Cookie Policy

Effective Date: August 2, 2026 Last Updated: August 2, 2026

Kiddo AI ("we," "us," or "our") is an AI-powered personalized storybook platform for children ages 2–12. This Cookie Policy explains which cookies and similar storage technologies we use, on which part of our service we use them, what they are for, and what control you have over them.

This document is a companion to our Privacy Policy and does not replace it. Where this policy describes a technology, the Privacy Policy describes the underlying data and your rights over it.

Kiddo AI is 100% ad-free. We want to be direct about what that means here: we do not use advertising cookies, marketing pixels, behavioural tracking, or third-party analytics on any of our surfaces. The short version of this policy is that we use a small number of strictly necessary cookies on our backend, and local device storage in our apps — and nothing else.

What This Policy Covers
What Cookies and Similar Technologies Are
Our Website (kiddoai.net)
Our Backend Service (api.kiddoai.net)
Our Mobile App (iOS and Android)
Our Admin Dashboard (admin.kiddoai.net)
Server Logs
What We Do Not Use
Third Parties
Children and Cookies
Consent and Legal Basis
How to Control Cookies and Local Storage
Changes to This Policy
Contact Us

1. What This Policy Covers

Kiddo AI is delivered across four surfaces, and they behave very differently:

Our marketing website at kiddoai.net
Our backend service at api.kiddoai.net, which our apps talk to
Our mobile app for iOS and Android, where families actually create and read stories
Our internal admin dashboard at admin.kiddoai.net, used only by Kiddo AI staff

Each section below tells you exactly what is stored on that surface. If a surface is not listed as storing something, it does not store it.

2. What Cookies and Similar Technologies Are

Cookies

A cookie is a small text file that a website asks your browser to store and send back on later visits. Cookies are commonly split into two groups:

Strictly necessary cookies — required for a service to work at all, such as keeping you signed in.
Optional cookies — analytics, personalization, and advertising cookies, which require your consent in the EU and UK.

Kiddo AI uses only strictly necessary cookies. We do not set any optional cookies.

Similar technologies

Cookies are not the only way information can be stored on a device. The technologies relevant to Kiddo AI are:

localStorage — a browser storage area that persists until it is cleared. Unlike a cookie, it is never automatically transmitted to a server.
AsyncStorage — the equivalent storage area inside a native mobile app. It lives inside the app's private sandbox on your device.

Because these technologies read and write information on your device, EU and UK law treats them the same way it treats cookies, so we disclose them here even though they are not, strictly speaking, cookies.

3. Our Website (kiddoai.net)

Our marketing website sets no cookies at all. It also uses no localStorage and no sessionStorage.

kiddoai.net is a fully static site. Everything it needs is served from our own domain:

No analytics. There is no Google Analytics, no Google Tag Manager, no Plausible, no Vercel Analytics, and no other measurement tool. We do not count, segment, or profile visitors.
No advertising or marketing pixels. No Meta/Facebook Pixel, no ad network tags, no remarketing scripts.
No third-party fonts at runtime. Our Nunito and Open Sans fonts are downloaded once at build time and served from our own servers, so your browser never contacts Google Fonts.
No embedded third-party content. There are no embedded videos, maps, chat widgets, comment systems, or social media embeds that could set cookies on our behalf.
No language cookie. Your language is determined entirely by the address you visit (for example /en or /tr), not by a stored preference.

This is why you will not see a cookie consent banner on kiddoai.net. There is nothing to consent to.

4. Our Backend Service (api.kiddoai.net)

Our backend does set cookies. All of them are first-party and strictly necessary, and none of them are used for analytics, profiling, or advertising.

Cookie	Purpose	Lifetime	Who receives it
`connect.sid`	Session identifier. It holds no personal data itself — it is a random reference to a short-lived session record kept on our own servers (Redis, hosted in Germany). It exists to carry the Google sign-in flow safely from start to finish.	24 hours	Browsers that make requests to our API
`auth_token`	Authentication cookie. After you complete a Google sign-in in a browser, this cookie carries your signed session token (a JSON Web Token) so you arrive back at Kiddo AI already signed in.	24 hours	Browsers completing a web sign-in
`kiddo_queue_board`	Internal operations only. Grants a signed-in Kiddo AI administrator access to our background job monitoring page. It is scoped to a single internal path and is never issued to families.	8 hours	Kiddo AI staff only

Security properties

All of these cookies are marked Secure in production, meaning they are only ever transmitted over an encrypted HTTPS connection.
auth_token is set with SameSite=Lax, which prevents it from being sent along with cross-site requests.
kiddo_queue_board is HttpOnly, so it cannot be read by page scripts, and is restricted to our internal job monitoring path.
Session records are stored on our own infrastructure in Nuremberg, Germany, and expire automatically after 24 hours.

Our API issues a session identifier to browser clients as part of handling a request, including before sign-in is complete. This is a technical requirement of the sign-in flow. The session record it points to contains no advertising identifier, no browsing profile, and no data about your children.

5. Our Mobile App (iOS and Android)

The Kiddo AI mobile app does not use cookies. Native apps do not have a browser cookie jar in the way a website does, and we do not rely on one. Instead, the app keeps a small amount of information in AsyncStorage, a private storage area inside the app's own sandbox on your device.

Stored item	What it is	Why
`sessionToken`	Your signed-in session token (JWT)	Keeps you signed in between app launches so you do not have to authenticate every time
`user`	A cached copy of your own profile	Lets the app show your account instantly on launch, without waiting for the network
`@KiddoAI:installId`	A random identifier (UUID) generated once per app installation	Distinguishes this installation of the app, so device-specific features such as push notifications are delivered to the right place
`@kiddo/onboardingCompleted`	A yes/no flag	Prevents the first-run introduction from being shown again
`@kiddo/settings`	Your app preferences — language, audio, notification, and theme settings	Remembers how you have set the app up
`@kiddo/storyReadSettings`	Your reading preferences — text size, display theme, narration volume, Child Mode options	Remembers how your family likes to read
`@kiddo/readerTourSeen`	A yes/no flag	Prevents the reading-screen tour from being shown again

Most of this information stays on your device and is never sent to us. Your session token is sent to our API to authenticate your requests, and your install identifier is sent so that push notifications can reach the correct device.

Third-party storage inside the app

Two components we rely on also keep small amounts of information on your device as part of doing their job:

RevenueCat, which manages subscriptions, stores a subscriber identifier and your entitlement status locally so the app knows whether your Plus subscription is active, including when you are offline.
Firebase Cloud Messaging, which delivers push notifications, stores a device push token. This is only created if you grant notification permission. If you decline, no token is created or collected.

Neither of these is an advertising or analytics component. Firebase Analytics is explicitly disabled in our app, and we do not use the Facebook SDK, AppsFlyer, Adjust, Branch, or any similar attribution or measurement SDK.

Signing in through your browser

Google and Apple sign-in open your device's own browser or system sign-in sheet. Any cookies set during that step belong to Google or Apple and are governed by their privacy policies, not by this one. We never see them.

6. Our Admin Dashboard (admin.kiddoai.net)

Our admin dashboard is used exclusively by Kiddo AI staff. It is not accessible to families and is documented here only for completeness.

It sets no cookies. It stores two things in localStorage:

auth_token — the administrator's session token, used to authenticate requests to our API.
tableColumnSettings_… — which columns an administrator has chosen to show or hide in a given data table.

There is no analytics tooling in the admin dashboard either.

7. Server Logs

Separately from cookies, our API keeps technical request logs on our own servers. These are created by our infrastructure, not by anything stored on your device, but we mention them here so the picture is complete.

Each log entry may include the IP address the request came from, the browser or app user agent string, the request path and method, the response status, and how long the request took. We use these logs to operate the service, diagnose faults, and investigate abuse. They are not used to build profiles of you or your family, are not shared with advertisers, and are never combined with children's data for any marketing purpose.

8. What We Do Not Use

To state it plainly and without qualification, across every Kiddo AI surface:

No advertising cookies, ad networks, or advertising SDKs
No marketing or conversion pixels (no Meta/Facebook Pixel, TikTok pixel, LinkedIn Insight Tag, or equivalent)
No behavioural advertising, retargeting, or ad profiling
No third-party web analytics (no Google Analytics, Google Tag Manager, Plausible, Vercel Analytics, Matomo, Mixpanel, PostHog, Amplitude, Segment, Hotjar, or Microsoft Clarity)
No third-party analytics SDKs in the mobile app (Firebase Analytics is explicitly disabled)
No crash reporting SDKs (no Sentry, no Crashlytics, or similar)
No session replay or heatmap tools
No cross-site or cross-device tracking
No fingerprinting
No advertising identifiers (we do not request the IDFA or use App Tracking Transparency, because we have nothing to track you for)
No data brokers, and no selling of data

9. Third Parties

No third party sets a cookie on kiddoai.net. The only third-party components that store anything on a device do so inside our mobile app, and both are functional rather than promotional:

Provider	What it stores on your device	Why
RevenueCat	Subscriber identifier and subscription entitlement status	So the app knows whether your Plus subscription is active
Firebase Cloud Messaging (Google)	Device push notification token	So push notifications can be delivered — only if you grant permission

Google and Apple may set their own cookies during sign-in, within their own sign-in pages. That processing is theirs, and their respective privacy policies apply to it.

A fuller list of the service providers we work with — including our AI, text-to-speech, storage, and payment providers — is set out in the Third-Party Services section of our Privacy Policy. None of them place cookies or tracking technologies on your device through Kiddo AI.

10. Children and Cookies

Kiddo AI is built for parents and guardians to use on behalf of children ages 2–12. Children do not create accounts and are not tracked.

We do not use any cookie or storage technology to track children, build profiles of children, or target content or advertising at children.
The information our app stores on a device is either about the parent's account (a session token, a cached parent profile) or about how the app should behave (settings, reading preferences, first-run flags).
Reading and listening activity used to power reading statistics, streaks, and badges is stored in your family's account on our servers, tied to the child profile a parent created. It is not derived from cookies or from any tracking technology, and it is visible only to your family.
We do not share any of this with advertisers or data brokers, because there are none.

This approach is designed to meet the requirements of the Children's Online Privacy Protection Act (COPPA) and Article 8 of the GDPR.

Under the EU ePrivacy Directive, the GDPR, and equivalent UK rules, consent is required before storing information on a user's device — except where that storage is strictly necessary to provide a service the user has explicitly requested.

Every cookie and storage item described in this policy falls within that strictly necessary exemption:

Session and authentication cookies exist so that signing in works and stays working.
App storage exists so that you stay signed in, and so that the settings you chose are still there next time.

We therefore do not ask for cookie consent, and you will not see a consent banner. There is no optional tracking to opt in or out of, because we do not do any.

Our servers are located in Nuremberg, Germany (Hetzner), so this data is processed within the European Union.

12. How to Control Cookies and Local Storage

On our website

There is nothing to manage — kiddoai.net stores nothing on your device.

In your browser

Every major browser lets you view, block, and delete cookies and site data through its settings, usually under "Privacy" or "Cookies and site data". Blocking strictly necessary cookies for api.kiddoai.net will prevent browser-based sign-in from completing.

In the mobile app

Sign out from the app menu. This clears your stored session token and cached profile.
Uninstall the app. This removes everything the app has stored on your device, including all settings and identifiers.
Turn off notifications in your device settings, or in the app's own settings, to stop the push token being used.
Your device-level settings for the app can be found under Settings → Kiddo AI on iOS, or Settings → Apps → Kiddo AI on Android.

Your wider rights

Clearing storage on your device does not delete data held in your account. To access, correct, export, or delete the data we hold, see the Your Rights section of our Privacy Policy, or write to us at hello@kiddoai.net.

13. Changes to This Policy

If we ever introduce a new cookie or storage technology — for example, a privacy-respecting way of understanding which features families use — we will update this policy first, revise the "Last Updated" date above, and, where the law requires consent, ask for it before anything is stored.

We will notify you through the app when we make material changes.

14. Contact Us

If you have questions about this Cookie Policy, or about anything Kiddo AI stores on your device, we are happy to answer them:

Email: hello@kiddoai.net
Website: kiddoai.net
In-App: Menu → Contact Us