COPPA Notice for Parents

PandaPanda Kids is designed for children and we take children's privacy seriously. This notice explains, in plain language, exactly what information we collect from children, how we use it, and the rights you have as a parent or legal guardian. It complements our full Privacy Policy and is provided to satisfy the direct notice requirements of the Children's Online Privacy Protection Act (COPPA), including the amended Rule effective April 22, 2026.

What information do we collect from children?

Only the minimum needed to provide the service:

• The child's first name (no last names).
• The child's age, used to pick age-appropriate content.
• An avatar selection from a fixed library of cartoon images.
• Listening history within the app (songs played, playlists created, favorites). This is stored only to operate the app and is never used for advertising or profiling.

We do not collect from children:

• Last names, addresses, phone numbers, or photos.
• Location data of any kind.
• Contacts or address book information.
• Biometric data such as voiceprints or face scans.
• Audio or video recordings.
• Persistent device identifiers used for cross-app tracking.

How do we use this information?

Only to provide the service inside the app:

• Show your child age-appropriate songs and playlists.
• Remember favorites and playlists across sessions.
• Save listening history so your child can return to a song they liked.

We do not use children's information for advertising, profiling, third-party sharing, or machine-learning training.

How do we obtain parental consent?

Before any information is collected about a child, a parent or guardian must:

• Create the parent account (which requires email verification and confirmation that the account holder is 18 or older).
• Provide a payment method on file (used by Apple for subscription billing; this acts as additional verification of adult identity).
• Affirmatively create the child profile from within Parent Zone after the parent account is verified.

This combination of email verification, payment method on file, and parent-only Parent Zone access constitutes verifiable parental consent under COPPA.

What are your rights as a parent?

• Review all information collected about your child. Open Parent Zone > Profile Settings to see everything, or email coppa@pandapandakids.com to request a written copy.
• Refuse further collection or use at any time by deleting the child profile in Parent Zone.
• Delete all information collected about your child by deleting your account in Parent Zone > Profile Settings > Delete Account. All personal information is permanently removed within 30 days.

To exercise any of these rights, email coppa@pandapandakids.com. We respond within 30 days.

Who do we share information with?

We share children's information only with the small set of service providers strictly needed to run the app, none of whom receive identifying information they could use for their own purposes:

• Apple Inc. (account authentication and in-app purchases).
• RevenueCat Inc. (subscription receipt validation; receives only anonymous identifiers and the Apple receipt).
• Supabase Inc. (database hosting; SOC 2 Type II; data encrypted at rest and in transit).
• Cloudflare Inc. (audio file delivery; receives only file paths, no user identifiers).

We never share children's information with advertising networks, analytics companies, social media platforms, or data brokers.

Security

We maintain a written information security program. All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Access to systems holding personal data is limited to authorized personnel through token-based authentication with audit logging.

Effective date and updates

This notice is effective May 1, 2026. We will notify parents through the app and by email if material changes are made.