Content Hub Kids – Privacy Policy

Effective: [date of publication]

Draft for legal review. Every point marked “[Lawyer: …]” must be decided or checked before publication; remove all bracketed notes from the published text. [Lawyer: the Czech version is intended to be the governing version for Czech consumers; confirm, and say so in both versions.]

Content Hub Kids is an app of short animated series for children aged about 4 to 10 and their families. Because the people watching are children, we collect as little as we can. There are no ads, no advertising identifiers and no third-party analytics or tracking tools in the app.

1. The short version

• Children never create an account and never give us a name, email, birthday, photo or location.
• The app creates a random app ID on first launch. It is used only to count which episodes are watched, to improve recommendations inside the app and to fix playback problems. A parent can switch this off.
• Parents can create an account (an email address and a one-time code) to buy coins, set parental controls and keep coins across devices.
• Payments are handled by the App Store or Google Play. We never see card details.
• Viewing data is deleted after 90 days. A parent can delete the account in the app at any time.
• We do not sell data, show ads or build profiles for use outside the app.

2. Who we are

The controller of your personal data is:

Costa Hub s.r.o. Školská 660/3, Nové Město, 110 00 Praha 1, Czech Republic Company ID (IČO): 23882271, VAT ID (DIČ): CZ23882271 Registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 434492 Represented by Christian Costa, executive director (jednatel) Email: [email protected] Telephone: +420 602 766 346

We have not appointed a data protection officer. [Lawyer: confirm a DPO is not required under GDPR Art. 37, given that the core activity involves first-party analytics on children’s devices.]

3. Whose data this policy covers

• Children who watch in the app. They use it without an account.
• Parents and guardians who use the “Grown-ups” area and, optionally, create a parent account.

The Grown-ups area is behind a parental gate (a question an adult answers). All purchases, settings and the parent account are there.

4. Data from the device a child watches on

What the app sends to us

Viewing events carry the random app ID only. They do not carry a parent’s account ID, even when a parent is signed in on the device.

Network address

Every device that connects to the internet has a network (IP) address. When the app sends viewing events, we use the address only to limit how many events one address can send in a day, and we keep it only as a salted one-way code (a hash), never as the address itself. These codes are deleted at the end of the day (in practice within about two days).

To protect the service against automated abuse, our servers also count how often each network address and each parent account asks for a video or a purchase check. Again we keep only a one-way coded value, never the address or account ID in readable form, and each count is deleted within 20 minutes of the last request.

When the app streams a video or checks for an update, the services that deliver it also receive the device’s network address (see section 9).

[Lawyer: confirm the legitimate interest covers reading and hashing the network address of children’s devices for rate limiting (DPIA open question 6), and whether the store privacy labels must list it.]

What stays on the device only

Settings (autoplay, sound, reduced motion, use of mobile data), saved shows, likes, which episodes a child was already asked to rate, and, while no parent is signed in, the daily watch-time limit. This data is not sent to us and is deleted when the app is deleted.

What we never collect from children

• No name, email, phone number, birthday, photo, voice or contacts.
• No precise location, camera or microphone access.
• No advertising identifier (the Android advertising ID permission is blocked in the app).
• No chat, comments, messaging, sharing or other social features.
• No push notifications. [Owner: earlier test builds could store a push token on a parent account; delete the stored push_token values before publication.]

5. The parent account

A parent may create an account in the Grown-ups area. The account belongs to the parent, not the child. It lets the parent buy coins, keep them on a new phone or after reinstalling, and set parental controls that apply on every device signed in to the account.

Nothing about what a child watched is linked to the parent’s email or account. The coins, unlocks and controls are recorded against the account because they are what the parent bought and set.

6. Why we use data and on what legal basis

We do not use any of this data for advertising, we do not sell it, and we do not make decisions about anyone by automated means that have legal or similarly significant effects. The order of recommended episodes is worked out automatically, but it only changes what the app shows first.

7. Children’s privacy and parental consent

What the law requires. In the EU, the GDPR protects children’s data specially. Where an online service relies on consent, a child under the age of digital consent needs a parent’s consent; in the Czech Republic that age is 15. In the United States, the Children’s Online Privacy Protection Act (COPPA) applies to services directed to children under 13.

How we apply it.

• We do not ask children for any personal information. The only data from a child’s device is the random app ID and the data linked to it in section 4, used only for the app’s internal operations (recommendations, analytics on our own content, and fixing problems).
• Only an adult in the Grown-ups area can create an account, make a purchase or change settings.
• In the Grown-ups area, under Privacy, “Share anonymous watch stats” switches off viewing statistics completely. Switching it off also discards events not yet sent and stops sending watch progress for recommendations. Recommendations then fall back to general popularity.

[Lawyer: the statistics switch is on by default. Decide whether default-on first-party analytics with a parental off switch is acceptable to the ÚOOÚ under the Czech Electronic Communications Act (§ 89(3) of Act No. 127/2005 Coll., storing and reading the app ID on the device) and GDPR Art. 8, or whether collection must stay off until a parent switches it on (DPIA open question 1).]

[Lawyer: confirm the COPPA position – that the random app ID and network address are persistent identifiers used solely to support internal operations, including personalisation of recommendations inside the app, so verifiable parental consent is not required, and that this policy meets the COPPA notice requirements, including the written data retention policy required by the amended COPPA Rule (DPIA open question 2).]

For parents in the United States (COPPA). Costa Hub s.r.o. (section 2) is the operator of the app. We do not collect personal information from children other than the random app ID and the network address described in section 4, which we use only to support the internal operations of the app. We do not use them for advertising, and we do not disclose them to third parties other than the providers in section 9, which may use them only to provide their services to us under written agreements. We keep them only for the periods in section 11 and protect them under a written information security programme that we review at least once a year (section 12). [Owner: adopt the written information security programme (based on docs/compliance) and review it every year, as the amended COPPA Rule requires.]

Parents’ rights. A parent can at any time:

• see the data linked to a child’s device, or have it deleted: in the Grown-ups area, under Privacy, tap “Ask about this device’s data”. This shows the device’s app ID and opens an email to us with it filled in. The app ID is the only thing that links viewing events to a device, so we need it to find them;
• stop further collection, with the statistics switch above;
• delete the parent account (section 13).

We will never require a child to give more information than needed to watch. If we learn that we have collected personal information from a child beyond what is described here, we will delete it.

8. Purchases and payments

Coins and the Family Club are bought through the App Store (Apple) or Google Play (Google). The store takes the payment under its own terms and privacy policy. We never receive card or bank details. We receive a confirmation of the purchase (product, price, currency, transaction ID, store and country) through RevenueCat, which checks the receipt for us.

9. Who receives data

We use the following providers, who process data on our behalf (processors) under data processing agreements, or who act on their own account where stated.

We do not give data to anyone else, except where the law requires it (for example, to a court or a public authority).

[Lawyer: confirm that a data processing agreement (GDPR Art. 28) is in place with each processor, and check the providers’ subprocessors (for example, the email service Clerk uses to send one-time codes).]

10. International transfers

Viewing data and the database are stored in the European Union (Supabase, EU region [Owner: verify the exact region]). Clerk, RevenueCat and Expo are US companies. Where data goes to the US, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.

[Lawyer/owner: verify for each of Clerk, RevenueCat and Expo whether it is certified under the Data Privacy Framework or relies on standard contractual clauses (DPIA open question 3).]

11. How long we keep data

Deletion is done by automated jobs, not by hand.

12. Security

We protect data with technical and organisational measures, including:

• encrypted connections (HTTPS) for all traffic;
• strict access rules in the database: the app can only reach its own data through checked server functions, and only authorised staff can read analytics;
• videos are never on public addresses: each playback uses a link that expires after 30 minutes;
• the grown-up PIN and network addresses are stored only as one-way hashes;
• account deletion, retention limits and limits on requests are enforced automatically.

No system is perfectly secure. If a breach affects your data, we will inform the authority and you as the law requires.

13. Deleting the parent account

In the Grown-ups area, open Account and tap “Delete account”. We send a one-time code to your email to confirm it is you. Deletion removes the sign-in, the coin balance, unlock history, the ledger, rewards, parental controls and PIN hash, watch-time records and the record of accepted terms.

Coins are lost when the account is deleted and cannot be restored, also not with “Restore purchases”. Money already paid is refunded only through the store (see the Terms of Use).

What remains: purchase records needed for accounting and refund disputes, with the link to the account and the store’s account identifiers removed.

[Lawyer: two residual items need a decision (DPIA open question 5): (a) the customer record at RevenueCat is not deleted automatically when the account is deleted; (b) some older purchase records contain the account ID inside their internal key. Decide whether and by when both must be removed, and whether the text must mention them.]

14. Your rights

Under the GDPR you have the right to:

• access your data and get a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability for data you gave us under the contract (for example, your purchase history), in a machine-readable format;
• object to processing based on our legitimate interest, including the viewing statistics;
• withdraw consent at any time, where we rely on consent.

To use these rights, email [email protected]. For a child’s device, use “Ask about this device’s data” in the app so we receive the app ID. We may ask you to confirm your identity, for example by replying from the account’s email address. We reply within one month; in complex cases we may extend this by up to two more months and will tell you why.

[Lawyer: there is no in-app data export; confirm that handling access and portability requests by email is sufficient.]

You also have the right to lodge a complaint with the supervisory authority:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic www.uoou.gov.cz

You may also complain to the authority in the EU country where you live or work.

15. If you live outside the European Union

Content Hub Kids is offered worldwide. This section adds what the laws of some countries require; the rest of this policy applies as well. Wherever you live, you can use the rights in section 14 by emailing [email protected].

Where data goes. Data is stored in the European Union and processed by the providers in section 9, which are based in the European Union and the United States. Transfers are protected as described in section 10.

United Kingdom. The UK GDPR, the Data Protection Act 2018 and the Information Commissioner’s Age Appropriate Design Code (the Children’s Code) apply. We designed the app to its standards: no ads, no profiling of children, no data shared with third parties for their own purposes, and every purchase and setting behind the Grown-ups area. Our representative in the UK under Article 27 of the UK GDPR is [Owner: appoint a UK representative and insert their name and address]. If you have a complaint, please tell us first: we acknowledge complaints within 30 days and answer them without undue delay. You may also complain to the Information Commissioner’s Office (ico.org.uk).

United States. Section 7 explains how we comply with COPPA. We do not sell or share personal information, and we do not use it for targeted advertising. Depending on your state, you may ask to know, access, correct or delete personal information about you or your child by emailing [email protected]; if we refuse, you may appeal by replying to our answer. Where state law requires Apple or Google to tell us whether a parent has approved downloads and purchases, we use that information only to meet the law. [Owner: implement Apple’s Declared Age Range API and Google Play’s Age Signals API before release in the US.]

Canada and Switzerland. You may access and correct personal information and withdraw consent. The person responsible for personal information is Christian Costa, executive director, [email protected]. You may complain to the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d’accès à l’information) or to the Swiss Federal Data Protection and Information Commissioner.

Brazil. Under the LGPD, children’s data is processed only in the child’s best interest, and the rights in section 14 apply. Our contact for data protection is [email protected]; you may complain to the National Data Protection Authority (ANPD). [Lawyer: Brazil’s ECA Digital (Law 15.211/2025) has applied since March 2026 to services for children, including streaming; it requires reliable age verification, parental supervision tools and a legal representative in Brazil. Decide whether to comply or not to offer the app in Brazil.]

Australia, Japan, South Korea, India and other countries. We handle data as this policy describes; data goes to the European Union and the United States as described in sections 9 to 11. You may use your rights by emailing [email protected] and complain to your national data protection authority. [Lawyer: Australia is preparing a Children’s Online Privacy Code (to be registered by December 2026), and India’s data protection rules apply in full from May 2027 with verifiable parental consent for everyone under 18; check both before launch in those countries.]

16. Our website

This policy and the Terms of Use are published on our website at https://contenthub.costahub.co/privacy/kids/ and https://contenthub.costahub.co/terms/kids/. The website is a static page. It does not use cookies or analytics. It is hosted by Cloudflare, Inc. (Cloudflare Pages), which processes technical access data (such as the network address and time of access) to deliver and secure the site. [Owner: the kids app still links to https://reelix-admin.netlify.app/privacy.html; change the link in the app to the address above before publication.]

[Owner: an older public web version of the kids app is still online at reelix-app.netlify.app. Decide whether to remove it or cover it in this policy.]

17. Changes to this policy

When our data practices change, we update this policy first and change the date at the top. We tell parents about important changes in the app. Where a change would need a parent’s consent under the law (for example, new collection from children), we will ask for it before the change applies.

18. Contact

Questions about privacy: [email protected]

See also the Terms of Use.