How Kidbox protects your family’s data. Written for parents and guardians.
Last Updated: May 5, 2026Your child’s data is never sold or shared with third parties.
All analytics and tracking are disabled when your child is using the app.
We don’t collect photos, audio, location, or contacts from children.
Review, delete, or stop collection of your child’s data at any time.
Children never interact with AI directly. All content is reviewed by people first.
Delete your child’s profile and their data is erased immediately.
Fully compliant with COPPA, including the 2025 amendments.
Kidbox Corporation (“Kidbox,” “we,” “us,” or “our”) operates the Kidbox mobile application and website at kidbox.com (collectively, the “Service”). Kidbox is a children’s reading platform designed for children ages 2–8. Because our Service is directed to children under 13, we comply with the Children’s Online Privacy Protection Act (“COPPA”) and the FTC’s COPPA Rule, including the 2025 amendments.
This Privacy Policy explains what information we collect, how we use it, and what rights you have as a parent or guardian. Please read this policy carefully before allowing your child to use the Service.
If you have questions about this Privacy Policy or our data practices, or wish to exercise your parental rights, contact us at:
Kidbox Corporation is the sole operator that collects and maintains personal information through the Service. No other companies or partners operate parts of the Service or collect personal information from children through it.
When a parent creates a child profile, we collect the following:
Provided by the parent:
Collected automatically during the child’s use of the Service:
We do not collect the following from children:
Children cannot make their personal information publicly available through the Service.
When you create an account, we collect:
When you use creation features (passcode-protected, parent-only):
When you make a purchase:
Collected automatically when you (not your child) use the Service:
Important: All third-party analytics and tracking tools listed above are completely disabled when a child profile is active. They only operate when a parent is using the Service under their own parent profile.
We use children’s information solely to provide the Service:
We do not use children’s information for:
We use parent information to:
Children’s data: We do not share, sell, or disclose children’s personal information to any third party for any purpose. Children’s data is not shared with advertisers, data brokers, or any other external parties.
Parent data: We may share parent information with:
We do not sell personal information of any user — parent or child.
When a child profile is active: All third-party analytics, cookies, and tracking technologies are disabled. The only exceptions are:
When a parent profile is active: We use Firebase Analytics, Mixpanel, Customer.io, cookies, and Crashlytics for analytics, communications, and Service improvement. We use the Meta SDK and Meta Conversions API for install attribution and parent-only conversion measurement and ad optimization, with advertising identifier collection disabled. Parent-only conversion events may include account registration, trial or subscription start, or purchase. Matching data may include hashed parent email and Meta click/browser identifiers captured in parent/adult contexts. We do not send IDFA, GAID, child profile data, reading activity, story data, personalization inputs, child-session events, or read-derived audience data to Meta.
Logged-out website browsing: Visitors who are not logged in may browse the website. Analytics for logged-out visitors are limited to what COPPA permits under the “support for internal operations” exception: maintaining and analyzing the functioning of the website, performing network communications, and protecting the security and integrity of the Service. We do not use persistent identifiers from logged-out browsing to contact or build a profile of any specific individual. Parent-only Meta conversion measurement does not apply to logged-out browsing unless you move into a parent-only account, signup, subscription, or purchase flow.
Kidbox uses AI technologies to help adults create children’s books. Children do not interact with AI features directly. All AI-generated content is reviewed by a human before being shown to a child. Children are only shown content approved by the Kidbox team or by their parents. No child data is sent to AI providers.
If a parent optionally creates a character based on their child (name, age, or appearance), this information is provided by the parent during the creation process, which is passcode-protected and accessible only to parents.
The following third-party AI providers receive personal data when a parent uses creation features:
Providers may change over time. We will update this policy when providers are added or removed.
We obtain verifiable parental consent before collecting personal information from children. Our consent process works as follows:
If we do not receive consent, no child profile can be created and no child data is collected.
Because we do not share children’s information with third parties, separate consent for third-party disclosure is not required.
As a parent or guardian, you have the right to:
To exercise any of these rights, you may use the controls in the app or contact us at privacy@kidbox.com or by phone at (917) 382-4888.
We will not require your child to disclose more information than is reasonably necessary to participate in the Service.
We retain personal information only as long as reasonably necessary for the purpose it was collected:
We store data on Google Cloud Platform and Firebase, which provide industry-standard security measures including encryption in transit and at rest. We implement access controls, monitoring, and other reasonable security measures to protect personal information.
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect personal information, we cannot guarantee absolute security.
The Kidbox app may request the following device permissions, which are used only for parent features:
The app does not request access to location, contacts, or other device sensors.
We send parents emails about their child’s reading progress, weekly digests, and milestone alerts. These emails are sent from our servers. We do not currently send push notifications. We do not send any communications directly to children.
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing any personal information.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the sale of personal information. We do not sell personal information.
To exercise your California privacy rights, contact us at privacy@kidbox.com.
The Service is available in the United States only. Our Terms of Service require that users be located in the United States. The Service is available on iOS (Apple App Store), Android (Google Play Store), Amazon Appstore, and the web at kidbox.com.
We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or share children’s personal information, we will notify parents by email and post a prominent notice on the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:
Sign In