Kidzy Privacy Policy
Effective: 5 August 2026
· Applies to: Kidzy for Android
(ai.ryddhu.kids)
The short version
Kidzy does not collect your child's data. There is no account, no sign-in, no analytics, no advertising code, and no Ryddhu AI server that receives anything about your child. Everything Kidzy knows — what was watched, what settings you chose, your PIN — stays encrypted on your device and is deleted when you uninstall the app.
The one thing that does leave your device is a request to YouTube to fetch videos, because Kidzy plays YouTube content. Section 4 explains exactly what that means.
We wrote this to be read, not survived. If anything is unclear, ask us: support@ryddhu.com.
1. Who we are
Kidzy is published by Ryddhu AI, an independent software studio operated by Karthick Navin in Chennai, Tamil Nadu, India.
Contact: support@ryddhu.com
Kidzy is intended to be set up and supervised by a parent or legal guardian. It is designed for children to use, but not for children to configure.
2. What Kidzy stores, and where
Every item below is stored only on your device. None of it is transmitted to us or to any third party.
| What | Why | Retention |
|---|---|---|
| Watch history (video ID, time, position) | So you can see what your child watched | Until you clear it or uninstall |
| Parent PIN | To stop a child changing safety settings | Stored only as a PBKDF2 hash — never the PIN itself |
| Safety settings (threshold, keywords, watch limits) | Your configuration | Until uninstall |
| Video information cache (titles, channels, thumbnails) | Speed, and less mobile data | Maximum 30 days |
| Thumbnail analysis results | So the same video isn't re-analysed repeatedly | Maximum 30 days |
The database is encrypted with SQLCipher (AES-256). The encryption key is held in the Android Keystore, backed by dedicated security hardware on most modern phones. Another app on the device cannot read Kidzy's data.
What Kidzy does not store
- No name, age, date of birth, gender or photo of your child
- No email address, phone number or postal address
- No contacts, calendar, location or device identifiers — no advertising ID
- No microphone or camera access — Kidzy does not request these permissions
- No voice recordings and no keystroke capture
- No behavioural profile, advertising profile or cross-app tracking
Kidzy requests exactly two Android permissions:
INTERNET and ACCESS_NETWORK_STATE (to check whether you
are online). You can verify this on the Google Play listing.
3. What we do not do
- No analytics. No Firebase, no Crashlytics, no Google Analytics, no Mixpanel or equivalent. We do not know how many screens you opened or how long you used the app.
- No advertising SDKs. Kidzy contains no ad network code.
- No selling or sharing data. We have no data about your child to sell. This is not a statement about our intentions — there is no collection mechanism to misuse.
- No cloud backup of child data. Android backup is disabled and device-transfer extraction is excluded. Your child's watch history does not travel to Google Drive or to a new phone.
- No accounts. There is nothing to sign into, so there is no credential to breach.
4. What leaves your device — and what YouTube receives
This is the part that matters most, so please read it.
Kidzy plays videos from YouTube, and cannot do that without contacting Google. When Kidzy loads or plays a video, Google (YouTube) receives:
- Your device's IP address
- Standard network information (user agent, approximate language and region)
- The video ID being requested
- Cookies YouTube sets in its own player, subject to Google's policies
We do not control this and cannot switch it off — it is how YouTube playback works for any app or website that embeds it.
What Google receives is governed by the Google Privacy Policy, not by this one. Kidzy uses the YouTube API Services, so the YouTube Terms of Service also apply to YouTube content shown in the app.
Advertising
YouTube may serve advertisements within the video player. These come from Google, not from Ryddhu AI. Kidzy's safety filter does not screen advertisement content — our filter assesses the videos we show, but it cannot inspect ads Google inserts. We consider this a genuine limitation and would rather you know than discover it.
We send no search terms, watch history or settings to Google beyond what is needed to fetch the specific videos being displayed.
Our content catalogue
Kidzy downloads a curated catalogue of vetted channels from our content server. This is a one-way download. The request tells our server only your IP address and that some copy of Kidzy asked for the catalogue file — the same information any website receives. It contains nothing about your child, your settings, or what was watched. We do not build profiles from it.
5. Children's privacy — COPPA, GDPR-K and DPDP
Kidzy is built so the strictest children's privacy rules are straightforward to satisfy: we do not collect personal information from children.
United States — COPPA
Under the Children's Online Privacy Protection Act, operators of child-directed services must obtain verifiable parental consent before collecting personal information from children under 13. Kidzy does not collect personal information from children, so this obligation does not arise. We nonetheless require a parent to complete setup before the app can be used, so that a responsible adult has configured the safety settings.
Europe and the UK — GDPR and GDPR-K
- Legal basis: the limited local processing Kidzy performs is necessary to provide the service you requested (Art. 6(1)(b)) and is carried out entirely on your own device.
- No profiling and no automated decision-making with legal or similarly significant effects (Art. 22).
- Data minimisation (Art. 5(1)(c)) — the table in section 2 is the complete list.
- Your rights (access, rectification, erasure, portability, objection) are exercisable directly and immediately: the data is on your device, and Settings → Clear all data erases it. We hold no copy, so there is nothing for us to return or delete on your behalf.
We are also mindful of the UK Age Appropriate Design Code: no nudge techniques toward longer use, no behavioural advertising, high-privacy defaults, and parent-controlled watch limits.
India — DPDP Act 2023
The Digital Personal Data Protection Act requires verifiable parental consent for processing a child's personal data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Kidzy does none of these. No child personal data is processed by us as a Data Fiduciary, because none reaches us.
6. Parental consent and control
On first launch, Kidzy requires a parent or guardian to confirm they are the parent or legal guardian, read and accept this policy, set a parent PIN, and choose a safety level. Until this is complete, the app cannot be used.
A parent can at any time view watch history, change the safety threshold, add or remove blocked keywords, set or disable watch limits, clear all stored data, and change the PIN.
To delete everything: either Settings → Clear all data, or uninstall Kidzy. Because we hold no server-side copy, deletion is immediate and complete — there is no retention period and no backup to purge.
7. Security
- Encryption at rest — SQLCipher (AES-256) for all local data
- Key protection — the database key is sealed by the Android Keystore
- PIN protection — stored as a PBKDF2 hash, never plain text; verified with a constant-time comparison; rate-limited with escalating delays after repeated failures
- Transport — all network traffic uses HTTPS/TLS; cleartext traffic is disabled at the platform level
- Code hardening — release builds are minified and obfuscated
No system is perfectly secure. But because Kidzy holds no data about your child on any server, there is no central database of children's viewing habits to breach — a stronger guarantee than any promise about our security practices.
8. Content safety — what we can and cannot promise
We want to be straight with you, because the alternative is a parent trusting a filter more than it deserves.
Kidzy's filter analyses video titles, descriptions, tags, channel reputation, category, and — using on-device image analysis — text and brightness in video thumbnails. It also scans for behavioural risks such as content encouraging imitation of dangerous stunts, compulsive viewing, or emotional manipulation. All image analysis happens on your device. No thumbnail or image is ever uploaded anywhere for analysis.
Kidzy's filter cannot watch the video itself. It does not analyse video frames or audio. A video with an innocuous title, description and thumbnail that becomes unsuitable partway through can pass our filter.
No automated filter is perfect. Kidzy substantially reduces the risk of unsuitable content, and we have tested it across 15 languages. It is not a substitute for adult supervision, and we ask you not to treat it as one. Please report anything that slips through to support@ryddhu.com — reports are how the filter improves.
9. Changes to this policy
If we change this policy materially, we will notify you in the app and update the date above. Where a change affects how data is handled, we will ask you to review it before you continue using Kidzy.
10. Contact
Email: support@ryddhu.com
Ryddhu AI, Chennai, Tamil Nadu, India
For privacy questions or complaints, write to us first — we will respond within 30 days. If you are in the EU or UK you also have the right to complain to your national data protection authority; in India, to the Data Protection Board.