Privacy

We're a small team building a tool we'd use for our own kids. We don't sell data, share it with advertisers, or use it to train any AI model. We collect the bare minimum needed to make the product work, and you can delete everything anytime.

• Your account: name, email, and the Google user ID Google gives us (so we can recognize you next sign-in).
• Kid profiles: first name, age band (3-5, 6-8, or 9-12 — not exact age or birthdate), an avatar color, and your parent PIN as a one-way hash (we can't read it back).
• Playlists you build: the YouTube channels and videos you've approved, the rules you set on channels, and which kid each playlist is assigned to.
• YouTube tokens (if connected): a refresh token from Google so we can read the playlists we created on your behalf and search YouTube for you. Stored encrypted at rest.
• View events: when a kid watched a video, for how long, and whether they finished. Used only to show you what your kids have been watching.
• Cached YouTube data: video titles, thumbnails, durations, channel metadata, and the made-for-kids flag — pulled from YouTube's public API so we aren't hammering them on every page load. We refresh this cache at least every three days, well within YouTube's 30-day maximum.

Backpack uses YouTube API Services to power channel search, video metadata lookups, and — only when you explicitly grant permission — to create and update a Backpack-managed playlist on your own YouTube account.

Because we rely on Google's services, additional rules apply:

• Your use of Backpack is also subject to the YouTube Terms of Service.
• Data we fetch from Google APIs (channel titles, thumbnails, video durations, the madeForKids flag, etc.) is also governed by the Google Privacy Policy.
• We do not store YouTube-derived data longer than three days without re-fetching it from YouTube.
• We do not redistribute, download, or modify YouTube video content. Videos always play through YouTube's official embedded IFrame Player.
• We do not use any YouTube data to train AI models, build advertising profiles, or share with third parties.
• You can revoke Backpack's permission to access your Google account at any time at myaccount.google.com/permissions or by tapping Disconnect YouTube in Backpack Settings. Revoking removes our access immediately; previously-cached metadata is deleted on the same 30-day schedule as the rest of your account data when you delete your account.

Backpack's use and transfer of information received from YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use YouTube data only to provide and improve the features described above — principally, creating and reading the per-child YouTube playlist that surfaces parent-approved videos in your kid's Backpack library. We do not use YouTube data for any other purpose.
• We do not transfer YouTube data to third parties, except (1) as needed to provide or improve user-facing features through service providers acting under contractual safeguards (hosting, database), (2) to comply with applicable law or valid legal process, or (3) as part of a merger, acquisition, or sale of assets, with notice to affected users.
• We do not use YouTube data for advertising of any kind, including personalized, targeted, retargeted, or interest-based advertising. We do not sell YouTube data.
• We do not allow humans to read your YouTube data, except (1) with your explicit consent (for example, when you ask our support team to investigate a specific problem), (2) when necessary for security reasons such as investigating abuse, (3) when required by law, or (4) when the data has been aggregated and anonymized so that it can no longer identify any individual user.

If we ever want to use YouTube data for a purpose beyond what is described in this policy, we will obtain your explicit consent first.

• Your kid's exact birthdate, biometrics, or photo
• Your location or your kid's location
• Device fingerprints, advertising IDs, or browser history
• Anything from your YouTube account other than the playlists we made for you
• Behavioral profiles, recommendation models, or anything that feeds an algorithm

Postgres database hosted in the United States (US-East region). All connections are encrypted in transit. Sensitive fields like OAuth refresh tokens and parent PINs are encrypted at rest in addition to the database's standard encryption.

• You, anytime, through the app
• Engineering staff at Backpack, only when investigating a support ticket you've opened or a security incident
• Nobody else. We don't share data with advertisers, analytics companies, AI training data brokers, or anyone else

Backpack is designed to be used by parents on behalf of their kids. The kid never creates an account, never signs in, and never gives us any data themselves. Everything about a kid in our system is information you, the parent, provided. We comply with the Children's Online Privacy Protection Act (COPPA) and similar regulations elsewhere.

As a parent, you have the right to review, modify, or delete any information about your kid in our system at any time. The app provides controls for all three.

We don't serve ads in our app. We don't use any third-party analytics or tracking tools in kid mode. In the parent dashboard we use minimal first-party logging to debug errors — no behavioral tracking, no cross-site tracking pixels.

When YouTube videos play in our app, they play through YouTube's official player. YouTube may serve ads as part of that — that's their player, their ads, and their policies, not ours. If a parent has YouTube Premium, those ads don't play.

You can delete your entire account and all associated data from the Settings page at any time. Once you delete, we permanently remove everything within 30 days. Backups are purged on the same schedule. You don't need to email us or wait — the button works immediately.

If we change anything about how we handle your data, we'll email you and show a banner inside the app at least 30 days before the change takes effect. We won't make changes quietly or assume you read a notice. If we ever start doing anything we said we wouldn't — selling data, training models on your stuff, anything like that — that's the kind of change we'd tell you about and let you opt out of (or close your account first).

Questions, concerns, or to request a copy of all data we have about you: email privacy@backpack.kids. We answer every message.