Short version (DRAFT — pending legal review; not yet in force)
- Our marketing website (kidbys.com) sets no cookies.
- Our web app uses one strictly necessary sign-in cookie. Our mobile app keeps sign-in details in your device's secure storage.
- We use no advertising cookies, no ad SDKs and no cross-site tracking, anywhere.
- Crash reporting, if switched on, strips personal data before sending. Product analytics are first-party, pseudonymous, and you can switch them off.
- Because we only use strictly necessary technologies on the website and web app, we do not show a cookie banner. If that ever changes, we will ask first.
Effective date: EFFECTIVE DATE
This policy explains how LEGAL ENTITY NAME ("Kidbys") uses cookies and similar technologies, such as device storage and software development kits (SDKs). It adds to our Privacy Policy.
1. What these technologies are
A cookie is a small file a website stores in your browser. Similar technologies include browser local storage, the secure storage on your phone (Apple Keychain or Android Keystore), and SDKs built into an app that may store or read information on your device. EU and UK law requires consent for these technologies unless they are strictly necessary to provide a service you asked for.
2. kidbys.com (marketing website)
The marketing website is a static site. It sets no cookies and uses no analytics or advertising tools. It is hosted by Hostinger and delivered through Cloudflare, which process standard server logs (such as your IP address, browser type and the page requested) to deliver the site and protect it from abuse. To draw the page, your browser also loads fonts from Google Fonts (Google) and open-source animation libraries (three.js, GSAP and Lenis) from the jsDelivr CDN; loading them shares your IP address and browser details with those providers. The site embeds no third-party video, social widgets or tracking pixels.
Public artist pages on our website show only published art, a display name and, where enabled, an age band. They set no cookies.
3. Kidbys web app
| Name | Type | Purpose | Duration | Necessary? |
|---|---|---|---|---|
kidbys_refresh |
First-party cookie, HttpOnly, Secure, limited to sign-in requests | Keeps you signed in securely by holding a refresh token | Up to 30 days, renewed while you use the app; deleted when you sign out | Yes |
| Moderation claim records (staff console only) | Browser local storage | Lets a Kidbys staff reviewer resume a case they claimed | Until the case is released | Yes (staff only) |
If you enable it, a bot-protection check (Cloudflare Turnstile) may run during sign-up or sign-in to block automated abuse; Cloudflare may process device and browser signals for that purpose. CONFIRM whether Turnstile is enabled in production.
4. Kidbys mobile app
| Item | Where stored | Purpose | Necessary? |
|---|---|---|---|
| Adult sign-in refresh token | Device secure storage | Keeps you signed in | Yes |
| Child device credential and child session | Device secure storage | Lets your child sign in with their picture code on a device you approved; child sessions last minutes | Yes |
| Push notification token | Device secure storage and our servers | Delivers notifications you have allowed (through Apple, Google and Expo's push service) | Only if you allow notifications |
| "Badges already seen" record | Device secure storage | Avoids repeating a badge celebration for your child | Yes |
| Payment SDK (Stripe) | Device | Collects card details securely when you pay, and helps prevent fraud | Only when you pay |
| In-app purchase framework (Apple, Google) | Device | Processes subscriptions and Spark purchases bought in the app | Only when you buy |
| Crash reporting SDK (Sentry), if switched on | Device | Sends technical error reports so we can fix bugs. We never attach your user identity, and we strip personal data, tokens and query strings before sending | Strictly necessary for security and stability |
The app does not contain advertising SDKs, advertising identifiers (we do not request Apple's IDFA or use Google's advertising ID), social-media tracking pixels or third-party analytics SDKs. The child's Artist area uses only the strictly necessary items above.
4.1 Product analytics
Kidbys may record a small, fixed set of product events (for example "app opened", "onboarding step completed", "artwork published") on our own servers. Events are keyed to a pseudonymous identifier, never your account ID, email or a device advertising ID, and the event design blocks names, contact details, locations and free text. Events are kept for 180 days (365 days for optional beta feedback). You can switch product analytics off at any time in Profile > Privacy & Data. Optional feedback events are only recorded with your consent.
5. Your choices
- Browser: you can block or delete cookies in your browser settings. If you block the sign-in cookie, you will not be able to stay signed in to the web app.
- Notifications: turn them off in the app or in your phone's settings.
- Analytics: switch off in Profile > Privacy & Data.
- Device storage: signing out removes your sign-in tokens; deleting the app removes the app's local data.
6. Changes
If we ever add a technology that is not strictly necessary, we will update this policy and ask for your consent before using it where the law requires.