The short version
- Parents sign in with Google or Apple. We get your name and email, nothing from your YouTube account.
- Kids never sign in. A child profile is a first name, a friend character, an age range and the limits you set.
- We don't show ads and we don't sell data.
- App analytics run only on the parent's phone, in parent mode. Never on kids' screens or TVs.
- Delete your account in Settings and everything goes with it: children, shelf, TVs and watch history.
1Who we are
SafeShelf is made by [Company legal name], [street address, city, country]. In this policy, "we" means that company and "you" means the parent or guardian who uses SafeShelf.
This policy covers the SafeShelf apps for iPhone, iPad, Android phones and tablets, and Android TV, and this website.
2What we collect
| What | Details | Why |
|---|---|---|
| Your account | Name and email from Google or Apple sign-in. If you use Apple's Hide My Email, we only see the relay address. | To sign you in and keep your shelf in sync across devices. |
| Parent PIN | A salted hash of your 4-digit PIN. We never store the PIN itself. | To keep kids out of parent mode. |
| Child profiles | First name or nickname, the friend character, age range, daily limit and bedtime hours. | To show each child their shelf and apply your limits. |
| Your shelf | The channels, videos and categories you add, with titles and thumbnails from YouTube. | To show your kids only what you approved. |
| Requests | When a child taps "Ask a grown-up," the words they searched for (up to 200 characters), or a request for more time. | So you can decide whether to add something. |
| Watch history | Which video each child watched, its title, channel and category, when they started and for how long. | For daily limits, bedtime and the weekly report. |
| Linked TVs | An anonymous device account, the TV's name, platform and when it was last used. | So the TV shows your shelf without asking for a password. |
| App analytics | Screens viewed and actions such as "TV linked" or "channel added," with the app version, device model, operating system and approximate region that Google Analytics for Firebase records. | To find bugs and see which parts of the app parents use. |
Analytics turn on only when a signed-in parent is in parent mode or setup on their own phone or tablet. They are off on every kids' screen and on every TV. Advertising storage, ad user data and ad personalization are all turned off.
3What we never collect
- YouTube account access
- Passwords
- A child's email or phone number
- Photos, voice or video of anyone
- Precise location
- Contacts
- Advertising IDs
SafeShelf never asks for YouTube permissions, and we never post, like, comment or subscribe on anyone's behalf.
4YouTube videos
SafeShelf uses YouTube API Services to search for channels and videos and to show their titles and thumbnails. Videos play in YouTube's own embedded player, loaded in privacy-enhanced mode from youtube-nocookie.com.
While a video plays, YouTube may collect information under its own policies, and YouTube may show ads inside its player. SafeShelf doesn't control that. Read the YouTube Terms of Service and the Google Privacy Policy.
SafeShelf does not access your Google account data beyond your name and email at sign-in. You can remove SafeShelf's access at any time on the Google third-party connections page.
5How we use it
- To run SafeShelf: sign-in, syncing your shelf, linking TVs, limits and reports.
- To keep it working: fixing bugs and keeping YouTube titles and thumbnails up to date.
- To manage SafeShelf Plus if you subscribe.
- To answer you when you contact us.
We don't use any of it for advertising, and we don't build profiles of children.
7Children's privacy
SafeShelf is set up and controlled by parents. Children can't create accounts, sign in, or send messages, and the kids' side of the app has no links out to other websites.
A parent creates each child profile and decides what goes into it. We collect only what's listed above, and only to run the features you turn on. You can see, change or delete everything about your child in parent mode at any time.
We follow the Children's Online Privacy Protection Act (COPPA) in the United States and the GDPR rules for children's data in Europe. If you think we have information about a child that a parent didn't provide, contact us and we'll delete it.
8How long we keep it
- Your account, children, shelf and watch history stay until you delete them or delete your account.
- YouTube titles and thumbnails are refreshed regularly. Anything not refreshed within 30 days is deleted.
- TV link codes expire after 10 minutes.
- Cached YouTube search results are kept for 6 hours.
- Analytics data is kept for [2 or 14 months, per your Firebase setting].
9Your choices
- See and edit: everything is in parent mode.
- Delete a child: remove the child profile in parent mode. Their watch history and requests go with it.
- Unlink a TV: in Settings. The TV loses access right away.
- Delete everything: Settings, then Delete account. This removes your account, children, shelf, TVs and history.
Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to how we use it. Email us to use any of these rights. We'll answer within 30 days.
10Security
Data travels over encrypted connections. Every family's data is walled off from every other family's at the database level. Our YouTube API key stays on our servers, never in the app. No system is perfect, so if we learn of a breach that affects you, we'll tell you.
11Changes
If we change this policy, we'll update the date at the top. If a change affects what we collect about children, we'll tell you in the app first and ask for your OK where the law requires it.
12Contact us
Email [privacy@yourdomain.com] or write to [Company legal name, street address, city, country].