What you need to know
- Accounts belong to parents. Only adults aged 18+ who are a child's parent or guardian can create an account. Children have no accounts, profiles or logins.
- We collect nothing about your child as a person. No name, age, birthday, photo, voice or location.
- No ads, ever. There is no advertising on the website or in the app, and we never sell or share personal information for advertising.
- Analytics only with your permission. The website's story, player and library pages contain no analytics. In the app, usage analytics stays off until a parent allows it, and you can turn it off at any time. There are never advertising tools.
- You are in control. Delete your account yourself, at any time. Change your cookie or app analytics choice at any time.
Who we are and how to contact us
Cocoloops is a children's audiobook service at www.cocoloops.com and in the Cocoloops app. It is operated by Cocoloops, based in India("Cocoloops", "we", "us"). We decide how your personal information is used, so we are responsible for it (the "controller" or "data fiduciary").
Privacy questions and requests: support@cocoloops.com. We answer within 30 days.
Accounts are for parents and guardians
Cocoloops stories are made for children aged 2 to 12. To create an account you must confirm that you are 18 or older and the parent or legal guardian of the child who will listen. We record when you confirmed and which version of this policy you saw.
Your child listens through your account. Nothing in the website or the app lets a child type, record or upload information that is sent to us.
What we collect
| Information | Details | Source |
|---|---|---|
| Account details | Name, email address and password; or the name and email you share when you sign in with Google or Apple, plus your Google profile picture | You |
| Guardian confirmation | Date and time of your 18+ and guardian confirmation, and the policy version | You |
| Preferences | Story language, learning language, playback speed, theme | You |
| Listening activity | Which stories were played on your account, the position reached, and whether a story was finished | Use of the service |
| Bookmarks and reviews | Bookmarks you save; star ratings and review text you write, which other users can see | You |
| Subscription | Plan, status, dates, and reference numbers from Stripe, Google Play or the App Store. We never see your card number | Stripe, Google Play, Apple |
| App usage analytics | Screens opened, stories played, sign-ins and subscription events, linked to your account ID. Only if you allow it in the app | Your device |
| Devices | A label such as "Chrome on Windows" or a phone make and model, the platform, and when it was last used | Your device |
| Account emails | Your email address and one-time confirmation codes when you delete your account | You |
| Newsletter | Email address, date subscribed, and the consent wording you agreed to | You |
| Cookie choice | A random ID, your choice, the time and the banner version. No IP address | Your browser |
| Technical logs | IP address, browser type and the pages or files requested, in our hosting provider's server logs | Your device |
We also count how many times each story chapter is played and finished. These totals are not linked to any account or device.
What we never collect
- A child's name, age, date of birth, photo, voice or school
- Location, precise or approximate, beyond what an IP address in a server log reveals
- Microphone, camera or contacts access (the app does not ask for these permissions)
- The Android advertising ID, Apple's advertising identifier (IDFA) or any other advertising identifier
- Card numbers or bank details
If we ever wanted to collect new information about children, we would ask parents for consent first. We never contact a child directly.
Our website pages and the listening experience
Cocoloops has three parts, and we treat them differently.
- Information pages for parents (landing page, pricing, blog, About and our Privacy, Terms and Refund pages). With your permission, we use Google Analytics here to understand how parents find us.
- The listening experience on the website (home, browse, story and playlist pages, the player, the library, your profile and sign-in). Only the storage needed to run the service is used. There are no analytics, advertising or social media tools.
- The Cocoloops app. There are no advertising or social media tools. Usage analytics (Google Analytics for Firebase) is off until a signed-in parent taps Allow, and can be turned off at any time under Profile.
Identifiers we use
Some information recognises a browser, device or account over time. We use each identifier only to run the service, never for advertising or to track you across other websites or apps.
| Identifier | Why we use it | How we limit it |
|---|---|---|
Sign-in session (fb-session cookie, app sign-in token) | Keep you signed in | Expires after 5 days; removed when you sign out |
| Account ID (from Google Firebase Authentication) | Link your listening, bookmarks and subscription to your account | Never shared for advertising; deleted with your account |
Device ID (cl_device cookie, app device token) | Keep your subscription within its device limit | Used only for the device limit; deleted with your account |
| Billing references (Stripe customer ID, Google Play purchase token, App Store transaction ID) | Manage your subscription and payments | Shared only with the payment provider that issued them |
Cookie-choice ID (cl_consent) | Prove what you chose about cookies | Random; not linked to your account |
Google Analytics ID (_ga cookies) | Count visits to information pages | Only after Accept; never on listening pages; advertising features off |
| Firebase app instance ID and your account ID in app analytics | Understand how the app is used | Only after you allow it in the app; advertising features off; turn off under Profile |
How we use information, and our legal basis
| Purpose | Information | Legal basis (EU, UK, Switzerland) |
|---|---|---|
| Create and secure your account; sign you in | Account details, guardian confirmation, devices, technical logs | Contract |
| Play stories and resume where you stopped | Listening activity, preferences, bookmarks | Contract |
| Take payment and manage your subscription | Subscription | Contract; legal obligation for tax records |
| Keep your account within its device limit | Devices | Contract |
| Confirm account deletion | Account emails | Contract |
| Keep the service secure and prevent abuse | Technical logs | Legitimate interest |
| Send the newsletter | Newsletter | Consent |
| Count visits to information pages | Google Analytics data | Consent |
| Understand how the app is used so we can improve it | App usage analytics | Consent |
| Record your cookie choice | Cookie choice | Legal obligation |
We never use listening activity to profile a child, to recommend products, or for marketing.
International transfers
Cocoloops is based in India. Our website is hosted in the United States, and the providers listed above may process information in other countries. When information leaves the EEA, the UK or Switzerland for a country without an adequacy decision, we rely on safeguards such as Standard Contractual Clauses. You can ask us for a copy.
How long we keep information, and how deletion works
| Information | How long |
|---|---|
| Account, preferences, listening activity, bookmarks, reviews, devices | Until you delete your account |
| Sign-in session | 5 days |
| Subscription records | Until you delete your account. Stripe, Google Play and Apple keep their own payment records under their own policies |
| Account confirmation codes | Until they expire, within minutes |
| Newsletter address | Until you unsubscribe or delete your account |
| Cookie choice in your browser | 6 months, then we ask again |
| Record of your cookie choice | 5 years |
| Server logs | 30 days |
| Google Analytics data (website and app) | 2 months |
When you ask to delete your account, we lock it for 30days so you can change your mind by signing in. After that we erase your account and everything linked to it. Copies in our database provider's backups are overwritten as the backups rotate and are not used in the meantime.
Your choices and rights
- Delete your account: "Delete my account" on your profile (website or app), or www.cocoloops.com/delete-account. Cancel any active subscription first.
- Unsubscribe: use the link in any newsletter.
- Change your cookie choice: "Cookie settings" in the site menu or footer.
- See, correct or get a copy of your information: email support@cocoloops.com. We answer within 30 days.
- Withdraw consent at any time. This does not affect anything done before.
- Complain to us first if you like, or to the authority listed below.
Parents and guardians can use all of these rights for the account they hold.
Children's privacy
We do not knowingly collect personal information directly from children. If we learn that we did, for example in a review a child wrote, we delete it straight away. If you think this has happened, contact us.
We have a short privacy note for children to read together.
Security
Connections are encrypted. Passwords are handled by Google Firebase Authentication and we cannot read them. Access to our systems is limited to the people who need it. If a breach affects your information, we will tell you and the relevant authorities as the law requires.
Information for your country
European Union and United Kingdom.You have the rights to access, correct, delete, restrict, object to and port your information, and to withdraw consent. Where we rely on consent from a child under your country's age of digital consent (13 to 16), we ask the parent. In the UK we follow the Age Appropriate Design Code: settings that affect children are high-privacy by default.
Switzerland. We comply with the Federal Act on Data Protection. Your information may be processed in the countries described under International transfers. You can complain to the Federal Data Protection and Information Commissioner (FDPIC).
United States.Cocoloops is directed to children, so we follow the Children's Online Privacy Protection Act (COPPA). Accounts are held by parents, and any identifiers linked to a child's listening are used only to support our internal operations, as listed under Identifiers we use. Parents can review or delete this information, and stop its further use, by deleting the account or emailing us. Our retention periods are listed above. We do not sell or share personal information, and we honour Global Privacy Control signals.
India. We comply with the Digital Personal Data Protection Act, 2023 and its Rules. You can withdraw consent as easily as you gave it, ask for a summary of your data, correct or erase it, and nominate someone to act for you. Contact us first at support@cocoloops.com. If you are not satisfied, you can complain to the Data Protection Board of India. We do not track or monitor the behaviour of children, or target advertising at them.
Changes to this policy, and new owners
We post changes here and update the date at the top. For significant changes we tell account holders by email or in the service before they take effect, and ask for consent again where the law requires it.
If Cocoloops is sold or merged, personal information may pass to the new owner only if it keeps the promises in this policy. Otherwise we will ask for consent or delete it.
Contact
Cocoloops. Email: support@cocoloops.com.
Related policies
