Privacy Policy

Version 2026-10-21 · Effective October 21, 2026 · Kiddlewood is operated by Tosemum Holdings LLC, an Arizona limited liability company ("Kiddlewood," "we," "us"). For accounts created before October 21, 2026, the changes in this version take effect on October 28, 2026. Until then, the October 2, 2026 version applies to those accounts.

1.Who uses Kiddlewood

Kiddlewood accounts are created and controlled by adults: parents, legal guardians, and representatives of local businesses. The app is 18+, and children do not use the Service themselves. All information about children in Kiddlewood is entered by, and remains under the control of, the parent or guardian who owns the account, with their consent (Section 4).

2.Information we collect

Account information

• Email address and password. Passwords are stored hashed by our authentication provider; we never see or store them in plain text.
• For parent accounts, your date of birth is asked at signup to confirm you are an adult. We keep only the year of birth, together with a record that you confirmed you are 18 or older and the parent or guardian of any child you add.

Profile information you choose to add

• Your name, bio, interests, and an optional profile photo (of you, the adult).

Children's information entered by the parent

• For each child, a first name or nickname and an age, entered by you, the parent. Only you can see a child's name and age; other users see a count of children and their age ranges (Section 3).
• That is the extent of it: we do not collect children's photos, birth dates, schools or contact details, and we never collect any information from a child directly. How we ask for and record your consent is described in Section 4.

Location

• We use your device's position only when you ask us to. The app reads it after you tap Use My Location (during setup, on the Families tab, or when registering a Business) or Update My Location (in Edit Profile). Next to each of these buttons, the app explains that we keep only a rough area, and the first time, your phone asks for your permission.
• You can type your area instead. During setup, choose "Or enter your area manually" and type a city, ZIP or postcode. In Edit Profile, the same box appears when location access is off or your position cannot be read. The text you type is sent through our server to Google to find a matching area and a rounded point.
• Your exact position never leaves your phone, and we keep only a rounded area. On your phone, the app rounds your position to a point on a grid about half a mile wide. That rounded point is sent to our server, which rounds it again before storing it, and from our server to Google to find the name of the surrounding area, such as a suburb or town. We store the rounded point, the area name and your country, nothing more precise. If our server cannot be reached, the app asks your phone's own location service (Apple or Google) to name the rounded point instead.
• If you type a neighbourhood or city name in your profile (at signup, or in the Neighbourhood box in Edit Profile), it is saved as you typed it and other families can see it. Type a general area, such as a suburb or town, never a street address.
• The app only ever shows other families an area name and a distance range, such as "1 to 3 mi away", never a map or coordinates.
• If you have given location permission, the app also checks your position on your phone once each time it starts, to see whether you are more than about 50 miles from your saved area, so that it can offer to update your area if you appear to have moved. Only a count of days away and the time of the last check are saved. If the app offers to update your area, the rounded point is named as described above; otherwise the position is not sent anywhere. Turning off location access for Kiddlewood in your phone's settings stops this check.
• Older Android versions of the app worked differently: they sent your device's exact position directly to Google to find the area name, without rounding it first. Updating to the latest version from Google Play stops this.

Content you create

• Introductions, playdates and activities you post, neighbourhood alerts, messages you send (one-to-one and in your neighbourhood group), and reports you submit.

Business information (Business accounts)

• Business name, category, description, contact details, website, address, logo, listings, and subscription status. Business contact details and address are public-facing by design: that is the point of a listing.

Push notifications

• If you allow notifications, your phone gives the app a push token: a code issued by Expo's push service that identifies this app on this device, so that a notification can be delivered to it. We store the token with your account, along with whether the device is an iPhone or an Android phone. We do not store any other device identifier.
• We send a notification when someone sends you a one-to-one message, asks to connect with your family, or accepts your connection request. A notification contains the other person's display name and a short fixed line such as "Sent you a message". It never contains the text of a message.
• The same items also appear in the in-app notifications list, together with a once-a-day summary of interest in activities you posted. That summary stays in the app and is never sent as a notification.

Technical information

• Session tokens that keep you signed in, and the routine server logs kept by our hosting provider. The app contains no analytics, crash-reporting or advertising software.

3.What other users can see

4.Children's information

Kiddlewood is for adults. Children cannot have accounts, and we never collect information from a child directly. Information about a child comes only from their parent or guardian, who controls it, and we treat it with the highest care:

• What we keep. For each child, a first name or nickname and an age, entered by the parent. We do not collect children's photos, birth dates, schools or contact details.
• Who can see it. A child's name and age are visible only to the parent who entered them. Other users see only a count of children and their age ranges.
• How we use it. Only to provide the app's features to that family, for example showing other families a count and age ranges so playdates can be matched by age. We never use children's information for advertising or marketing, never sell it, and never permit third parties to collect it from the app for their own purposes.
• Your consent as the parent. During account setup, before you add your children, the app asks for your consent and records that you gave it. By adding a child, during setup or later in Edit Profile, you confirm that you are the child's parent or legal guardian and that you consent, for your child, to us handling their details as this policy describes (Terms of Service, Section 4). Several countries and regions require a parent's consent for a child's information, including Quebec (children under 14), South Africa and Nigeria (children under 18), and Singapore under the guidance of its Personal Data Protection Commission. Your consent as the parent is how we meet these rules.
• Withdrawing consent. You can withdraw your consent at any time by removing your child's details in Profile → Edit Profile → Your Kids: tap ✕ next to a child or, if only one child is listed, clear their name and save. We then delete that child's name and age. Deleting your account removes all of your family's information (Section 7). We keep the record of your consent while your account exists, and it is deleted with your account.
• If you believe a child's information was provided or collected contrary to this policy, contact privacy@kiddlewood.com and we will delete it.

5.How we use information

• To run the Service: accounts, profiles, discovery of nearby families, playdates, messaging, alerts, and Business listings.
• For safety: operating report and block tools, reviewing reported content, moderating using manual and automated tools, enforcing our Terms, and meeting our legal reporting obligations (Section 8).
• To communicate with you: transactional email such as signup confirmation and password reset codes, and the push notifications described in Section 2. We do not send marketing email or marketing notifications to families.
• For billing: managing Business subscriptions through Stripe.

6.Service providers

We share information only with the providers that run the Service, and only as needed to run it:

• Supabase: database, authentication, file storage, and the server functions that geocode locations, send notifications and delete accounts.
• Stripe: payment processing for Business subscriptions. Your card details go directly to Stripe; we never store card numbers.
• Resend: delivery of transactional email (confirmations, reset codes).
• Expo: app build and update infrastructure, and push notification delivery. Expo's push service receives your push token and the notification text and passes them to Apple or Google.
• Apple and Google: app distribution through their stores, and delivery of push notifications to your phone through Apple's and Google's notification services. Your phone's own location service (Apple or Google) may also be asked to name your rounded location point, as described in Section 2.
• Google Maps Platform: converting a rounded location point, or a place name you type, into an area name. Requests go through our server, which does not log the point or the text you typed.
• Content-safety screening: content you submit, including message text, is checked by our own systems inside our database (Section 8). We do not send it to any outside company for screening. If we ever add an outside screening provider, we will name it in this policy and tell you before it starts.

We use no advertising networks and no third-party analytics. We may also disclose information if required by law, legal process, or to protect the safety of a child or any person.

7.Retention and deletion

• We keep your information while your account is active.
• Deleting your account (Settings → Delete My Account) removes your profile, your family's information, your photos, your posted activities, comments and alerts, your messages and connections, your notifications, your push tokens, your parental consent record, and your terms acceptance record from the live service. Deletion is immediate and permanent. See our Delete Your Account page.
• Some records are kept after deletion where the law requires or a legitimate need exists: billing records for Business subscriptions, which Stripe keeps as our payment processor; records of content our automated check blocked (Section 8); and safety reports as described in Section 8, with your account identifier removed but the copy of the reported content kept as evidence. Residual copies in routine backups cycle out on a limited schedule.

8.Safety disclosures and legal reporting

Automated screening. Before it is posted, text you submit is checked automatically by our own systems for content that may indicate a safety risk. The check covers messages (one-to-one and group), activities and Business listings, alerts, profile bios, and Business names and descriptions. If the check blocks something, it is not posted, and we keep a copy of the blocked text so that our safety team can review it. Content that is flagged may be reviewed by a member of our safety team.

Asking for a human review. If the automated check blocked something and you think it got it wrong, email safety@kiddlewood.com and ask for a human review. A member of our team will look at it and reply to you.

Kiddlewood has zero tolerance for child sexual abuse and exploitation. If content or conduct on the Service appears to involve child exploitation, we report it to the National Center for Missing & Exploited Children (NCMEC) and, where it involves Canada, to Cybertip.ca, and we cooperate with law enforcement. Federal law (18 U.S.C. §2258A) requires us to preserve information related to such reports for an extended period, currently one year, and we do so even if the associated account is deleted. Reports you submit through the in-app Report tool, including a copy of the reported content, are retained so we can review them, act on them, and meet these obligations; the person you report is not told who reported them.

9.Security

Passwords are hashed. Database access is protected by row-level security so users can only reach the data the app intends for them. Profile photos and business logos are stored at unlisted web addresses; they are not private files, so do not upload a photo you would not want seen. Access to production systems is limited. No online service can promise perfect security, but Kiddlewood was designed privacy-first: the most important protections, children's names and ages hidden from other users and only rounded locations ever stored, are built into how the app works, not bolted on.

Incidents and breaches. We keep a register of security and privacy incidents. If an incident affects your information, we will notify you, and the regulators, where the law requires. Section 12 describes what this means in each country where Kiddlewood is available.

10.Where your information is stored

Kiddlewood is run from the United States by Tosemum Holdings LLC. Your information is stored in the United States (Amazon Web Services, North Virginia) by our hosting provider, Supabase. Some of the providers in Section 6 may process it in other countries to deliver the service. Providers that act for us are bound by contract to protect your information to a standard comparable to this policy. Apple and Google handle app store and notification data under their own privacy policies. Authorities in the United States may be able to access information held there under US law.

11.Your rights and choices

You have these rights wherever you live:

• Access and correction. You can see and correct your profile and family information in the app at any time (Profile → Edit Profile), or ask us to do it.
• Deletion. You can delete your account in Settings → Delete My Account, or ask us to delete your information.
• A copy of your information. You can ask us for a copy of your information in a structured, commonly used format (JSON).
• Withdrawing consent. You can withdraw consent at any time: remove a child's details (Section 4), turn off location access or notifications in your phone's settings, or delete your account. This does not affect what we did before you withdrew it, and some features, such as finding nearby families, may not work without the information.
• How to ask. Email our Privacy Officer at privacy@kiddlewood.com. We may need to confirm that the request comes from you. We reply within 30 days (in New Zealand, within 20 working days).
• Complaints. If you are not happy with our answer, you can complain to the privacy regulator where you live. Section 12 lists the regulator for each country where Kiddlewood is available.
• We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.
• Location permission is controlled by your device settings. If you do not grant it, you can type a city, ZIP or postcode instead, and the app's area features work from the area you have set.
• Push notifications can be turned off at any time in your phone's settings: on iPhone, Settings, Notifications, Kiddlewood; on Android, Settings, Apps, Kiddlewood, Notifications. Signing out of the app removes that device's push token from our servers, and deleting your account removes all of them.

12.International users

Kiddlewood is currently available in the United States, New Zealand, Singapore and Nigeria. It is not currently offered in Australia, Canada or South Africa; the sections for those countries below still apply to any account created there. Everything else in this policy applies wherever you live. This section adds what the law where you live requires. Our Privacy Officer handles every request in this section at privacy@kiddlewood.com.

Canada, including Quebec

• Person in charge of the protection of personal information: our Privacy Officer, privacy@kiddlewood.com.
• In Quebec, information about a child under 14 needs the consent of a parent. We only receive a child's information from their parent, who gives that consent (Section 4).
• Your information is stored in the United States and may be accessible to authorities there (Section 10).
• You can ask to access or correct your information, or to get a copy in a structured, commonly used format. We reply within 30 days.
• We keep a register of confidentiality incidents. If a breach creates a real risk of significant harm (in Quebec, a risk of serious injury), we will notify the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information, and the people affected.
• You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca, in French).

Australia

• Privacy Officer: privacy@kiddlewood.com.
• Kiddlewood is only for adults 18 and over. Nobody under 18 may have an account.
• You can ask to access or correct your information. We reply within 30 days.
• If a data breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the people affected.
• Please contact us first. If you are not satisfied with our answer, or we have not replied within 30 days, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

• Privacy Officer: privacy@kiddlewood.com.
• When a parent tells us about their child, we collect the child's information from the parent, not from the child. As information privacy principle 3A requires, we tell the parent what we hold: the child's first name or nickname and age, kept only to match families by age, visible only to that parent, with other families seeing only age ranges. The parent can see, correct or remove it at any time (Section 4).
• You can ask to access or correct your information. We reply within 20 working days.
• If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable.
• Please contact us first. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Singapore

• Data Protection Officer: our Privacy Officer, privacy@kiddlewood.com.
• By creating an account you consent to the collection, use and disclosure described in this policy. You can withdraw consent at any time by removing a child's details, turning off location access, deleting your account, or emailing our Data Protection Officer. Withdrawing consent may mean we can no longer provide some or all of the service.
• In line with the Personal Data Protection Commission's guidance on children's personal data, a parent gives consent for their child (Section 4).
• When we transfer your information outside Singapore, the recipient is bound by contract to protect it to a standard comparable to the Personal Data Protection Act.
• You can ask to access or correct your information. We reply within 30 days.
• If a data breach is notifiable, we will notify the Personal Data Protection Commission and the people affected as the law requires.
• You can complain to the Personal Data Protection Commission (pdpc.gov.sg).

South Africa

• Kiddlewood is no longer available to download in South Africa. This section applies to existing South African accounts.
• Information Officer: our Privacy Officer, privacy@kiddlewood.com.
• Under the Protection of Personal Information Act, a child is anyone under 18. We process a child's information only with the prior consent of their parent or guardian, given when the parent adds the child's details (Section 4).
• We transfer your information to the United States with your consent and under contracts that require comparable protection.
• You can ask to access, correct or delete your information, or object to how we process it. We reply within 30 days.
• If your information is accessed or acquired by someone without authority, we will notify the Information Regulator and you as soon as reasonably possible.
• You can complain to the Information Regulator (inforegulator.org.za).

Nigeria

• Privacy Officer: privacy@kiddlewood.com.
• Under the Nigeria Data Protection Act, a child is anyone under 18. We process a child's information only with the consent of their parent or guardian, given when the parent adds the child's details (Section 4).
• You can ask to access, correct or delete your information, get a copy of it, restrict or object to how we process it, or withdraw your consent. We reply within 30 days.
• If a breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will tell you where the law requires.
• You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

United States

• Privacy Officer: privacy@kiddlewood.com.
• Kiddlewood is for adults. We do not collect information directly from children under 13, or from any child. Information about a child is entered only by their parent (Section 4).
• You can ask to access, correct or delete your information, or get a copy of it, wherever you live in the United States. We reply within 30 days.
• California residents. If you are a California resident, you have the right to know what personal information we collect and how we use it (described above), to request access to or deletion of your information, to correct it, and to not be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising. To make a request, email privacy@kiddlewood.com; we will verify and respond as required by law.
• You can complain to the California Privacy Protection Agency (cppa.ca.gov) if you live in California, or, about children's privacy, to the Federal Trade Commission (reportfraud.ftc.gov).

Everywhere else

• Wherever you live, you can ask our Privacy Officer at privacy@kiddlewood.com to access, correct or delete your information, or to get a copy of it in a structured, commonly used format. We reply within 30 days. You can also complain to the data protection authority where you live.

13.Changes to this policy

If we make material changes to this policy, we will notify you in the app or by email before they take effect. The version and effective date at the top always reflect the current policy.

For accounts created before October 21, 2026, the changes in this version take effect on October 28, 2026. Until then, the October 2, 2026 version applies to those accounts.

14.Previous versions

• Version 2026-10-02, effective October 2, 2026, and in force until October 27, 2026 for accounts created before October 21, 2026.
• Version 2026-07-28, effective July 28, 2026 to October 1, 2026.

15.Contact

Tosemum Holdings LLC · Arizona, USA
Privacy Officer, Tosemum Holdings LLC: privacy@kiddlewood.com
General & support: hello@kiddlewood.com
Child safety: safety@kiddlewood.com

Our Privacy Officer is also our person in charge of the protection of personal information (Quebec), our Data Protection Officer (Singapore) and our Information Officer (South Africa).