Privacy

We're a small team building a tool we'd use for our own kids. We don't sell data, share it with advertisers, or use it to train any AI model. We collect the bare minimum needed to make the product work, and you can delete everything anytime.

• Your account: name, email, and the Google user ID Google gives us (so we can recognize you next sign-in).
• Kid profiles: first name, age band (3-5, 6-8, or 9-12 — not exact age or birthdate), an avatar color, and your parent PIN as a one-way hash (we can't read it back).
• Playlists you build: the YouTube channels and videos you've approved, the rules you set on channels, and which kid each playlist is assigned to.
• YouTube tokens (if connected): a refresh token from Google so we can read the playlists we created on your behalf and search YouTube for you. Stored encrypted at rest.
• View events: when a kid watched a video, for how long, and whether they finished. Used only to show you what your kids have been watching.
• Cached YouTube data: video titles, thumbnails, durations — pulled from YouTube's public API so we aren't hammering them on every page load.

• Your kid's exact birthdate, biometrics, or photo
• Your location or your kid's location
• Device fingerprints, advertising IDs, or browser history
• Anything from your YouTube account other than the playlists we made for you
• Behavioral profiles, recommendation models, or anything that feeds an algorithm

Postgres database hosted in the United States (US-East region). All connections are encrypted in transit. Sensitive fields like OAuth refresh tokens and parent PINs are encrypted at rest in addition to the database's standard encryption.

• You, anytime, through the app
• Engineering staff at Backpack, only when investigating a support ticket you've opened or a security incident
• Nobody else. We don't share data with advertisers, analytics companies, AI training data brokers, or anyone else

Backpack is designed to be used by parents on behalf of their kids. The kid never creates an account, never signs in, and never gives us any data themselves. Everything about a kid in our system is information you, the parent, provided. We comply with the Children's Online Privacy Protection Act (COPPA) and similar regulations elsewhere.

As a parent, you have the right to review, modify, or delete any information about your kid in our system at any time. The app provides controls for all three.

We don't serve ads in our app. We don't use any third-party analytics or tracking tools in kid mode. In the parent dashboard we use minimal first-party logging to debug errors — no behavioral tracking, no cross-site tracking pixels.

When YouTube videos play in our app, they play through YouTube's official player. YouTube may serve ads as part of that — that's their player, their ads, and their policies, not ours. If a parent has YouTube Premium, those ads don't play.

You can delete your entire account and all associated data from the Settings page at any time. Once you delete, we permanently remove everything within 30 days. Backups are purged on the same schedule. You don't need to email us or wait — the button works immediately.

If we change anything about how we handle your data, we'll email you and show a banner inside the app at least 30 days before the change takes effect. We won't make changes quietly or assume you read a notice. If we ever start doing anything we said we wouldn't — selling data, training models on your stuff, anything like that — that's the kind of change we'd tell you about and let you opt out of (or close your account first).

Questions, concerns, or to request a copy of all data we have about you: email privacy@backpack.kids. We answer every message.