacy-policy.de.md; if the versions differ, the German version prevails – confirm with counsel.
Privacy Policy for Pepelly
Pepelly is a video app for children that only plays YouTube channels a parent has approved. Accounts belong to parents. Children do not have accounts, do not sign in and do not give us an email address.
1. Who is responsible
Controller under the GDPR: COMPANY, ADDRESS, email: privacy@pepelly.appData protection officer, if appointed: NAME, EMAIL
Questions about this policy or your data: privacy@pepelly.app.
2. Summary
- We collect only what the app needs to work: the parent's account, the child profiles the parent creates, and the devices paired to them.
- We do not collect a child's email address, location, photo, voice, contact list or advertising ID.
- Pepelly shows no advertising of its own (YouTube may still show ads inside videos) and has no third-party analytics or tracking in kid mode.
- Videos are played through the official YouTube player. Pepelly uses YouTube API Services (see section 6).
- You can export or delete all data at any time in the app. Deletion is completed within 24 hours.
3. What data we process
Parent account
| Data | Why |
|---|---|
| Email address and name (from Sign in with Google or Sign in with Apple), the sign-in provider and its account identifier | To create and secure your account, sign you in, send transactional emails |
| Language (locale) and time zone | Interface language; when a "day" starts for daily limits, bedtime and weekly reports |
| Plan (free or Family) and where it was bought (App Store / Google Play) | To unlock Family features |
| Parent PIN (stored only as a one-way hash) | Parent gate on your devices |
| Push notification tokens of your parent devices, platform, last seen | To notify you of channel requests from your child and of weekly reports |
| Optional: YouTube access token for "import my subscriptions", stored encrypted (AES-256-GCM) | Only if you choose to import your YouTube subscriptions; used read-only to list them |
Child profile (created by the parent)
| Data | Why |
|---|---|
| Profile name (a first name or nickname is enough) and an avatar from our built-in set | To show the right profile on the kid device |
| Age band (3–5, 6–8 or 9–12) – no date of birth | Suggested channel packs and default video-length filter |
| Whitelist: approved channels, single-video allow/block rules, content filters | The core function: show only what you approved |
| Daily limit and bedtime settings | Screen-time limits you set |
| Channel requests the child sends ("ask for this channel") | So you can approve or decline them |
| Watch sessions: which video, on which paired device, when, for how many seconds | Daily limits and the weekly report for you |
Children cannot enter free text that is shown to anyone, cannot upload anything and cannot contact other users.
Kid devices
| Data | Why |
|---|---|
| Pairing code (valid 10 minutes) and the device token issued on pairing (we store only a hash), device name, platform, pairing and last-seen time | To link a device to exactly one child profile and let you revoke it |
Technical data
When any app or the web dashboard talks to our server, the server necessarily receives the IP address and technical request data. Server logs are kept for 14 days for security and troubleshooting. Crash reports are described in section 7.
We do not use this data to build profiles of children, and we do not sell or share personal data for advertising.
4. Legal bases (GDPR)
- Contract (Art. 6(1)(b)): parent account, child profiles, whitelist, limits, pairing, subscription, transactional emails.
- Consent (Art. 6(1)(a), Art. 8): processing of your child's data in the child profile; the optional YouTube subscriptions import.
- Legitimate interest (Art. 6(1)(f)): security logs, abuse prevention (rate limiting), crash reports to keep the app stable.
- Legal obligation (Art. 6(1)(c)): retention of invoices where required (billing itself is handled by Apple or Google).
5. Children's data and parental consent (GDPR Art. 8, COPPA)
Pepelly is directed at children, but only a parent or legal guardian can set it up.
- Consent at profile creation. When you create a child profile you confirm that you are the child's parent or legal guardian and consent to the processing described here. We record the time of that consent. Without it no profile is created.
- Data minimisation. We collect from or about the child only the profile data listed in section 3. No email, no location, no advertising ID, no persistent identifier used for tracking.
- No ads of our own, no tracking in kid mode. Kid mode contains no advertising SDK, no analytics SDK and no links out of the app. Push notifications and Firebase are not loaded in kid mode.
- Parental control. You can review, change, export or delete your child's data at any time, and withdraw consent by deleting the profile. Revoking a paired device ends its access immediately.
- COPPA (United States). If Pepelly is offered in the US, the parent's account sign-in and consent checkbox serve as the verifiable parental consent mechanism counsel to confirm the method is sufficient under 16 CFR 312.5. We do not condition a child's participation on collecting more data than needed. Parents can contact us at privacy@pepelly.app to review or delete their child's information.
6. YouTube
Pepelly uses YouTube API Services. Videos are played in the official YouTube embedded player; channel and video information (titles, thumbnails, durations, publish dates) is fetched by our server from the YouTube Data API.
- By using Pepelly you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms
- Google's Privacy Policy applies to YouTube: https://policies.google.com/privacy
- The YouTube player is provided by Google. When a video plays, Google may receive data such as the device's IP address and set cookies according to its own policy. YouTube may show ads in videos; Pepelly does not add or change them. Pepelly does not remove YouTube ads. Ad-free playback depends on the parent's own YouTube Premium subscription and on whether YouTube applies it inside embedded players.
- YouTube subscriptions import (optional). If you connect your YouTube account, we request read-only access (
youtube.readonly) only to list your subscriptions so you can approve channels faster. We store the access grant encrypted and never show it to anyone, including in data exports. - Revoking YouTube access. In the app: Settings → YouTube connection → Disconnect (this deletes the stored grant and revokes it at Google). You can also revoke it at any time at https://security.google.com/settings/security/permissions. Deleting your account also revokes it.
- Cached YouTube data. We store YouTube channel and video information only as long as needed and refresh it regularly. Any YouTube data not refreshed within 30 days is deleted.
7. Service providers (processors) and recipients
We use these providers under data processing agreements. Some are located outside the EU/EEA; where that is the case, transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses counsel to confirm per provider.
| Provider | Purpose | Data |
|---|---|---|
| Google LLC / Google Ireland – YouTube API Services | Channel and video information; official player; optional subscriptions import | Channel and video IDs; for the import, your YouTube grant; player: IP address and device data (Google as independent controller) |
| Google – Sign in with Google; Apple – Sign in with Apple | Sign-in | Identity token, email, name |
| Apple (App Store), Google (Google Play) | Subscription purchase and billing (they are independent controllers for payment data) | Purchase and subscription status; we never see card details |
| RevenueCat, Inc. | Checking store receipts and subscription status | Pseudonymous app user ID (our internal parent ID), purchase and subscription events |
| Google – Firebase Cloud Messaging | Push relay to parent devices only; no other Firebase service is used | Push token of the parent device; notification content (for channel requests: the child's profile name and the channel title) |
| PostHog Inc. (EU cloud, Frankfurt) | Error reports from the server and the parent area of the app; usage statistics of the parent area (e.g. which way a channel was added) | Stack traces, device model and OS, app version, internal parent ID, parent-area events; for children only a daily total of watch minutes under a one-way hashed profile ID; no names, emails or tokens; nothing from kid mode |
| Resend (Plus Five Five, Inc.) | Transactional emails (e.g. account-deletion confirmation) | Email address, email content |
| HOSTING PROVIDER, LOCATION | Server and database hosting, backups | All data listed in section 3 |
| BACKUP STORAGE PROVIDER, LOCATION | Encrypted daily database backups | All data listed in section 3 |
OPEN: the engineering decisions list server-side, parent-only product events in PostHog. If used, add: "PostHog Inc. / PostHog EU – product usage statistics of the parent area, server-side only, never kid mode, EU hosting". Remove this note otherwise.
We do not pass personal data to any other third party unless the law requires it.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and child profiles | Until you delete them; deletion is completed within 24 hours |
| Watch sessions | 13 months confirm, or until the profile/account is deleted |
| Pairing codes | Expire after 10 minutes; removed after 24 hours |
| Revoked kid devices | 30 days after revocation confirm |
| Cached YouTube data | Refreshed regularly; deleted if not refreshed within 30 days |
| Server logs | 14 days |
| Error reports and usage statistics (PostHog) | 90 days |
| Backups | 30 days rolling; deleted data disappears from backups when they rotate out |
9. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent at any time with effect for the future (Art. 7(3)). Parents exercise these rights for their children.
- Export: Settings → Account → Export my data gives you a machine-readable file (JSON) of everything we hold about you and your children.
- Delete: Settings → Account → Delete account removes your account, all child profiles, whitelists, watch sessions, paired devices and any YouTube grant within 24 hours. You receive a confirmation email. Cancel your subscription in the App Store or Google Play separately; deleting the account does not cancel store billing.
- Contact: privacy@pepelly.app
You may also complain to a data protection supervisory authority, for example the one in your country of residence or the authority responsible for COMPANY, e.g. "Landesbeauftragte für Datenschutz ...".
10. Security
Connections are encrypted (TLS). Sign-in tokens are short-lived; kid device tokens can only read that one child's approved content. The parent PIN and device tokens are stored as hashes, the YouTube grant is encrypted at rest. Access to production systems is restricted to COMPANY staff who need it.
11. Changes
We will update this policy when the app or the law changes and show material changes in the app before they take effect.
Appendix: this website (pepelly.app)
This section covers the website only. Counsel: review and merge into the policy above.
- Hosting and server logs. The website is served by our own web server at HOSTING PROVIDER, LOCATION. Each request is logged with the IP address, date and time, the page requested, the referring page and the browser identifier, for security and troubleshooting, and deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).
- No cookies. The website sets no cookies and stores nothing on your device.
- No third-party requests. Fonts, images and styles are served from this domain. The website does not load anything from Google or other third parties.
- Statistics (only if switched on). If PostHog is enabled for the website: we count page views with PostHog (EU hosting) without cookies and without storing anything on your device; describe IP handling as configured. Remove this item while statistics are off.
- Store links take you to the App Store or Google Play, where Apple's or Google's privacy policy applies.