Privacy Policy
This policy explains what [Operator name] ("we") collects and keeps when you use Kids Display: the public website, the admin app, the TV player, the phone controller and the Android TV app. The service is based in the United States and is offered in the United States only, for now.
1. What we collect
Account data. For admins and editors: name, email address and a hashed password (we never store the password itself), the organizations you belong to and your role. For an organization: its name and time zone.
Content. Whatever the organization uploads, links or writes: images, PDFs and the pages we render from them, video links, text slides, and room and schedule names. This may include personal data the organization chooses to include, such as photos of children.
Uploads and their fingerprints. For each uploaded file we keep who uploaded it, when, from which IP address and browser, the original file name and type, and cryptographic hashes (SHA-256) of the file as uploaded and of the stored copy. We convert images for display and also keep the original file exactly as it was uploaded, including any information the camera or phone stored in it (such as when and where a photo was taken). Only the site operator can retrieve an original (never other users or the TVs), each retrieval is logged, and the original is deleted together with the display copy. We keep this record even after the file itself is deleted.
Logs and activity records.
- IP addresses and browser user agents, on sign-in and on requests to the service.
- Server access logs: time, the page or API call, the result, and which account or device made it.
- An audit log of who did what and when: sign-ins and failed sign-ins, password changes, membership and role changes, uploads, changes to media, schedules, rooms and devices, reports and takedowns, and our own access to your organization. We keep this as an application-enforced append-only log. It is not tamper-proof.
Device data. For each TV or device: its name, app version, browser user agent, when it was last seen, and a device key stored on the device.
Children. The service is not directed to children, and we do not collect personal information from children who watch displays. Displays show content and do not ask the viewer for anything. Photos or names of children appear only when an organization uploads them. The organization is responsible for getting the parent or guardian consent that its own policies and the law require.
2. How we use it
To run and secure the service, to prevent and investigate abuse, to respond to reports and takedown notices, to support organizations, and to meet legal obligations. We do not sell personal data, show ads, or use it for profiling.
3. Who can see it
- Your organization. Its admins and editors can see the organization's content, rooms and members.
- Our staff. We can access an organization's account and content for support, safety and legal reasons. That access is logged. Where child safety is involved we may restrict access to material without viewing it.
- Service providers. Our hosting and infrastructure providers, who process data for us.
- YouTube. When a YouTube video plays, it plays in YouTube's embedded player, loaded from youtube-nocookie.com, and the page loads Google's player script. The service uses YouTube API Services, and Google's privacy policy applies. Google may collect data from the device that plays the video, and may store data on it (see section 4).
- Legal process and safety. We disclose information when we believe in good faith that a subpoena, court order, warrant or other valid legal process requires it, to report apparent child sexual exploitation to NCMEC as the law requires, to prevent imminent harm, or to protect the rights and safety of the service and its users. We may preserve information when we receive a legal request or a report that requires it.
4. Cookies and local storage
We use one cookie and some local storage on your device. All of it is strictly necessary to run the service, and none of it is used for tracking or advertising. This is an information notice, not a consent banner, because there is nothing optional to switch off, except for what Google's player stores (last row).
| Where | Item | What it is for | How long |
|---|---|---|---|
| Admin app | Cookie kd_session (HTTP-only, SameSite=Lax, Secure on HTTPS) |
Keeps you signed in | Up to 30 days, or until you sign out |
| Admin app | Local storage kd.cookieNotice |
Remembers that you dismissed the cookie notice | Until you clear it |
| TV player and Android TV app | Local storage kd.token and kd.state |
Identifies the device, and keeps the last playlist so it still works through a short network drop | Until the device is reset or its storage cleared |
| Phone controller | Nothing is stored. The control key is in the address you open | ||
| Landing page, legal pages | Nothing. These pages have no scripts | ||
| YouTube player (admin preview and the TV player) | Set by Google, not by us. We load it from youtube-nocookie.com | Plays YouTube videos. Google may store data on the device or in the browser once a video plays, and Google's policy applies | Set by Google |
We do not use analytics, advertising or cross-site tracking, so there is nothing for a Do Not Track setting to change.
5. How long we keep things
These are the periods we aim for. They may be longer when we must preserve data (a legal hold, a legal request, or a child-safety report).
| Data | Kept for |
|---|---|
| Account data | While the account is active. A deleted account is removed after 30 days. |
| Content deleted by a user (the Trash) | 30 days, then purged |
| Uploads never attached to anything | 7 days |
| An organization's content after the organization is closed | 30 days |
| Audit log, general | 2 years |
| Failed sign-in and lockout records | 90 days |
| Server access logs | 90 days |
| Records of accepting these documents | Account life plus 2 years |
| Reports and copyright notices | 3 years |
| Material preserved for a child-safety report | At least 1 year |
| Backups | Up to 14 days, locally and off-host |
Backups. We take nightly backups of the database and keep a copy of uploaded files off the main server. Data you delete may therefore remain in backups for up to 14 days. Backups are limited and not guaranteed (see the Terms).
6. Security
We hash passwords, use HTTPS, limit who can reach the server, sign file links so they stop working after a short time, and log staff access. Material quarantined for child-safety reasons is encrypted at rest with a key we keep separate from the data. That protects against accidental viewing and against copies of the data being read elsewhere. It does not protect against someone with full control of the server. No system is perfectly secure.
7. Your choices
Organizations can ask to access, correct or delete account data using the report form. We will honor requests as applicable state law requires. Users can change their password in the admin app.
8. Location
Data is stored and processed in the United States. The service is not offered outside the United States, so contact us before signing up if your organization is elsewhere.
9. Changes and contact
We will tell you about material changes by asking you to accept the new version when you next sign in. Earlier versions stay available at All legal documents. We do not publish an email address at this time. Use the report form.
This is version 2026-10-06 of the Privacy Policy.