Privacy Policy

This Privacy Policy explains how Puffling, Inc. ("Puffling," "we," "us," "our") collects, uses, discloses, and retains information when you use our mobile application, website(s), and related services (collectively, the "Service").

By using the Service, you acknowledge the practices described in this Privacy Policy.

1) Who Puffling is for

Puffling is designed for parents/guardians and adult caregivers. The Service provides personalized play activities, stories, and rhymes for children.

Children should not use the Service to create accounts or provide information directly to us.

2) Summary of key points

• We collect limited information about parents/guardians (first name, email).
• We collect structured information about children that parents/guardians choose to provide (child first name, birthdate, age range, interests, milestone selections).
• We do not collect phone numbers, photos, audio, or video.
• We do not run ads or use third-party advertising/retargeting.
• We use third-party AI processing providers to generate content. We do not send a child's birthdate to those providers; we send an age range instead (e.g., "2-3 years old"). We require that those providers do not train on data we send them.
• We do not store prompts. We do store generated outputs so you can access and sync them across devices.
• You can delete a child profile or delete your account in-app, which permanently deletes your data from our systems.

3) Information we collect

3.1 Information you provide (parents/guardians)

• Parent/guardian first name
• Email address
• Support/contact communications (if you email us)

3.2 Child profile information (provided by parent/guardian)

We collect child profile information only when a parent/guardian chooses to create or update a child profile, including:

• Child first name (text field)
• Child birthdate (used to derive an age range for personalization, e.g., "2-3 years old")
• Interests (short text fields; intended as simple terms like "trains")
• Developmental milestones (checkbox selections)

3.3 Generated content you save

Generated outputs (e.g., activities, stories, rhymes) that the Service creates and stores for you so you can revisit or sync them.

3.4 Device and service data

We collect information needed to operate the Service, such as:

• Device and app information (e.g., device type, OS version, app version)
• Operational logs (e.g., events needed to diagnose issues, prevent abuse, and keep the Service reliable)

We perform analytics and crash reporting using first-party tools and Apple platform APIs. We do not use third-party advertising or retargeting SDKs.

3.5 Payment information

If you purchase a subscription via Apple In-App Purchase, Apple processes the transaction. We do not receive your full payment card information. We may receive purchase-related information needed to provide access (e.g., subscription status and renewal dates as provided by Apple).

4) How we use information

We use information to:

Provide and operate the Service

• Create and manage accounts
• Create and manage child profiles
• Generate personalized content and features

Personalize outputs

• Use child profile attributes (age range, interests, milestones) to tailor activities, stories, and rhymes

Store and sync outputs

• Store generated outputs so you can access them later and sync across devices

Maintain safety, security, and reliability

• Monitor for abuse, protect infrastructure, and diagnose bugs
• Prevent fraud and enforce our Terms of Service

Communicate with you

• Send service-related messages (e.g., account confirmations)
• Send marketing emails if you opt in or where permitted by law (you can unsubscribe at any time)

Comply with legal obligations

• Respond to lawful requests and meet regulatory requirements

5) AI processing and third-party model providers

5.1 What we send to AI processing providers

To generate content, we may share limited context with third-party AI processing providers, such as:

• Child first name
• Child interests
• Age range derived from birthdate (e.g., "2-3 years old"); we do not send the birthdate itself
• Selected milestone categories
• The type of content requested (e.g., activity, story, or rhyme)

5.2 Training restrictions

We contractually require that third-party AI processing providers do not train their models on the data we send them for Puffling's requests.

5.3 Prompt storage

We do not store prompts in our systems. Operational logs may capture limited metadata (such as timestamps and request types) needed for reliability and abuse prevention, but not the full content of prompts.

5.4 Output storage

We store generated outputs so you can access them later and sync them to your account.

6) How we disclose information

We do not sell your personal information.

We may disclose information in the following circumstances:

6.1 Service providers and processors

We may share information with vendors that help us operate the Service (for example: hosting, infrastructure, email delivery, and AI processing providers). These vendors may process information only on our instructions and for the purposes described in this Privacy Policy.

6.2 Legal and safety

We may disclose information if we believe it is reasonably necessary to:

• Comply with law, regulation, legal process, or governmental request
• Protect the rights, property, or safety of Puffling, our users, children, or the public
• Investigate and prevent fraud or security issues

6.3 Business transfers

If Puffling is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

7) Data retention

We retain information for as long as your account is active or as needed to provide you the Service.

When you delete:

• A child profile: We delete the associated child profile information and related outputs tied to that profile.
• Your account: We delete your account information, child profiles, and stored outputs.

Inactive accounts: If your account has been inactive for three (3) years, we may delete it after providing notice to the email address on file.

Backups and logs: Residual copies may remain temporarily in backups or logs for security, integrity, or disaster recovery purposes. Such copies are typically deleted or overwritten within 90 days in accordance with our normal backup lifecycle.

8) Your choices and rights

8.1 In-app controls

You can:

• Edit or delete a child profile in the app
• Delete your account in the app (this permanently deletes your data)

8.2 Marketing emails

You can opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us at hello@puffling.ai. Even if you opt out, we may still send important service-related messages.

8.3 Rights by region (including GDPR/UK GDPR and CPRA)

Depending on where you live, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Request portability (a copy of your data in a commonly used, machine-readable format)
• Object to or request restriction of certain processing (GDPR/UK GDPR)
• Withdraw consent where we rely on consent (GDPR/UK GDPR)
• Request information about disclosures and processing (CPRA)

To exercise rights, email hello@puffling.ai. We may need to verify your identity and/or your authority as a parent/guardian before fulfilling a request.

8.4 California notice (CPRA)

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• We do not use or disclose "sensitive personal information" for purposes that require a "Limit the Use of Sensitive Personal Information" link under CPRA.

9) Children's privacy (COPPA)

9.1 We collect child information from parents/guardians

We do not knowingly collect personal information directly from children under 13. Child profile information is entered by a parent/guardian (or authorized caregiver). By creating a child profile, the parent/guardian represents that they have authority to provide this information.

9.2 Parental rights

A parent/guardian can:

• Review or change a child's profile information in-app
• Delete a child's profile in-app
• Delete the account in-app, which deletes associated child data

You can also contact us at hello@puffling.ai for assistance.

9.3 Data minimization and retention for children

We collect only what we need to provide personalization and store outputs for your use. We retain child profile information and outputs until you delete them (see Section 7).

10) International users and cross-border transfers

Puffling is based in the United States and may process information in the United States and other countries where our service providers operate.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate safeguards for international transfers where required, such as Standard Contractual Clauses or other lawful mechanisms.

11) Legal bases for processing (GDPR/UK GDPR)

Where GDPR/UK GDPR applies, we process personal data on one or more of the following legal bases:

• Performance of a contract: To provide the Service you request
• Legitimate interests: To secure, maintain, and improve the Service; prevent abuse; and provide support (balanced against your rights)
• Consent: For certain marketing communications where required
• Legal obligation: To comply with applicable laws

12) Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure. These measures include encryption of data in transit and at rest, access controls, and regular security reviews.

No security system is perfect, and we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

13) Cookies and similar technologies (website)

If you visit our website, we may use cookies or similar technologies necessary for site functionality and basic analytics. We do not use third-party advertising or retargeting cookies.

14) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the Effective Date above. Your continued use of the Service after an update means you accept the revised Policy.

15) Contact us

For questions, requests, or complaints about privacy, contact:

Puffling, Inc.
251 Little Falls Drive
Wilmington, Delaware 19808
hello@puffling.ai