Keep the family context small.

We collect only the information described below to run accounts, create playlists, remember adult-selected viewing preferences, connect approved AI clients, keep the service secure, and understand whether closed feedback is working.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use personal information to target ads, and we do not knowingly collect sensitive personal information about children.

We use an adult's email address, a pseudonymous account ID, authentication records, and an optional display name to create and secure an account. Account data is kept while the account is active and deleted or deidentified after a verified deletion request, subject to limited security, legal, and backup needs.

GoodKidVids is for parents, guardians, educators, and other adults. We do not ask for a child's name, exact birthday, school, location, photograph, or contact information.

Optional viewing preferences use broad age ranges, controlled topic choices, reviewed creator choices, manually entered favorite creator names, and loved or disliked video choices. They remain private account settings and are kept until the account holder changes them or requests account deletion.

These choices improve or filter that account's results. They are not public ratings, child profiles, or safety judgments.

The original wording of a playlist request is stored for no more than 30 days so we can diagnose unsuccessful searches and catalog gaps. It is then deleted automatically. The controlled search criteria, resulting playlist, duration, and operational outcome may remain with the account until deletion.

If someone submits a playlist request before signing in, the browser keeps that draft for up to 30 minutes so it can finish the playlist after authentication. The draft is removed after the request receives a definitive response and is never placed in the sign-in URL or analytics.

Account-generated playlists are private by default. An account holder can create a random, unlisted share link and revoke it later. Original request text is not shown on a shared player or returned through MCP account tools.

Claude and other supported clients connect through OAuth. We store the client, approved capabilities, grant status, and security timestamps needed to operate and revoke the connection. Access and refresh tokens are handled as credentials and are not placed in playlist links or analytics.

The consent screen lists the requested capabilities. A connected application can be disconnected from the account page, which invalidates its access.

Server-side operational measurements use a pseudonymous account or client identifier and a small allowlist of outcomes, timings, counts, and error categories. They do not require an analytics cookie.

Optional browser analytics are off until you allow them. If allowed, PostHog receives allowlisted page, feature, browser category, device category, operating-system category, and performance events. Browser persistence is memory-only, so PostHog does not set an analytics cookie. We store the analytics choice in local browser storage. Analytics is retained for no more than 12 months.

Automatic capture, session replay, advertising tracking, full URLs, referrers, free text, precise location, and IP capture by application code are disabled. We do not send email addresses, child information, raw playlist wording, feedback text, transcripts, OAuth tokens, share tokens, or full playlist contents.

Essential Supabase cookies keep an adult signed in and refresh the account session. A short-lived cookie may preserve the safe destination during sign-in. The playlist builder may use temporary session storage to carry a generated playlist to its player. These are used to provide features the visitor requests.

GoodKidVids uses YouTube's privacy-enhanced embed domain. When a visitor loads or plays an embedded video, YouTube may receive device and network information under its own policies. PostHog's optional browser analytics is cookie-free as configured above.

Information comes from the adult using the service, their device, connected AI clients, and service operations. It may be processed by Supabase for accounts and data, Vercel for the website, Cloudflare for MCP, OpenAI for controlled playlist request parsing, YouTube for embedded playback, and PostHog for limited analytics.

Providers receive only the information needed for their role. We do not permit them to use GoodKidVids data for their own advertising.

You may ask to know, access, correct, or delete personal information associated with your account. You may also change preferences, disconnect an AI client, revoke a playlist share link, or change optional analytics above. We will not discriminate against anyone for making a privacy request.

Use account controls where available, or email carla@hippopolka.com. We may need to verify that the requester controls the relevant account. An authorized agent may submit a request, but we may ask for proof of authority and identity as permitted by law.

Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or advertising share to opt out of. If that practice changes, this notice and the required controls must change before collection begins.

We use access controls, row-level database policies, credential separation, and limited retention appropriate to this closed-feedback service. No system can promise absolute security.

We will update the date and this notice before materially changing the categories or purposes of collection. Privacy questions and requests can be sent to carla@hippopolka.com.