TameTube ("we," "us," or "our") is a parent-controlled media platform designed to provide children with a safe, distraction-free YouTube viewing environment without algorithmic rabbit holes, comments, or autoplay traps.
We are fiercely committed to safeguarding the privacy of families and children. This Privacy Policy outlines our strict data collection, usage, and security practices in compliance with the **Children's Online Privacy Protection Act (COPPA)**, the **General Data Protection Regulation (GDPR-K)**, and other applicable global privacy regulations.
2.Information We Collect
2.1 Parent Account Information
To establish and administer a parent account, we collect:
Parent email address (used for account authentication and verifiable consent).
Parent display name and optional profile avatar (via Google OAuth).
Regional preference (US, EU, AP) to ensure local database routing.
Billing details processed directly by our payment processor, Stripe (we never store raw credit card numbers).
2.2 Child Profile Data
When a parent creates a child profile, we collect only the minimal data required for functionality:
Parent-assigned Nickname: An alias chosen by the parent (we do not collect children's legal names).
Age Bracket: Used exclusively to filter certified age-appropriate collections.
Hashed Kid Access Key: Cryptographically hashed login key used by the child to access their viewer.
Viewing Analytics: Daily watch session timestamps and playlist history for parent dashboard display.
What We Strictly NEVER Collect from Children:We never collect real names, physical addresses, GPS location, phone numbers, audio/video recordings, photos, or persistent behavioral tracking cookies from children.
3.How We Use Information
All data collected is used strictly for internal operational purposes:
Delivering the parent-curated video dashboard and kid player.
Enforcing parent-configured daily screen-time limits and bedtime lockouts.
Displaying watch history exclusively to the verified parent or guardian.
Preventing unauthorized access through secure session tokens.
We do NOT sell, rent, monetize, or share children's data with advertisers, third-party data brokers, or profiling algorithms.
4.Verifiable Parental Consent (Email Plus Method)
In accordance with COPPA Rule § 312.5, TameTube employs the FTC-approved "Email Plus" method prior to activating any child viewing profile:
When a parent adds a child profile, a verification email is dispatched to the parent's registered email address.
The message outlines the specific data to be collected (nickname, screen limits, watch history).
The parent must confirm consent by clicking a secure, time-limited token link (expires in 24 hours).
Upon confirmation, a follow-up confirmation email is sent with permanent revocation instructions.
Parents may revoke consent at any time by deleting the child profile from their dashboard, which permanently erases all associated viewing history.
5.YouTube API Services & Third-Party Integration
TameTube uses YouTube API Services to allow parents to search and curate video content. By using TameTube, you acknowledge that:
Video playback occurs through YouTube's embedded player in privacy-enhanced mode (youtube-nocookie.com), which restricts YouTube from storing tracking cookies unless the user interacts with the player.
Railway & Cloudflare: Hosts application containers, databases, and secure edge routing with SSL/TLS encryption.
Resend: Dispatches transactional consent, security notifications, and family invitations.
Google OAuth: Optional parent sign-in method.
7.Multi-Region Data Residency (EU, US & Asia-Pacific)
To comply with regional data sovereignty standards and minimize latency, TameTube operates isolated regional database instances:
European Union Users (EU): Data is stored in Railway's EU-West datacenter in compliance with GDPR.
Americas Users (US): Data is stored in US datacenters in compliance with COPPA and US state privacy regulations.
Asia-Pacific Users (AP): Data is stored in Asia-Pacific regional datacenters in compliance with applicable privacy frameworks, including the Australian Privacy Principles (APPs), Singapore Personal Data Protection Act (PDPA), and Japan Act on the Protection of Personal Information (APPI).
8.Data Security & Encryption
We implement enterprise-grade technical and organizational security controls:
All data in transit is encrypted using modern TLS 1.3.
Kid Access Keys are salted and hashed using bcrypt; plain text keys are never accessible by staff.
Parent dashboard accounts are protected with strict CSRF protection and HTTP-only JWT cookies.
Database connections operate within Railway's private internal network.
9.Your Rights as a Parent (Review, Export, Deletion)
Under COPPA and GDPR, parents hold comprehensive rights to:
Review: Inspect all watch history, playlists, and settings in the parent dashboard.
Delete: Delete individual child profiles, which immediately purges their watch sessions and history.
Export / Portability: Request a complete export of parent and child records.
Account Termination: Permanently close the parent account and delete all associated records.
10.Contact Us & Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or your family's data, please contact our privacy team: