Children's Privacy Notice

1. Who this notice covers

This notice applies to any user under 13 in the United States and under 13 (or the applicable age of digital consent in their country) in the EEA and UK. It also describes age-appropriate design practices that apply to all users under 18 on the platform.

2. Parental consent (COPPA)

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If a parent or guardian is registering an account for a child under 13, consent is obtained at registration and is documented in our systems.

Parents and guardians may at any time:

• Review the personal information we hold about their child.
• Request correction or deletion of that information.
• Revoke consent, which will result in account deletion.

To exercise these rights, contact us at [privacy@eddy.example.com — update before launch].

3. What we collect from children

We apply data minimization principles and collect only what is necessary for core functionality:

• Email address — used solely for account authentication and essential service communications. We do not use it for marketing without explicit parental consent.
• Reading progress — which books have been opened and the current position, to enable resume-reading. This data is not shared with third parties.

We do not collect from children:

• Audio recordings — the "Contribute audio" feature is disabled for child accounts.
• Location data.
• Behavioral or interest profiling data for advertising.
• Social features or public-facing profile information.

4. UK Children's Code (Age Appropriate Design Code)

In line with the UK Children's Code, we apply the following standards to all users under 18 on the platform:

• Best interests of the child: Privacy settings default to the most protective option; no nudge techniques are used to push children toward sharing more data.
• Data minimisation: We collect only what is necessary to deliver the reading service.
• No data use for profiling: We do not profile children for commercial purposes.
• No geolocation tracking: We do not collect or use precise location data.
• Parental controls: Where a child account is linked to a family account (feature forthcoming), parents will have visibility and control over their child's activity.

5. GDPR Article 8 — digital age of consent

In EU member states, the digital age of consent ranges from 13 to 16. Where the age of consent in a user's country is above 13, we require parental or guardian consent for users below that age. We rely on the age declared at registration and will take prompt action if we discover consent was not properly obtained.

6. Data retention for child accounts

We retain child account data only as long as the account is active. Upon account deletion or parental revocation of consent, personal data is erased within 30 days. Reading-progress data is deleted immediately on account deletion.

7. Security

Passwords are hashed using Argon2id. Session tokens are stored in secure, HttpOnly cookies not accessible to JavaScript. We conduct regular security reviews of data handling processes.

8. Contact and complaints

For questions, requests, or complaints regarding children's privacy, contact us at [privacy@eddy.example.com — update before launch].
UK users may also contact the ICO: ico.org.uk.
US users may contact the FTC: ftc.gov.