Privacy Policy

KidSafeTube("we", "our", "us") respects your privacy. This policy explains what we collect, how we use it, and the choices you have. It applies to our web application and the KidSafeTube Chrome extension.

What we collect

• Account information. Email, name, and profile image you provide at sign-up (or that your Google account provides on OAuth sign-in).
• Authentication token. After you sign in, we issue a short-lived session token. The KidSafeTube Chrome extension caches this token locally (inchrome.storage.local) so you stay signed in across browser sessions without logging in twice. The token lives on your device and is sent to our API only to authenticate your scan requests.
• Content you submit for screening. The YouTube videos, Spotify songs, and playlist links you paste in to scan. To classify them we pull the relevant lyrics or transcript from independent sources, send that text to our AI provider for classification against our content taxonomy (profanity, sexual content, drugs, violence, dark themes, and more), and store the resulting verdict and category breakdown so you can revisit your scan history.
• Child profiles. The per-child profiles you create, including a name or nickname, an age, and the filter level you choose. Please use first names or nicknames only and avoid entering sensitive personal details about a child.
• Usage metadata. Per-account scan counts (used to enforce plan limits), timestamps, the platform scanned (YouTube or Spotify), and your plan tier.
• Billing. Handled by Stripe on our web app. The Chrome extension never sees payment data. We do not see or store your card details.
• Login activity. When you sign in or sign out, we record the timestamp, IP address, browser user-agent, and approximate country. This helps you detect unauthorised access to your account and lets us understand product engagement in aggregate. We do not sell or share this data.

How we use it

The lyrics and transcripts associated with the links you submit are sent to a third-party AI provider to classify them against our content taxonomy. We store the submitted link, its metadata, and the resulting verdict and category breakdown so you can access your scan history and apply it to your child profiles. We use aggregate usage numbers (scans run, verdicts returned) to improve the product.

We do not sell, rent, or share your data with third parties for advertising or profiling.

Abuse prevention

Some screens let you enter free text, such as your screening profile or a support message. Before that text is saved we run it through a lightweight filter that rejects content falling into the categories listed in our Terms of Service. Rejected entries are not saved.

We keep an internal audit record of rejected entries - the original text, the rejection category, timestamp, IP address, and browser user-agent. This is used solely to identify accounts that repeatedly attempt disallowed content so we can enforce our Terms of Service. These records are not shared with third parties.

Chrome Extension

The KidSafeTube Chrome extension adds live protection on YouTube - auto-skipping flagged videos, blocking the comment section, and filtering suggested videos. Because browser extensions warrant an explicit data disclosure, here is exactly what it does and does not handle.

Data the extension sends to our servers:

• The identifier of the YouTube video you are viewing, so we can return its verdict and apply your filters. We do not read arbitrary page content or log your keystrokes.
• Your cached session token, attached as an Authorization header so our API knows which account is making the request.

Data the extension stores locally on your device (via chrome.storage.local, not transmitted anywhere):

• Your cached session token.
• Your theme preference (light or dark).
• Your active child profile and filter toggles.

Data the extension does not collect:

• Web history. Content scripts only run on the sites listed in the extension manifest, and only to apply your filters. We do not track which other pages you visit, page titles, or visit timestamps.
• Location. We do not access GPS, device location, or derive geolocation from your IP beyond the approximate country recorded in the login activity log above.
• Personal communications. We do not read your emails, texts, DMs, or any chat conversation content.
• Financial information. The extension never handles card numbers, transactions, or credit data. All billing runs through Stripe on our web app.
• Health information. Never collected.
• Keystrokes, clicks, or mouse movement. The extension only needs to know which video is on screen to apply your filters.

We do not sell or transfer user data to third parties outside of approved use cases (Stripe for payments, our AI provider for content classification, the lyrics and transcript sources we query, Supabase for data storage, and Resend for transactional email). We do not use your data for advertising, profiling, creditworthiness scoring, or any purpose unrelated to screening the content you choose to submit.

Your data, your control

• You can delete any scan from your History page.
• You can add, edit, or remove child profiles at any time from Settings.
• You can delete your account from Settings. This removes all stored scans, child profiles, and account data.

Children's privacy

KidSafeTube is a tool for parents, teachers, and other adults to screen content on behalf of children. It is not directed at children and we do not knowingly create accounts for anyone under 18. The child profiles you create hold only the limited information you choose to enter (a name or nickname, an age, and filter preferences) and exist solely to match scan results to the right child.

Security

Data is stored on Supabase (Postgres) with row-level security so only you can read your own records. Traffic is encrypted with TLS. Authentication uses short-lived session tokens.

AI provider API keys

Some plans let you bring your own Anthropic API key via Settings › AI Providers so your scans run on your own key. Here is exactly how we handle it:

• Encrypted at rest. Your API key is encrypted with AES-256 before being written to our database. The plaintext key is never stored. We hold only the encrypted ciphertext plus the last four characters of the key so you can identify which key you saved.
• Used only for your requests. The key is decrypted in memory only at the moment your scan is processed, and only to call the AI provider on your behalf. It is never logged, never exposed in API responses, and never used for any other account.
• Never shared or sold.Your key is sent only to the provider it belongs to (your Anthropic key is sent only to Anthropic's API endpoint during your scan).
• You control deletion.You can remove your API key at any time from Settings › AI Providers. Deletion permanently removes the encrypted ciphertext from our database.

Cookies

We use essential cookies for authentication and a theme preference cookie. We do not use third-party advertising or tracking cookies.

Changes to this policy

If we make material changes, we will update the date above and, for signed-in users, show a notice on your next visit.

Contact

Questions? Email privacy@kidsafetube.ai or see our Terms of Service.