Children's Privacy Notice

Effective: January 1, 2026 · Last updated: January 1, 2026

Moonpath is built specifically for children ages 5-8. This notice summarizes how we protect their privacy and how we comply with the Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation as it applies to children (GDPR-K), and the Apple App Store Kids Category and Google Play Families Policy requirements.

What we don't do

• We don't show ads of any kind, including in-house promotions.
• We don't include third-party advertising, analytics, or tracking SDKs.
• We don't ask for a name, email, phone, photo, address, or location.
• We don't collect or transmit your child's Advertising ID. The Android build explicitly removes the AD_ID permission.
• We don't allow communication between users — there is no chat, forum, social feed, or message inbox.
• We don't share or sell any data to third parties.

What we collect, and why

Under COPPA, certain operational data — strictly used to make the app work — does not require verifiable parental consent. Everything we collect falls into that category. Specifically:

• An anonymous device identifier (a UUID generated on the device on first launch). Used to send notifications and to record anonymous story ratings on our server. Not tied to any name, email, or other personal information.
• A push notification token from Apple Push or Firebase Cloud Messaging. Used only to deliver notifications you opted into. Disable in your device's notification settings to stop delivery.
• An anonymous "+1 star" event when your child rates a story. We store only the integer (1-5) per story counter; no identifier is sent with the rating.
• On-device app state — earned stickers, sparks, streaks, story progress. This stays on your device unless you contact us and choose to share it.

Parental controls

• Notifications can be disabled in iOS Settings → Notifications → Moonpath, or Android Settings → Notifications → Moonpath.
• Subscriptions and in-app purchases are gated behind a math-based parental-verification step in addition to the platform's own purchase password / Face ID gate.
• Removing all data can be done by deleting the app. To also remove the anonymous device identifier from our server, email hello@moonpath.app.

Service providers

We use the following providers, each contractually bound to use the data only for the specific purpose listed:

• Cloudflare — hosting and database.
• Apple Push Notification service / Firebase Cloud Messaging — delivering notifications.

No third-party advertising or analytics SDKs are integrated into the app.

Your rights

As a parent or guardian, you have the right to:

• Review the data we have collected related to your child.
• Request deletion of that data.
• Refuse further collection by uninstalling the app.

To exercise any of these rights, email hello@moonpath.app with a description of your request. We respond within 14 days.

Contact

Questions about children's privacy: hello@moonpath.app.

Placeholder document — final wording and business entity will be filled in before App Store / Play Store submission.