Privacy policy

Stamped is a parental-control app for YouTube videos. A parent creates a family account, approves the YouTube channels each child may watch, and sets screen-time limits. This page explains what we collect, why, how long we keep it, and how to delete it.

Who runs this service

Stamped at this address is run by Roy. Contact: [email protected].

YouTube API Services

Stamped uses YouTube API Services to look up channels and videos and to play them. By using Stamped you also agree to be bound by the YouTube Terms of Service. Google's use of information is described in the Google Privacy Policy.

Videos play inside YouTube's own embedded player (served from youtube-nocookie.com). While a video plays, YouTube's own terms and privacy policy apply to what YouTube collects through that player; Stamped does not control it. Video titles and thumbnails are loaded from YouTube's servers (youtube.com, ytimg.com).

Stamped limits which YouTube videos are shown based on the choices the parent makes. These limits are set by the parent, not by YouTube.

What we collect

• Parent account: email address, name, and, if you sign up with email, a password hash. If you sign in with Google there is no password; see "Google sign-in" below.
• Family and PIN: family name, time zone, a hashed parent PIN, and when you accepted these terms.
• Kid profiles: a display name, an avatar colour, and optionally a birth year. We do not ask for a child's email, photo, location or any other identifier.
• Screen time: daily usage in seconds (counted in short ticks while a video plays), schedules, limits and any extra time you grant.
• Watch history: which approved videos a profile watched, when, and for how long, plus attempts to open videos that were not allowed.
• Devices: for each phone, tablet, computer or TV signed in to your family: a name (one you choose, or a default such as "iPhone" or "TV"), the kind of device, when it was last used, which kid used it last, which kids may watch on it, and any quiet hours or lock you set.
• Requests for more time: when a child taps "Ask for more time", the profile, the device it was asked on, when, and your answer (kept for up to 30 days).
• Notification settings: if you tap "Notify me when a kid asks", the push address your browser gives us for that device (a web address at your browser maker's push service, such as Google, Mozilla or Apple) and its encryption keys. We use it only to send you "name asks for more time". It is deleted when you turn notifications off, when the device is signed out, or when the push service says it no longer exists.
• Approved channels: the YouTube channels and videos you approve per profile, and a cached copy of public channel and video information (titles, thumbnails, durations) from YouTube.
• Server logs: technical request logs (time, page or API route, status, internal ids). We do not put names or email addresses in logs.

Google sign-in

If you choose "Continue with Google", Google shares your name, email address, profile picture and Google account ID with us (the basic openid, email and profile permissions). We use them only to sign you in. We do not ask for access to your YouTube account, contacts, files or any other Google data, and we never post anything to Google or YouTube for you.

You can remove Stamped's access to your Google account at any time at security.google.com/settings/security/permissions. Your Stamped account is not deleted by this. The next time you choose "Continue with Google", Google asks you to allow Stamped again. To remove your Stamped account and its data, delete it in Settings. If you ask us to, we delete the Google-linked data we hold (your Google account ID and sign-in tokens) within 7 days of your request.

Why we collect it

To run the service: sign you in, show each child the videos you approved, enforce the time limits you set, and show you what was watched. We also measure how the app is used and when it breaks, to fix bugs and improve it (see "Usage analytics and error reports"). We do not use the data for anything else.

Sharing and ads

We do not sell your data and we do not share it with third parties for their own purposes. Stamped shows no ads and contains no advertising code. The external services the app uses are YouTube/Google (to fetch video information and play videos, as described above), Google sign-in if you choose it, and PostHog for usage analytics and error reports (below). Data is stored on the server that hosts this Stamped instance.

Usage analytics and error reports

We use PostHog (PostHog Inc., servers in the United States) as a service provider, only to understand how Stamped is used and to find and fix errors. It is not used for ads, profiling, or anything that follows people to other sites, and PostHog may not use the data for its own purposes.

• What is sent: which screen was opened and which action was taken (for example "opened a video from the home feed", "approved a channel", "paused"), whether it worked, how long it took, error details with the code location, and the device type (web, app, TV) and browser.
• Who it is linked to: the parent account's random internal ID. A child is only ever a one-way scrambled code that cannot be turned back into the profile, so PostHog never knows which child it is.
• Never sent: names, email addresses, profile names, birth years, video or channel titles or IDs (so not what a child watched), search words, PINs, passwords or IP addresses. PostHog is set to discard IP addresses and we turn off its location lookup.
• On children's screens, the TV and the Android app no PostHog code runs. Those screens report to our own server, which checks every event against a fixed list and only then forwards it.
• On grown-up web pages (sign-in, sign-up, setup, the parent area) PostHog's script records which buttons are clicked, with all text on the page hidden from it, through our own server. It keeps a random ID in the browser's session storage (cleared when the tab closes), sets no cookies, and switches off if your browser sends Do Not Track or Global Privacy Control. There is no screen recording.
• PostHog keeps this data for up to 12 months. Deleting your account stops it; you can also ask us to delete it.

Notice to parents (COPPA)

This notice is for parents and guardians, as described in the US Children's Online Privacy Protection Act (COPPA). Children use Stamped only through a profile that a parent created, on a device the parent signed in.

Operator: Roy, contact [email protected].

What we collect from or about your child:

• the profile name you type, an avatar colour, and an optional birth year;
• watch history: which videos were watched, when and for how long;
• usage time, recorded in short ticks while a video plays, to enforce the daily limit;
• attempts to open a video that is not allowed (denied attempts);
• a cookie (stamped_profile) that remembers which profile is selected on the device.

Why: to show your child only what you approved, to enforce the schedule and time limits you set, and to show you what was watched. We do not use it for ads, profiling or anything else, and we do not sell it. Stamped has no ads.

Usage analytics: to keep the app working we record which kid screens and buttons are used (for example "video started", "search used", "lock screen shown") and any errors, and send them to our analytics provider PostHog without the child's name, profile ID, birth year, what was watched, search words or IP address. The child appears only as a scrambled code. No analytics code from PostHog runs on your child's screens. Details: Usage analytics and error reports.

YouTube and Google: videos play in YouTube's embedded player from youtube-nocookie.com, and thumbnails load from YouTube's servers. That means YouTube/Google receives the device's IP address and browser details, may set its own cookies or local storage, and may show its own ads in the player. YouTube's own policies apply to that: see the Google Privacy Policy and the YouTube Terms of Service. Stamped does not control what YouTube collects.

Your rights: you can review your child's watch history and blocked attempts in the parent area (Reports), change or delete a profile (Kids), and delete the whole account with all data (Settings, then Delete account). You can stop further collection at any time by deleting the profile. You can also email [email protected] to ask what we hold or to have it deleted.

How long we keep data

• Account, profile, screen-time and watch-history data: until you delete the profile or the account.
• Denied attempts (videos that were not allowed): 90 days.
• Cached YouTube channel and video information: refreshed or deleted within 30 days.
• Sign-in sessions: you stay signed in until you sign out; a device that is not used for 400 days is signed out.
• Device records: deleted when the device is signed out (by you, from Settings → Devices, or after 400 days without use).
• Requests for more time: 30 days. Notification push addresses: until you turn them off or the device is signed out.
• Server logs: 14 days.
• Usage analytics and error reports (PostHog): up to 12 months.
• After you delete the family account, remaining copies (such as backups) are removed within 7 days. A co-parent's own sign-in account is kept but loses access to the family.

Cookies and device storage

Stamped uses only cookies it needs to work. None are used for ads or analytics.

• Sign-in session (better-auth.session_token, with a __Secure- prefix on https): keeps you signed in; renewed while you use Stamped, removed after 400 days without use.
• stamped_profile: which kid profile is selected on this device.
• stamped_tz: your time zone, for 15 minutes while you sign in with Google.
• stamped_terms: that you ticked the terms box, for 15 minutes while you sign up with Google.
• stamped_device: a short-lived code while a TV or another device is being signed in.
• Google sign-in may set short-lived cookies of its own sign-in flow on our site while you sign in.
• On grown-up web pages only, PostHog keeps a random visitor and session ID in the browser's session storage (not a cookie), removed when the tab closes.
• The app also keeps small settings in the browser's local storage (TV mode, autoplay, recent searches per profile) and a temporary cache of the video list. They stay on the device.
• If you turn on notifications, a small service worker (/sw.js) is installed in that browser so it can show them. It stores nothing and does not load pages.
• YouTube's embedded player may set its own cookies or storage, as described above.

Deleting your data

A parent can delete a single kid profile (and its history) or the whole account in the parent area under Settings, then Delete account. Deleting the account erases the family, all profiles, approved channels, history and your login right away; any remaining copies, such as backups, are removed within 7 days. If another parent shares the family, deleting the family account removes all family and child data (profiles, schedules, history and approvals); the other parent's own sign-in account stays, but it no longer has access to the family. Cached public YouTube channel and video information is shared by all families, so it is not removed with your account; it is refreshed or deleted within the usual 30 days. You can also email [email protected] to ask for deletion or a copy of your data; we act on emailed requests within 7 days.

Contact

Questions or requests: [email protected].

Changes

When this policy or the Terms change in a meaningful way, we change the version at the top of this page and ask you to accept again in the parent area.