PuddleStoneParent controlsPrivacy Policy
This policy explains what PuddleStone collects, why it is needed, who receives it, and the choices available to parents.
Effective and last updated: 27 August 2026
1. Who we are
PuddleStone provides a parent-managed web dashboard and Android video app. In this policy, “PuddleStone”, “we”, “us”, and “our” refer to the operator of the PuddleStone service. Questions and privacy requests can be sent to privacy@puddlestone.com.
2. Information we collect
| Category | What it includes and why |
|---|---|
| Parent account | Firebase user ID and the parent’s Google account name and email address, used to authenticate the parent and protect their family settings. |
| Family choices and YouTube API data | Approved channel IDs, channel names and thumbnails, plus public video IDs, titles, thumbnails, channel details, publication dates, and synchronisation times. This creates the approved feed. |
| Child device data | An anonymous Firebase user ID, a shortened device identifier, a friendly device name chosen by the parent, family association, and pairing time. PuddleStone does not require a child’s name, email address, contacts, precise location, or advertising ID. |
| Security and operations | Pairing codes and expiry times; short-lived request counters keyed with one-way hashes; and technical logs such as IP address, browser or device details, errors, and request times that may be processed by Firebase, Google Cloud, or Cloudflare. |
We receive parent account details from Google sign-in, family choices directly from the parent, device details from the Android app, public video information from YouTube API Services, and technical information automatically when the service is used.
3. How we use information
We use information to authenticate parents, pair devices, deliver the approved feed, refresh public video details, remove unavailable videos, secure the service, prevent abuse, diagnose faults, answer requests, and meet legal obligations. We do not use PuddleStone data for targeted advertising or sell it.
4. YouTube API Services and playback
PuddleStone uses YouTube API Services, including the YouTube Data API and the YouTube embedded player. Use of PuddleStone is therefore also subject to the YouTube Terms of Service. Google’s handling of information is described in the Google Privacy Policy.
PuddleStone requests only public channel and video information needed for the approved feed. It does not request access to a parent’s or child’s private YouTube account, subscriptions, viewing history, uploads, or other YouTube OAuth data. Video playback is delivered directly by YouTube using its privacy-enhanced youtube-nocookie.com player; Google may receive device, network, and playback information under its own policies.
PuddleStone does not currently connect to an authorised YouTube account. If a user has separately authorised Google services, those permissions can be reviewed or revoked in Google security settings. Revoking access does not itself erase information already held by PuddleStone; see our Data Deletion Policy.
5. Service providers and sharing
We disclose information only as needed to operate, secure, or comply with law:
- Google Firebase and Google Cloud provide authentication, database, server functions, hosting, and operational logging.
- YouTube and Google provide public video metadata and embedded playback.
- Cloudflare may provide domain, network, caching, and security services.
- Google Fonts supplies the web typeface and may receive normal network request information.
We may also disclose information where required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. We do not sell personal information.
6. Children and parent-managed use
PuddleStone is designed to be configured by a parent or legal guardian. The parent chooses creators and pairs the child’s device. A child does not need to create a named account or give us an email address. Parents are responsible for having authority to configure the device and for deciding whether approved content is suitable. If you believe a child’s information was provided without appropriate permission, contact us so we can investigate and delete it where required.
7. Retention
- Approved YouTube channels are refreshed about every six hours. PuddleStone retains up to the 30 most recent public, embeddable videos returned for each approved channel. Older, private, deleted, or unavailable items are removed after the next successful refresh. Stored YouTube API data that has not been refreshed is deleted before it becomes more than 30 days old.
- Removing an approved creator deletes that creator and the related stored video metadata from the family feed.
- Unused pairing codes expire after 15 minutes and expired records are removed by routine daily cleanup. Security rate-limit records expire after their short protection window and are also routinely removed.
- Parent, household, creator, and paired-device records are kept while the account is active and until they are removed or a verified deletion request is completed.
- Security logs, disaster-recovery copies, and provider backups may remain for a limited period under provider retention schedules or where needed for security or law. They are not used as active account data.
8. Security and international processing
We use authentication, access rules, restricted server credentials, request throttling, encrypted connections, and limited-access infrastructure. No system can guarantee absolute security. Our providers may process information in the United Kingdom and other countries, using the safeguards required by applicable law.
9. Your choices and rights
Parents can remove creators and paired devices in the dashboard. Depending on where you live, you may also have rights to access, correct, export, restrict, object to, or delete personal information, and to complain to a privacy regulator. To delete the whole family or parent account, follow the steps in our Data Deletion Policy.
10. Changes to this policy
We may update this policy when the service, law, or providers change. We will publish the revised policy here and update the date above. Material changes may also be highlighted in the service where practical.
Contact
For questions, rights requests, or concerns, email privacy@puddlestone.com. Please do not send a password or pairing code.