Privacy Policy

PandaPanda Kids ("we", "our", "us") is committed to protecting the privacy of children and families who use our application. This Privacy Policy explains what information we collect, how we use it, and the rights you have. We comply with the Children's Online Privacy Protection Act (COPPA) including the April 22, 2026 amendments, the EU General Data Protection Regulation (GDPR) including Article 8 children's consent provisions, the California Consumer Privacy Act (CCPA), the California Online Privacy Protection Act (CalOPPA), and Apple's App Store Review Guidelines for the Kids Category.

1. Who We Are

PandaPanda Kids is an iOS application that provides original children's music in multiple languages. Our service has no advertising, no third-party tracking, no social features, no external links accessible to children, and no in-app purchase mechanism reachable without a parental gate.

Operator: PandaPanda Kids
Privacy contact: privacy@pandapandakids.com
COPPA contact: coppa@pandapandakids.com
Support: support@pandapandakids.com

2. Information We Collect

From parents (account holders, age 18+)

• Email address for account creation, password recovery, and critical security notifications.
• First and last name for personalization of the parent account interface.
• Sign in with Apple identifier when the parent chooses Sign in with Apple as the authentication method.
• Subscription and purchase history via Apple's StoreKit and our payment processor (RevenueCat) for receipt validation and subscription management.

From child profiles (created and managed by parents)

• First name only (no last names from children).
• Age (used for age-appropriate content selection).
• Avatar selection from a fixed library of cartoon images.
• Listening history within the app (songs played, playlists created, favorites). Stored only to provide the service.

What we never collect

• Children's last names, addresses, phone numbers, or photos.
• Location data of any kind.
• Contacts or address book information.
• Browsing history outside the app.
• Biometric identifiers including voiceprints, faceprints, or behavioral fingerprints.
• Audio recordings, photos, or videos taken by the device.
• Advertising identifiers (we do not show ads).
• Persistent device identifiers used for tracking across services.

3. Children's Privacy (COPPA Compliance)

PandaPanda Kids is specifically designed for use by children under 13 in the United States and children under 16 in the European Economic Area. We are fully compliant with COPPA including the amended Rule effective April 22, 2026. Specifically:

• Only parents and legal guardians aged 18 or older can create accounts.
• Verifiable parental consent is obtained before any child personal information is collected, through the parent's email verification, payment method on file, and acceptance of this Privacy Policy during account creation.
• Child data is used solely to provide the service inside the app. We do not use it for behavioral advertising, profiling, or any commercial purpose other than operating the app.
• We never disclose child personal information to third parties for advertising, marketing, or any commercial use.
• Parents may review, modify, or delete their child's personal information at any time through the Parent Zone in the app or by emailing coppa@pandapandakids.com.
• We maintain a written information security program reasonably designed to protect the confidentiality, security, and integrity of personal information collected from children.
• Push notifications to children are limited to in-app reminders (for example, a daily sing-along reminder) and never contain promotional content or links out of the app.

4. How We Use Information

We use the information we collect solely to:

• Provide and maintain the music streaming service.
• Manage subscriptions and accounts.
• Personalize age-appropriate song recommendations within the app.
• Send critical account and security notifications to the parent's email address.
• Improve app performance and stability.
• Comply with legal obligations.

We do not use any personal information for advertising, behavioral profiling, building marketing lists, or training machine learning models.

5. Third Parties

PandaPanda Kids uses a small set of essential service providers, none of whom receive personally identifiable information about children:

• Apple Inc. for account authentication (Sign in with Apple) and in-app purchases (StoreKit). Subject to Apple's privacy policy.
• RevenueCat, Inc. for subscription receipt validation. Receives an anonymous app user identifier and the Apple-issued purchase receipt. Does not receive child information.
• Supabase, Inc. for authentication and database hosting. Stores account email, hashed credentials, and the data described in Section 2. SOC 2 Type II certified. Data is encrypted in transit and at rest.
• Cloudflare, Inc. for audio file delivery (CDN). Receives only the file path of the song being streamed, no user identifier.

We do not use third-party advertising networks, third-party analytics SDKs that collect personal information, third-party tracking pixels, or social media plugins.

6. Data Retention and Deletion

We retain personal information only as long as the account is active. Upon account deletion request:

• All personal information including parent account data, child profiles, listening history, favorites, and playlists is permanently deleted within 30 days.
• Anonymized, aggregated usage statistics (for example, "song X was played N times globally") may be retained for service improvement but contain no personally identifiable information.
• Purchase records may be retained as required by tax, accounting, and audit obligations, with personal identifiers removed where possible.

Parents may request account deletion at any time through Parent Zone in the app or by emailing privacy@pandapandakids.com.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, port, restrict processing of, or delete personal information we hold about you or your child. You also have the right to lodge a complaint with a supervisory authority. To exercise any of these rights, email privacy@pandapandakids.com. We respond within 30 days.

California residents have additional rights under the CCPA, including the right to know what categories of personal information we collect, the right to delete, the right to opt out of any sale (we do not sell personal information), and the right to non-discrimination for exercising these rights.

8. Security

All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Authentication uses industry-standard token-based protocols with refresh-token rotation. We follow a written information security program that includes access controls, audit logging, vendor due diligence, and incident response procedures. While no system is perfectly secure, we apply commercially reasonable safeguards.

9. International Users

Data is processed in the United States. By using the app outside the United States you consent to the transfer of your information to the United States. For users in the European Economic Area or United Kingdom, we rely on appropriate safeguards including Standard Contractual Clauses where applicable.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app and by email to the parent account holder. The "Last Updated" date at the top reflects the most recent changes.