Privacy Policy

This policy explains what personal data Kivolo Kids collects, how we use it, and the rights you have. It applies to every page on kivolokids.com, the Kivolo Kids app, and any Kivolo Kids service.

Last updated: 18 April 2026. Effective date: same.

1. Who we are

Kivolo Kids is operated by Devgame OU, Tallinn, Estonia (EU). In this policy, "we", "us", and "our" refer to Devgame OU. "You" refers to the parent or legal guardian who creates an account; "your child" or "the child" refers to the under-13 user whose profile you create.

Contact: privacy@kivolokids.com.

2. The short version

• We never sell or share personal data with advertisers.
• Zero third-party trackers load on children's pages — verified per release.
• Video embeds use youtube-nocookie.com; no YouTube cookies are written until your child actively presses play on a video (behind a Parental Gate).
• We collect the minimum from children: a nickname, age range, language preference, and the list of videos/games your child watched — nothing else.
• You can delete your account and all associated child data at any time from the parent cabinet.

3. What data we collect

From parents (account holders)

• Email address (for login and password reset).
• Password (stored as a bcrypt hash, never in plain text).
• Country (two-letter ISO code, used to determine pricing tier).
• Subscription status and history.
• IP address and user-agent of login sessions (stored for 30 days, for account security).

From children (under 13)

• First name or nickname — chosen by the parent, used to personalise bedtime stories.
• Birthdate month/year — used only to compute an age range (2–4 / 4–6 / 6–8) for content filtering. We do not store day of birth.
• Language preference.
• Activity log — which videos played and which games were opened. Used only for the weekly parent report.

What we DO NOT collect

• Location data, GPS, Wi-Fi networks, or device identifiers.
• Photos, voice recordings, or videos.
• Contact lists, calendar, messages.
• Any data from third-party advertising networks.

4. COPPA (US children under 13)

Kivolo Kids complies with the Children's Online Privacy Protection Act as amended in 2025 (16 CFR § 312, final rule effective April 2025). We obtain verifiable parental consent at account creation; the parent creates the child profile themselves.

Parents have the right to review, delete, and refuse further collection of their child's data at any time. Do this from your parent cabinet or by emailing privacy@kivolokids.com.

5. GDPR (EU and UK)

For EU/UK users we rely on the legal basis of Contract (Article 6(1)(b) GDPR) for the parent account, and Parental consent (Article 8 GDPR) for children. You have the rights of access, rectification, erasure, restriction, portability, and objection. To exercise, email privacy@kivolokids.com.

6. CCPA / CPRA (California)

California residents have the right to know what personal information is collected, to delete, and to opt out of sale/sharing. We do not sell or share personal information in the meaning of CPRA. To request deletion: privacy@kivolokids.com.

7. Cookies

• kv_access, kv_refresh, kv_csrf — authentication cookies, httpOnly (where applicable), SameSite=Strict, set only for logged-in parents.
• kivolo_lang — your language preference.
• kivolo_age_group — the age filter your child selected. First-party, no tracking.

We do not use third-party tracking, advertising, or analytics cookies.

8. Data retention

• Parent account data: retained while the account is active; deleted within 30 days after you delete your account.
• Child data: same as parent account. Weekly reports are kept for 12 months, then purged.
• Session logs (IP, UA): 30 days, then purged.
• Payment records (subscription proofs): 7 years as required by EU VAT law.

9. Data sharing

We share data only with infrastructure subprocessors necessary to deliver the service:

• Hetzner Cloud (DE) — hosting.
• Anthropic (US) — Claude API for story generation and moderation. No child PII is sent; only theme + age range + language.
• YouTube (US, Google LLC) — embedded videos via youtube-nocookie.com, only after your child presses play.

We do not share data with marketing partners, data brokers, or advertising networks.

10. Your choices

• Edit or delete your child's profile at any time in the parent cabinet.
• Cancel subscription at any time — access remains until the paid period ends.
• Fully delete the account via the cabinet settings.

11. Changes to this policy

If we make material changes, we'll email you at least 30 days in advance. Non-material changes (typos, clarifications) are published here without notice. Revision history is available at privacy@kivolokids.com on request.

12. Contact

For privacy questions, deletion requests, or exercising your rights:

Devgame OU · Tallinn, Estonia · privacy@kivolokids.com · Data Protection Officer available on request.