Privacy policy

PureView is a video app for parents. It plays YouTube videos, but only from channels our curators picked, and a parent decides what shows on each device. Children may watch it on a device a parent hands them, so this policy covers them too. Akiva Ackerman, a sole proprietor trading as ASH-ai, runs it. This page says what the app sends, what we keep and for how long, who else handles it, and what you can do about it.

The short version

• Children watch without signing up. The app never asks a child for a name, email, photo, voice or location, and we keep no profile of any child on our servers.
• While a child watches, the app still sends us some things: a short play log for each video (with no device ID or login), search words (used for that one search, not stored), and, like every internet service, the device's network address. Details are below.
• Without a parent login there are no filters: a child can see every video in the app. Signing out, or deleting the login, turns the filters and the PIN off on that device.
• A parent login is optional. It is needed only for filters, the PIN, premium, Request a channel and Send feedback. With one, we keep the parent's email address, the password as a one-way hash, and sign-in records.
• Premium is an optional subscription a parent can buy in the app. Apple or Google takes the payment, and we never see your card. RevenueCat checks the purchase for us with your login's account ID, not your email.
• Follows, likes, watch history, which channels a child watches most, the age setting, the content groups and the parent PIN stay on the device.
• No ads from us. No tracking or analytics companies. We never sell or rent anything about anyone.
• Videos and their pictures load straight from YouTube (Google) on the device, so YouTube receives data from that device under its own rules, and may show its own ads.

Without a login

This is how the app starts. A child can watch every approved video. The app does not ask anyone for a name, email, photo, location or anything else, and it sends no device ID. It sends us:

• Requests for the video list. The app asks our server and our database for the list of approved videos and channels. These requests carry no identifier.
• A play log. When a video plays, fails or ends, the app sends the video's ID, which of those happened and an error code. When a video plays again on the same device, it also sends "replayed" for that video. When a child taps the heart on a video, it sends "liked" for that video (nothing is sent when the heart is turned off, and nothing goes to YouTube). When YouTube says a video's owner doesn't allow it to play in other apps, it also sends "unplayable" for that video. We store that with the day only. No device ID, no login, no network address, no time of day. Each row also gets a running number from the database. It isn't a time, but it does show the order the rows came in on that day. We use it to hide videos that keep failing or can't play in the app and, as daily totals, to rank the videos children watch, finish and like.
• A check before each video plays. The app asks our database whether that video is still approved. The request carries only the video's ID, no identifier. Our database provider, Supabase, sees the network address it comes from, as with any request.
• Search. What you type in search is sent to our server only to find matching videos. We don't store it. It goes in the body of the request, never in a web address, and our server doesn't log it. The search covers only the approved videos and channels, never all of YouTube, and nothing is sent to YouTube. The last 10 searches are kept on the device so a child can tap one again; a parent can clear them in Parent settings.
• An update check. On launch the app asks whether a newer version of its screens exists. It sends the platform (Android or iOS) and the app's version numbers. Nothing else.

Network addresses. Like every internet service, our servers see the network (IP) address a request comes from, including requests from a child's device. We don't store the address in our database. To stop floods of requests we turn it into a keyed hash (a scrambled code that can't be turned back into the address without our secret key) and count requests per code. A hash is not anonymous: while it exists it still stands for that network, so we treat it as personal information. Those codes are deleted when their time window ends (10 minutes to 7 days), at the latest by the next daily clean-up. Our hosting providers also keep short logs of requests for security and running the service: on our current plans, Vercel keeps them for about a day and Supabase for up to a day. These logs can include the network address and the type of device or browser. We read them only to fix problems.

With a parent login

A parent login is for adults. You make it in the app (Parent settings) with your email address and a password, and confirm it with a 6-digit code we email you. Then you choose a PIN for that device. A login turns on the filters (the age setting and the content groups), the PIN, Request a channel and Send feedback. The filters and the PIN are kept on the device, not with us. With a login we keep:

• your email address;
• your password, only as a one-way hash (a scrambled form that can't be turned back into the password), held by our sign-in provider, Supabase. We never see or store the password itself;
• when the login was made, when it was confirmed and when it last signed in, and an account ID for the login;
• while you stay signed in, the network address and device type of each phone or tablet you signed in on, kept with that session until you sign out;
• our sign-in provider's security log of sign-ins, which includes your email and network addresses. We have switched off copying it into our database; Supabase keeps it in its own logs for a short time (1 hour on our current plan);
• premium: whether it is on and when it ends, whether we switched it on or you bought it in the app, and, if you bought it, the plan (monthly or yearly), the store (App Store or Google Play) and when the store last told us about it.

Nothing about your child on the login. A login holds no child's name, age, picture, profile, rules, watch time or history. The same is true of premium.

To keep you signed in, the app keeps the login's email address and its sign-in keys on the device. They go only to our sign-in provider, and to our own server when you request a channel, send feedback, buy or restore premium, or delete the login. Our server only checks that the login is real; it doesn't store the keys or the login with a request or a message. When the app opens (at most every 12 hours) it asks our database whether the login still exists and has premium, and asks for the current time, so time-based settings can't be fooled by changing the device's clock.

Signing out turns the filters off. If you sign out, or our sign-in provider says the login no longer exists (for example after you delete it on another device or on our web page), the filters and the PIN on that device turn off and your child can see everything in the app. The app warns you before you sign out or delete the login. Being offline does not turn them off.

Buying premium

Premium is an optional subscription a parent can buy inside the app, behind the parent PIN. It is never offered on a child's screens. Apple (App Store) or Google (Google Play) takes the payment under its own terms; we never see or store your card or payment details. We use RevenueCat to check purchases with Apple and Google: the app gives RevenueCat your login's account ID (not your email) and the store's purchase record, and RevenueCat tells our server which plan is active and when it ends. RevenueCat handles that under its privacy policy. We don't use RevenueCat's advertising or attribution features, and we send it nothing about your child. RevenueCat, Apple and Google keep their own records of the purchase; deleting your login doesn't delete those. We may also switch premium on for a login by hand, free of charge.

On the device only

These live in the app's storage on the device, with or without a login. We never receive them. Uninstalling the app or clearing its data removes them from the device:

• follows, the videos a child liked, watch history and which channels a child watches most (likes and follows help the app suggest more like them);
• the last 10 searches (each child's own with premium profiles);
• with a login: the "show up to age X" setting, the content groups a parent picks (Kids, Teens, Jewish, Sports), and the parent PIN (stored as a salted hash, never the PIN itself) with its count of wrong tries;
• with premium: kid profiles, each child's rules (such as hidden channels, Block Shorts and time limits) and daily watch time.

So the content groups and the parent PIN stay on the device, and so does everything a parent sets up for a child.

If the phone or tablet backs itself up (Google backup on Android, iCloud on iPhone and iPad), that backup can include this app's storage and put it back on a new or reset device. The backup belongs to you and is kept by Google or Apple; we can't see it.

The web preview (pureview-app.vercel.app) is the same app in a browser. It keeps the same on-device data in that browser's local storage instead of the app's, and clearing the site's data removes it. Our host, Vercel, sees standard request data (network address and browser type) to serve its pages.

Request a channel and Send feedback (signed-in parents)

A signed-in parent can ask us to add a YouTube channel. We receive the channel link and, only if you type it, your email address. We check that the request comes from a signed-in parent, but we don't record which login sent it. We use the email once, to tell you the channel was added, and then delete it. If the request is dismissed, or 90 days pass, we delete it without writing. The address is stored apart from the request count, and never appears in our admin log or our daily email.

A signed-in parent can also send us a short message. We receive the message, the app's version and, only if you type it, your email address. We don't record which login sent it. We use the email only to reply. It is deleted when we reply, when we close the message without replying, or after 90 days, whichever comes first. The message is deleted 30 days after we close it; until a curator closes it, it stays. Our reply email quotes your message, and our email provider, Resend, keeps a copy of emails it sends under its own policy. Please don't put your child's name or other personal details in it.

Bot check

To stop automated abuse, the parent login screens, Request a channel and Send feedback (and our sign-in and delete-login web pages) may show a quick "are you a person" check from Cloudflare Turnstile. It runs in a small frame from our website and looks at signals from the browser to tell people from bots. Cloudflare handles that data under its privacy policy. It is never shown on a child's screens. When our server checks the answer, it sends Cloudflare only that one-time answer, not your network address. For sign-in our sign-in provider (Supabase) does the check and may include your network address. We don't keep the answer.

YouTube

PureView uses YouTube API Services to show videos. By using PureView you agree to the YouTube Terms of Service. Videos play in YouTube's embedded player, loaded from YouTube's standard address (www.youtube.com), which connects straight from the device to YouTube. Video and channel pictures also load straight from YouTube's image servers. We don't send YouTube anything ourselves, but because the player and the pictures run on the device, including a child's device, YouTube receives what any visit to YouTube sends: the network address, device and browser details, which video is played and how, and any cookies YouTube sets in its player. YouTube may show its own ads. YouTube says that for videos marked "made for kids" it limits what it collects and doesn't show personalized ads. Most videos in the app are not marked that way, and they play under YouTube's normal rules, which can include personalized ads. We have a switch that would show only made-for-kids videos; it is off today. We add no tracking of our own to any video. Google's use of that data is covered by the Google Privacy Policy. Nothing in PureView signs in to YouTube, subscribes, likes or comments.

From YouTube we store channel and video information (titles, pictures, lengths, whether a video is made for kids). We refresh it at least every 30 days or delete it.

Who else handles data

These service providers handle data for us to run PureView. Each also has its own privacy policy that says how it handles data and how long it keeps its own logs:

• Supabase: our database and parent sign-in, including the password hash (privacy);
• Vercel: hosts our website and server code (privacy);
• Resend: sends our emails (sign-in and password-reset codes, "it's added", replies to feedback) (privacy);
• Cloudflare Turnstile: the bot check above;
• RevenueCat: checks premium purchases with Apple and Google (privacy);
• Anthropic (Claude): suggests groups and a Home shelf for a newly added channel from its public YouTube titles and description; nothing about you or your child is sent.

These companies handle data under their own policies, not on our behalf:

• Google / YouTube: the video player and pictures, as described above;
• Google Play and the Apple App Store: they deliver the app and take subscription payments.

We don't share personal information with anyone else, unless the law makes us (for example, a court order) or to protect someone's safety.

Children's privacy (COPPA)

PureView is an app for parents, and children may watch it, so we follow the U.S. Children's Online Privacy Protection Act. This is what that means here:

• The app never asks a child for personal information, and nothing in it lets a child post or share anything. Request a channel and Send feedback are behind the parent login.
• From a child's device we receive the device's network address with each request. We use it only to run the service: to send the videos and the video list, to keep the service secure and to stop floods of requests. We don't store the address in our database (one exception: if a parent signs in on that device, our sign-in provider keeps the address with the parent's session, as described above). For rate limits we keep only a keyed hash, for 10 minutes to 7 days. We never use the address to contact anyone, to build a profile of anyone or for ads.
• We also receive the play log and search words described above. They aren't linked to a device ID, a login or the network address, and search words are not stored.
• YouTube's player and pictures collect data from the device directly, under Google's policies, as described in the YouTube section.
• A parent login holds only the parent's own details. Everything a parent sets up for a child stays on the device.

As a parent you can, at any time:

• change or remove any setting on the device in Parent settings;
• delete your login in the app (Parent settings, then Delete login, then your PIN) or on our delete-login page; that happens straight away;
• ask us by email, mail or phone to show you, or delete, what we hold about you or your child. We reply within 7 days. If you ask us to delete something, we do it once we have checked the request comes from you, and tell you when it is done.

Deleting a login removes the email address, the password hash, the sign-in records, the sessions and any premium straight away. If premium was ever given by hand or the login was let in early to buy it, our admin log keeps a line saying so, with the account ID and usually your address shortened. Devices signed in with that login turn their filters off.

Deleting a login does not cancel a premium subscription bought in the app: cancel it in your App Store or Google Play account settings (in the app: Parent settings, then Manage subscription).

How long we keep things

This is our written data-retention policy. We keep information only as long as the reason for it lasts.

A daily job deletes expired information automatically. Our providers' own backups and logs follow their own schedules, so a deleted item can stay in them for a short time after it is gone from our database.

Keeping it safe

Everything travels encrypted (HTTPS). Passwords are held only as one-way hashes by our sign-in provider. Database rules let a signed-in parent read only their own login's details. Only the owner and invited curators can reach the admin, and only the owner can see the list of parent logins. No system is perfectly secure. If we learn that personal information we hold was accessed without permission, we will tell the parents affected, and the authorities where the law requires it, as quickly as the law requires.

Changes

If we change this policy, we'll update the date at the top. If a change means collecting new information from or about children, we will ask parents first where the law requires it.

Contact

Akiva Ackerman, a sole proprietor trading as ASH-ai
Email: akiva@ash-ai.app
Phone: (917) 924-0018
Postal address: 136 Donahue Avenue, Inwood, NY 11096
Website: www.ash-ai.app

The phone number is here because the children's privacy rule asks this notice to list one. Email is the quickest way to reach us.