Governing language. This is the English version of this Privacy Policy. The Spanish version, available at https://peekabookkids.com/politicadeprivacidad, is the official text. This English version is legally valid; however, in the event of any discrepancy in interpretation between the two, the Spanish version shall prevail.
New in version 3.3: an optional daily email. If you tick the corresponding box when registering, we will send you a daily email with parenting, education and children's sleep tips. It is optional, you can unsubscribe with one click from any email, and deleting your account also unsubscribes you. See Section 3.8.
You now need an account to use the app. Earlier versions of this Policy stated that the free content could be used without an account and anonymously. That is no longer the case: to access any content, including the free content, you must register with an email address or a Google account. We have corrected that description throughout this document because it was not accurate.
The account always belongs to an adult. Registration is preceded by a parental gate. Children cannot create accounts, even if they have their own email address.
You can delete your account yourself, from the app. We have added a deletion option inside the application and a web page you can use even after uninstalling it.
The app is now on Android. The Android version runs our web application inside a browser window, which changes the local storage mechanisms it uses.
Please read this Policy in full. If you are a parent or legal guardian, Section 4 explains precisely what we process and what we do not.
Owner and data controller: Carlos Alberto Duarte Ortega, an individual engaged in business activity.
Federal Taxpayer Registry (RFC): DUOC770203MN8
Domicile: Tecámac de Felipe Villanueva, State of Mexico, Mexico. The Controller's complete address, for purposes of notices, claims and the exercise of rights, is set out in Section 17 of this Policy.
General contact and data protection contact: contacto@peekabookkids.com
Tax invoice requests: factura@peekabookkids.com
Account deletion: from the application settings, or by writing to contacto@peekabookkids.com
Informational website: https://peekabookkids.com
Web Application and purchase site: https://app.peekabookkids.com/ — purchases are made at https://app.peekabookkids.com/pago
Application: Peek a Book Kids — White Noise (Stories and Meditations), available on the Apple App Store under identifier 6757008412, and on Google Play under package name com.peekabookkids.app.
This Policy describes how we handle the personal data of those who use the service in any of its forms: the iOS application, the Android application, the Web Application accessible through a browser, and the purchase site. It also covers the informational website peekabookkids.com.
We are committed to protecting the privacy of all users, with particular attention to children. This Policy has been prepared in accordance with:
Supervisory authority in Mexico. From March 21, 2025, supervision falls to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), acting through its decentralized body Transparencia para el Pueblo, replacing the former INAI.
Person responsible for compliance. We have designated a person responsible for handling data subject requests and overseeing compliance with this Policy, who may be contacted at contacto@peekabookkids.com.
Minimization. We collect only what is strictly necessary to identify you, give you access to the content and assist you. Nothing more.
Separation between adult and child. All identifiable data we process belongs to the responsible adult. We build no record associated with a child and ask a child for nothing.
No monetization of data. We do not sell, rent, transfer or exchange personal data. Our revenue comes exclusively from the sale of content.
No advertising and no tracking. The application displays no advertising, integrates no advertising networks, uses no device advertising identifiers and does not track users across applications or websites. Our only promotional communications are those the daily email may include, which you receive only if you opt in.
The application is downloaded free of charge from the Apple App Store and from Google Play, and may also be used in a browser at app.peekabookkids.com.
An account is required to reach the content, including the free content. Registration is free and requires no payment method. It is completed using an email address or by authenticating with a Google account. From that moment we process data that identifies the adult who holds the account.
The account serves three functions: identifying the responsible adult, allowing progress and preferences to be synchronized across devices, and enabling the paid content when it is purchased.
The registration flow is preceded by a parental gate: an action a young child cannot reasonably complete unaided. Its purpose is to ensure that an adult always creates the account. Children cannot register, even if they have their own email address.
Part of the content is identified within the application by a padlock icon. To access it, you must purchase it at app.peekabookkids.com/pago, using a browser. The application contains no purchase buttons, payment forms or charging mechanisms of any kind.
The Android application is a Trusted Web Activity: technically, our Web Application running inside a browser instance embedded in the app. We have blocked access to the payment route from within the Android application, so a purchase can only be completed by opening a browser separately.
Payment is processed by Stripe, an independent payment provider. We do not see, receive or store your card details. We receive only confirmation of the transaction, its identifier, the amount and the date.
Audio, video and the stories and books in PDF format are delivered from Cloudflare servers, which also host the Web Application. By reason of the technical nature of the Internet protocol, your device's IP address is transmitted to those servers in order to establish the connection: this is an unavoidable technical requirement of any data transmission, not a tracking mechanism.
The application includes a visible option to delete your account and the associated data, with no need to write to us: go to "Cuenta" (Account), solve the math problem of the parental gate and, in the Parents' Zone, tap "Eliminar cuenta" (Delete account). If you have already uninstalled the application, you can request deletion by writing to contacto@peekabookkids.com. Deletion is permanent: it is not a temporary deactivation. Deleting your account also unsubscribes you from the daily email.
We offer a free daily email with parenting, education and children's sleep tips, which may include information about our paid content.
Separately from the daily email, we send you service emails, which are not promotional and form part of providing the service: purchase confirmations, notices of an unprocessed payment, confirmation of account deletion and notices of changes to our legal documents.
The most important part of this Policy. Peek a Book Kids is designed for children to use, but it is contracted for, registered, paid for and administered by an adult. We do not request, receive or store personal data of children.
For the purposes of this Policy, the user is always the parent or legal guardian. Children cannot create accounts, cannot make purchases and do not provide personal data through the service. The child uses the application within a session opened by an adult, without identifying themselves or supplying any data.
Where several definitions apply, the most protective prevails.
By creating the account and permitting a child to use the service, the adult represents that they:
We apply the following reasonable mechanisms cumulatively:
We candidly acknowledge that no verification method is infallible. We apply reasonable efforts consistent with the guidance of the FTC, the UK Information Commissioner's Office and the European Data Protection Board.
If we become aware that an account was created by a child who circumvented the parental gate, we will delete it and erase the associated data within 7 business days, without using it for any purpose. If you are a parent or guardian and discover that your child created an account, write to contacto@peekabookkids.com and we will treat it as a priority.
The parent or guardian may withdraw consent at any time by deleting the account from the application or by writing to contacto@peekabookkids.com. Withdrawal takes effect prospectively and may make it impossible to continue providing the service.
From registration onward, and whether or not you purchase the paid content, we process:
This data is associated with your account, since one of its functions is to synchronize your progress across devices.
The content of the messages you send us by email when requesting support, a refund or the exercise of your rights.
Drawings or other materials generated within the application are stored exclusively on the device. They are not transmitted to our servers or to those of any third party, and are deleted when it is uninstalled.
We process no sensitive personal data of any kind. We neither collect nor process data revealing racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, trade union membership, sexual preference or biometric data, whether of the adult or of any child. Accordingly, we neither require nor obtain the express consent that the law requires for that category.
When you write to us, we process whatever you choose to include in your message. We ask you not to send us data unnecessary to handle your request, and in particular not to include your child's name, photographs or details. If we receive unnecessary data, we will delete it once the request has been handled.
Should we receive a child's personal data through any unforeseen route, we will delete it as soon as we become aware, without using it for any purpose and without retaining a copy, save for the minimum record of the fact where legally necessary.
Where this Policy refers to anonymized data, this means data processed such that it no longer permits any person to be identified, not even by us, and such that reversal is not reasonably possible. Anonymized and aggregate statistical data cease to be personal data and fall outside the scope of this Policy.
For our part, we do not use your personal data, your communications or your activity within the service to train, fine-tune or evaluate artificial intelligence models, and we do not transfer, sell or make them available to any third party for that purpose. This commitment concerns our own conduct; the processing each provider carries out under its own policies is addressed in Section 7.8.
Important. Because registration is mandatory, contact information and the user identifier are collected from all users, not only from those who purchase. The App Store privacy labels and the Google Play Data Safety form reflect that reality: they declare the email address and user identifier as data linked to identity, together with purchase history for those who acquire the paid content. Both listings also declare the existence of account and data deletion mechanisms.
Each purpose rests on a specific legal basis. In GDPR terminology:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and administering your account and authenticating you | Email address or Google identifier; credentials | Performance of contract — Art. 6(1)(b) GDPR |
| Giving you access to free content and syncing your progress | Account data, usage data, IP address | Performance of contract — Art. 6(1)(b) GDPR |
| Processing your purchase and enabling the content acquired | Entitlement status, transaction data | Performance of contract — Art. 6(1)(b) GDPR |
| Issuing tax receipts and keeping accounting records | Tax invoice and transaction data | Legal obligation — Art. 6(1)(c) GDPR |
| Handling support, refunds and rights requests | Email address and the content of your communications | Performance of contract and legal obligation |
| Sending you service emails: purchases, payments, account deletion and legal changes | Email address | Performance of contract — Art. 6(1)(b) GDPR |
| Sending you the daily email, only if you opted in | Email address; record of consent and unsubscription | Consent — Art. 6(1)(a) GDPR, withdrawable at any time |
| Preventing fraud and unauthorized access | Technical access logs and account data | Legitimate interest — Art. 6(1)(f) GDPR |
| Verifying that whoever registers is an adult | Parental gate result; the adult's representation | Legal obligation and parental consent — Art. 8 GDPR and COPPA |
| Improving the service through aggregate analysis | Anonymized usage data | Legitimate interest, subject to your right to object |
Where we rely on legitimate interest, we have assessed that the processing is necessary, proportionate and foreseeable, that it is confined to non-sensitive data and that it does not override your rights and freedoms. You may object by writing to contacto@peekabookkids.com.
Necessary purposes (without which we cannot provide the service): creating and administering your account and authenticating you; giving you access to the content; processing your purchase and enabling what you acquired; issuing tax receipts and keeping the records the law requires us to keep; handling your requests; and preventing fraud.
Optional purposes (which you may decline without affecting your access or the quality of the service): aggregate, anonymized analysis of usage for product improvement, and the daily email with parenting, education and children's sleep tips, which may include information about our paid content.
Your refusal of optional purposes will not be grounds for denying you the services or for conditioning them in any way.
We make the following mechanisms available to you, all free of charge:
We carry out no profiling and take no automated decisions producing legal effects or significantly affecting you. Validating your access is a technical check of whether your purchase is recorded as confirmed; it assesses, classifies and infers nothing about you.
The data disclosures described in Section 7 involve providers acting on our behalf and under our instructions, or respond to legal obligations; under Mexican law they do not constitute transfers requiring your separate consent. We do not transfer personal data to third parties for their own purposes.
We never sell, rent or commercialize personal data, and we do not share it for advertising purposes.
Function: distribution of the application through the App Store and Google Play, and hosting of its code on each platform's development infrastructure.
Data: Apple processes the data associated with your Apple Account, and Google the data associated with the account used to download the application from Google Play, each under its own policy. We receive only aggregate download statistics.
Important: neither Apple nor Google Play takes part in charging for the paid content, so neither receives nor processes any data relating to that transaction.
Location: United States of America.
Function: authenticating users and hosting the record that stores account data and the paid content entitlement status.
Data: email address or user identifier, encrypted credentials, entitlement status and technical access logs.
Google authentication: if you choose that option, Google additionally processes your own account data under its privacy policy. We receive only your identifier and the basic profile data needed to recognize you.
Location: United States of America and other regions of Google's infrastructure.
Function: processing payment on the purchase site.
Data: Stripe directly processes your payment instrument details, your email address and the transaction data. We neither receive nor store card numbers or banking credentials.
Nature: Stripe acts as a processor in respect of the charging we entrust to it, and as an independent controller in respect of its own fraud prevention and financial regulatory compliance purposes.
Safeguards: PCI-DSS compliance and standard contractual clauses for international transfers.
Location: United States of America and European Union.
Function: hosting the Web Application and the multimedia content (audio, video and PDF books), and delivering it by streaming.
Data: your device's IP address, transmitted by technical necessity of the Internet protocol in order to establish the connection, together with the logging data inherent to providing the service and protecting against attacks. Cloudflare does not receive from us your email address or your account identifier.
Location: globally distributed network; content is served from the nearest node.
Function: delivery of the daily email to those who opted in, and of service emails.
Data: your email address, your subscription status and the record of your consent and, where applicable, of your unsubscription. We share no other account data with this platform.
Nature: Resend acts as a processor in respect of the emails we entrust to it, under its data processing agreement.
Safeguards: certification under the EU-U.S. Data Privacy Framework and its United Kingdom extension.
Location: United States of America.
We may disclose data where there is a duly reasoned request from a competent authority, for compliance with tax or accounting obligations, for fraud prevention, or to protect the safety of a child. Unless legally prohibited, we will inform you of any such disclosure.
We may replace any of the listed providers for technical, economic or security reasons. Any incoming provider will be subject to equivalent obligations of confidentiality, security and purpose limitation. Where the substitution materially changes the categories of data processed, their location or the transfer safeguards, we will update this Policy and notify you in accordance with Section 16.
In the event of a merger, spin-off, acquisition or transfer of assets, data could be transferred to the acquirer, who would be bound to respect this Policy. We would notify you in advance and you could exercise your rights before the transfer takes effect.
We do not share personal data with our providers for advertising, profiling or commercialization purposes. The data we disclose to them is limited to what is strictly necessary for the function each performs under this Section.
Each provider additionally processes data under its own policies and terms of service, over which we exercise no control. We recommend consulting them: apple.com/legal/privacy, policies.google.com/privacy, stripe.com/privacy, cloudflare.com/privacypolicy and resend.com/legal/privacy-policy.
As the service is distributed worldwide and our providers operate infrastructure outside Mexico, your data may be processed in other countries, principally the United States of America.
For these transfers we rely on the following safeguards, as applicable to each provider and to your jurisdiction:
You may ask us for information on the safeguards applicable to a specific transfer by writing to contacto@peekabookkids.com.
| Category | Retention period | Reason |
|---|---|---|
| Account data and credentials | For as long as the account remains active | Provision of the service |
| Entitlement status | For as long as your right of access to the content subsists | Performance of contract |
| Usage and progress data | For as long as the account remains active | Synchronization across devices |
| Transaction and tax invoice records | 5 years from the transaction | Tax and accounting obligations (Mexico) |
| Technical access logs | Maximum 90 days, then deleted automatically | Security and diagnostics |
| Support communications | 2 years from closure of the request | Evidence of the assistance provided |
| Daily email subscription | Until you unsubscribe or delete your account | Sending the daily email |
| Content created on the device | Until you uninstall the application | Under your exclusive control |
If your account remains inactive for five consecutive years, we will send a notice to your registered email address. If ninety days pass from that notice without a response or recorded activity, we will delete the account data. We will never delete an active account without your request.
Data that Stripe, Google, Apple or Cloudflare retain on their own account is governed by their respective retention policies. We can instruct them to delete the data they process on our behalf, and we will do so upon your request.
If a security breach affecting your data occurs:
In all cases we will document the incident, its effects and the corrective measures taken.
As a data subject, or as a parent or guardian in respect of a child's data, you may exercise the following rights:
You can carry out erasure yourself from the Parents' Zone of the application or from the Web Application. If you have already uninstalled the application, you can request it by writing to contacto@peekabookkids.com. For the other rights, write to contacto@peekabookkids.com stating the right you wish to exercise.
Proportionate verification. We will request only the information necessary to confirm your identity. Where account ownership suffices to establish it, validation of the registered email address will be enough. We will require identity documents only where the nature of the request or the associated risk justifies it, and we will in no case retain them beyond the time needed for verification.
Exercising these rights is free of charge.
If we refuse your request, if you consider our response inadequate or if we fail to respond in time, you may apply to the competent supervisory authority. In Mexico, you have 15 days to bring proceedings before the Ministry of Anti-Corruption and Good Governance, through Transparencia para el Pueblo.
Our websites honor privacy preference signals sent by your browser, including those of the Global Privacy Control mechanism, where applicable law gives them effect. In any event, we neither sell nor share personal data for advertising purposes, so such signals do not alter our processing.
Rights of Access, Rectification, Cancellation and Opposition (ARCO), together with the right to withdraw your consent and to limit the use or disclosure of your data under Section 6.3.
Supervisory authority: the Ministry of Anti-Corruption and Good Governance, acting through its decentralized body Transparencia para el Pueblo, which assumed the powers of the former INAI as of March 21, 2025. Current channels are published on the Ministry's official portal at gob.mx.
All rights described in Section 11, together with the right to lodge a complaint with the supervisory authority of your country of residence. The directory is available at https://edpb.europa.eu.
Representative in the European Union. We have assessed whether a representative should be designated under Article 27 GDPR. That assessment is reviewed periodically in light of the volume and regularity of processing of data of individuals in the Union. Regardless of its outcome, we handle any request directly at contacto@peekabookkids.com, in Spanish or English.
Rights equivalent to those under the GDPR. Authority: the Information Commissioner's Office, www.ico.org.uk.
A parent or guardian has the right to review the information associated with their account, to request its deletion and to refuse any further collection. Authority: the Federal Trade Commission, www.ftc.gov, 1-877-FTC-HELP.
Rights to know, delete, correct and limit the use of sensitive information. We do not sell or share personal information within the meaning those laws give to those terms, so there is no opt-out mechanism to exercise. We do not discriminate against those who exercise their rights.
A number of states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, have comprehensive consumer privacy legislation. We recognize the rights that legislation grants you, including access, correction, deletion, portability and opt-out of targeted advertising, sale of data and profiling. As we engage in none of those three activities, the corresponding opt-out rights have no object in our case.
Office of the Privacy Commissioner of Canada, www.priv.gc.ca.
Autoridade Nacional de Proteção de Dados, www.gov.br/anpd.
If your country has personal data protection legislation, we will respect the rights that legislation affords you.
The iOS application is a native application and uses no browser cookies. It employs the operating system's local storage mechanisms, such as UserDefaults, to retain your settings and language preferences, playback progress and signed-in session state.
The Android application is a Trusted Web Activity: technically, our Web Application running inside a Google Chrome instance embedded in the app. For that reason, both the Android version and browser access use the browser's own storage mechanisms — local storage, IndexedDB and strictly necessary session and authentication cookies — for the same purposes: settings and language preferences, playback progress and maintaining your signed-in session. No advertising, tracking or third-party cookies are used.
The purchase site uses cookies strictly necessary for the registration and payment process to function, together with those Stripe requires for fraud prevention. Should analytics cookies or cookies serving any other non-strictly-necessary purpose be used, your prior consent will be sought through the appropriate mechanism.
The best interests of the child, enhanced protection, effective parental supervision, and design oriented toward calm rather than attention capture.
The application does not direct children outside its environment. Elements intended for the adult — registration, sign-in, account management and deletion, and any external link — sit behind a parental gate. In the Android version, the payment route is additionally blocked from within the application.
We integrate no third-party analytics tools for advertising purposes, use no device advertising identifiers and transmit no identifier for tracking purposes. The providers listed in Section 7 are involved solely in the service infrastructure.
We adopt the principles of the UK Information Commissioner's Office Age Appropriate Design Code. Specifically:
Transparency about the account requirement. The Age Appropriate Design Code recommends not requiring more data than is necessary to access a service directed to children. We are aware that mandatory registration departs from the minimum-collection configuration. We maintain it because it performs functions we could not otherwise provide — linking the acquired access to the person rather than the device, and allowing synchronization across devices — and we offset it by limiting registration to a single email address, placing it behind a parental gate and offering immediate deletion from within the application itself.
Our model rests on a deliberate design decision: the child is never an account holder and never the subject of identifiable processing. The only person identified in our systems is the adult who registers, after passing a parental gate. Any question on this point may be directed to contacto@peekabookkids.com.
Two routes: (i) from the Parents' Zone of the application — "Cuenta" (Account) section, after the parental gate, "Eliminar cuenta" (Delete account) link — on iOS and Android, and from the Web Application at app.peekabookkids.com; or (ii) by writing to us at contacto@peekabookkids.com, especially if you have already uninstalled the application.
Minor changes. Publication of the updated version with a new effective date at https://peekabookkids.com/politicadeprivacidad.
Material changes. These are changes affecting the categories of data processed, the purposes, the providers, international transfers or your rights. In such cases:
Version control. We will keep earlier versions of this Policy available, stating the period during which each was in force.
Data protection, rights and complaints: contacto@peekabookkids.com
Account deletion: from the application settings, or by writing to contacto@peekabookkids.com
Tax receipts: factura@peekabookkids.com
Controller's address and postal correspondence: Carlos Alberto Duarte Ortega, Bosque de Cedros, Manzana 46 Lote 1, Col. Los Héroes de Tecámac Sección Bosques, C.P. 55764, Tecámac de Felipe Villanueva, State of Mexico, Mexico. This is the Controller's address for all legal purposes, including the exercise of rights, notices and claims.
Languages: Spanish and English.
External references on privacy and digital parenting:
By creating an account and using Peek a Book Kids, the parent or legal guardian represents that they: