Governing language. This is the English version of this Privacy Policy. The Spanish version, available at https://peekabookkids.com/politicadeprivacidad, is the official text. This English version is legally valid; however, in the event of any discrepancy in interpretation between the two, the Spanish version shall prevail.
The Application has moved from being sold as a paid app on the App Store to being offered as a free download, with certain content acquired separately on our website. This change materially alters how we handle data:
There is now a user account. Anyone acquiring the paid content creates an account using their email address or Google account. This means that, unlike in previous versions, we do process data that identifies the responsible adult.
We process the payment now, not Apple. Payment is made on our website through Stripe. Apple no longer takes part in the transaction.
The adult's account data is NOT a child's data. We still do not collect any child's name, voice, image, location or contact details.
Please read this Policy in full before creating an account. If you are a parent or legal guardian, Section 4 explains precisely what we process and what we do not.
Owner and data controller: Carlos Alberto Duarte Ortega, an individual engaged in business activity.
Federal Taxpayer Registry (RFC): DUOC770203MN8
Address: Bosque de Cedros, Manzana 46 Lote 1, Col. Los Héroes de Tecámac Sección Bosques, C.P. 55764, Tecámac de Felipe Villanueva, State of Mexico, Mexico.
General contact and data protection contact: contacto@peekabookkids.com
Tax invoice requests: factura@peekabookkids.com
Website: https://peekabookkids.com
Purchase site: https://app.peekabookkids.com/
Application: Peek a Book Kids — White Noise (Stories and Meditations), available on the Apple App Store worldwide under identifier 6757008412, and on Google Play under the package name com.peekabookkids.app.
This Policy describes how we handle the personal data of those who use the Application and of those who purchase the paid content through our website. It applies both to the Application and to the Purchase Site.
We are committed to protecting the privacy of all users, with particular attention to children. This Policy has been prepared in accordance with:
Supervisory authority in Mexico. From March 21, 2025, supervision of personal data protection in the private sector falls to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), acting through its decentralized body Transparencia para el Pueblo, replacing the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
Person responsible for compliance. As required by the LFPDPPP, we have designated a person responsible for handling data subject requests and overseeing compliance with this Policy, who may be contacted at contacto@peekabookkids.com.
Minimization. We collect only what is strictly necessary for the Application to work and for you to access what you purchased. Nothing more.
Separation between adult and child. All identifiable data we process belongs to the responsible adult. We build no record associated with a child.
No monetization of data. We do not sell, rent, transfer or exchange personal data. Our revenue comes exclusively from the sale of content.
No advertising and no tracking. The Application displays no advertising, integrates no advertising networks and does not track users across applications or websites.
The Application is downloaded free of charge from the Apple App Store and from Google Play. Part of the content is immediately available, with no need to create an account or identify yourself. If you use the Application in this way only, we process no data that identifies you.
The remaining content is identified within the Application by a padlock icon. To access it, you must purchase it on our Purchase Site, which is a website separate from the Application. The Application contains no purchase buttons, payment forms or charging mechanisms of any kind.
On the Purchase Site you create an account using your email address or by authenticating with your Google account. That account belongs to the adult making the purchase. You then sign in within the Application using those same credentials and the content is unlocked.
Access is linked to your account, not to a device. To validate it, the Application checks a record containing your email address or identifier and whether your purchase was confirmed.
Payment is processed by Stripe, an independent payment provider. We do not see, receive or store your card details. We receive only confirmation of the transaction, its identifier, the amount and the date.
Audio, video and stories and books in PDF format are streamed and distributed from Cloudflare servers. By reason of the technical nature of the Internet protocol, your device's IP address is transmitted to those servers in order to establish the connection: this is an unavoidable technical requirement of any data transmission, not a tracking mechanism.
Sign-in and account management options sit behind a parental gate, that is, an action a young child cannot reasonably complete unaided. Its purpose is to ensure that an adult always performs these operations.
The most important part of this Policy. Peek a Book Kids is designed for children to use, but it is contracted for, paid for and administered by an adult. We do not request, receive or store personal data of children.
For the purposes of this Policy, the user is always the parent or legal guardian. Children may not create accounts, may not make purchases and do not provide personal data through the Application.
Where several definitions apply, the most protective prevails.
By downloading the Application, creating an account or permitting its use by a child, the adult represents that they:
We apply the following reasonable mechanisms cumulatively:
We candidly acknowledge that no verification method is infallible. We apply reasonable efforts consistent with the guidance of the FTC, the UK Information Commissioner's Office and the European Data Protection Board.
The parent or guardian may withdraw consent at any time by writing to contacto@peekabookkids.com. Withdrawal takes effect prospectively and may make it impossible to continue providing the service.
We process no data that identifies you. Only technical and usage data is generated, on an anonymized basis:
In addition to the above, we process the following data, all of it belonging to the responsible adult:
Drawings or other materials generated within the Application are stored exclusively on the device. They are not transmitted to our servers or to those of any third party, and are deleted when the Application is uninstalled.
We process no sensitive personal data of any kind. That is, we neither collect nor process data revealing racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, trade union membership, sexual preference or biometric data, whether of the adult or of any child. Accordingly, we neither require nor obtain the express consent that the law requires for that category.
When you write to us, we process whatever you choose to include in your message. We ask you not to send us data that is unnecessary to handle your request, and in particular not to include your child's name, photographs or details. If we receive unnecessary data, we will delete it once the request has been handled.
Should we receive a child's personal data through any unforeseen route — for example, included in a support email — we will delete it as soon as we become aware, without using it for any purpose and without retaining a copy, save for the minimum record of the fact where legally necessary. If you notice that this has occurred, please write to contacto@peekabookkids.com and we will treat it as a priority.
Where this Policy refers to anonymized data, this means data processed such that it no longer permits any person to be identified, not even by us, and such that reversal is not reasonably possible. Anonymized data and aggregate statistical data cease to be personal data and fall outside the scope of this Policy.
For our part, we do not use your personal data, your communications or your activity within the Application to train, fine-tune or evaluate artificial intelligence models, and we do not transfer, sell or make them available to any third party for that purpose. This commitment concerns our own conduct; the processing each provider carries out under its own policies is addressed in Section 7.8.
The privacy labels published on the Application's App Store listing, and the declarations in the Data safety form published on its Google Play listing, reflect the data categories described in this Section. From this version, those labels and declarations include the contact information and user identifier associated with the adult's account, together with purchase history, as data linked to identity. Technical and usage data continue to be classified as not linked to identity.
Each purpose rests on a specific legal basis. In GDPR terminology:
| Purpose | Data used | Legal basis |
|---|---|---|
| Enabling use of the Application and playback of free content | Anonymized technical and usage data; IP address for the connection | Legitimate interest — Art. 6(1)(f) GDPR |
| Creating and administering your account | Email address or Google identifier | Performance of contract — Art. 6(1)(b) GDPR |
| Processing your purchase and enabling the content acquired | Purchase status, transaction data | Performance of contract — Art. 6(1)(b) GDPR |
| Issuing tax receipts and keeping accounting records | Tax invoice and transaction data | Legal obligation — Art. 6(1)(c) GDPR |
| Handling support, refunds and rights requests | Email address and the content of your communications | Performance of contract and legal obligation |
| Preventing fraud and protecting service integrity | Account data and technical access logs | Legitimate interest — Art. 6(1)(f) GDPR |
| Enabling supervised use by a child | None from the child; the adult's representation | Parental consent — Art. 8 GDPR and COPPA |
| Improving the Application through aggregate analysis | Anonymized usage data | Legitimate interest, subject to your right to object |
Where we rely on legitimate interest, we have assessed that the processing is necessary, proportionate and foreseeable, that it is confined to non-sensitive data and that it does not override your rights and freedoms. You may object to this processing by writing to contacto@peekabookkids.com.
As required by Mexican law, we distinguish between the purposes that give rise to and are necessary for our relationship with you, and those that are not:
Necessary purposes (without which we cannot provide the service): operating the Application and playing the content; creating and administering your account; processing your purchase and enabling the content acquired; issuing tax receipts and keeping the records the law requires us to keep; handling your support, refund and rights requests; and preventing fraud.
Optional purposes (which you may decline without affecting your access or the quality of the service): aggregate, anonymized analysis of usage for product improvement, and the sending of informational communications about new content, should we ever enable them.
Your refusal of optional purposes will not be grounds for denying you the services or for conditioning them in any way.
We make the following mechanisms available to you, all free of charge:
We carry out no profiling and take no automated decisions producing legal effects or significantly affecting you. Validating your access is a technical check of whether your purchase is recorded as confirmed; it assesses, classifies and infers nothing about you.
The data disclosures described in Section 7 involve providers acting on our behalf and under our instructions, or respond to legal obligations; under Mexican law they do not constitute transfers requiring your separate consent. We do not transfer personal data to third parties for their own purposes. Should we intend to do so in the future, we would inform you beforehand and you could object, without this affecting the service.
We never sell, rent or commercialize personal data, and we do not share it for advertising purposes.
We rely on the following providers, each with a defined function and each subject to contractual confidentiality and security obligations:
Function: distribution of the Application through the App Store and through Google Play, and hosting of its code on each platform's development infrastructure.
Data: Apple processes the data associated with your Apple Account, and Google processes the data associated with the Google account you used to download the Application from Google Play, each under its own policy. We receive only aggregate download statistics from each store.
Important: neither Apple nor Google Play takes part in charging for the paid content, and therefore neither receives nor processes any data relating to that transaction.
Location: United States of America.
Function: processing payment on the Purchase Site.
Data: Stripe directly processes your payment instrument details, your email address and the transaction data. We neither receive nor store card numbers or banking credentials.
Nature: Stripe acts as a processor in respect of the charging we entrust to it, and as an independent controller in respect of its own fraud prevention and financial regulatory compliance purposes, under its privacy policy available at stripe.com/privacy.
Safeguards: PCI-DSS compliance and standard contractual clauses for international transfers.
Location: United States of America and European Union.
Function: hosting the record storing your account data and purchase status, for the sole purpose of validating your access to the content acquired.
Data: email address or user identifier, and entitlement status.
Google authentication: if you choose this option, Google additionally processes your own account data under its privacy policy. We receive only your identifier and the basic profile data needed to recognize you.
Location: United States of America and other regions of Google's infrastructure.
Function: hosting and streaming the Application's audio, video, and stories and books in PDF format.
Data: your device's IP address, transmitted by technical necessity of the Internet protocol in order to establish the connection, together with the logging data inherent to providing the service and protecting against attacks. Cloudflare does not receive from us your email address, your account identifier or any other personal data.
Location: globally distributed network; content is served from the nearest node.
Section reserved for future use; no content currently in effect.
We may disclose data where there is a duly reasoned request from a competent authority, for compliance with tax or accounting obligations, for fraud prevention, or to protect the safety of a child. Unless legally prohibited, we will inform you of any such disclosure.
We may replace any of the listed providers for technical, economic or security reasons. Any incoming provider will be subject to equivalent obligations of confidentiality, security and purpose limitation. Where the substitution materially changes the categories of data processed, their location or the transfer safeguards, we will update this Policy and notify you in accordance with Section 16.
We do not share personal data with our providers for advertising, profiling or commercialization purposes. The data we disclose to them is limited to what is strictly necessary for the function each performs under this Section, and our instructions are confined to that purpose.
Each provider additionally processes data under its own policies and terms of service, over which we exercise no control. We recommend consulting them if you wish to understand the full scope of their processing: apple.com/legal/privacy, stripe.com/privacy, policies.google.com/privacy and cloudflare.com/privacypolicy.
In the event of a merger, spin-off, acquisition or transfer of assets, data could be transferred to the acquirer, who would be bound to respect this Policy. We would notify you in advance and you could exercise your rights before the transfer takes effect.
As the Application is distributed worldwide and our providers operate infrastructure outside Mexico, your data may be processed in other countries, principally the United States of America.
For these transfers we rely on the following safeguards, as applicable to each provider and to your jurisdiction:
You may ask us for information on the safeguards applicable to a specific transfer by writing to contacto@peekabookkids.com.
| Category | Retention period | Reason |
|---|---|---|
| Account data | For as long as the account remains active | Provision of the service |
| Purchase status | For as long as your right of access to the content subsists | Performance of contract |
| Transaction records and tax invoice data | 5 years from the transaction | Tax and accounting obligations (Mexico) |
| Technical access logs | Maximum 90 days, then deleted automatically | Security and diagnostics |
| Support communications | 2 years from closure of the request | Evidence of the assistance provided |
| Content created on the device | Until you uninstall the Application | Under your exclusive control |
If your account remains inactive for five consecutive years, we will send a notice to your registered email address. If ninety days pass from that notice without a response or recorded activity, we will delete the account data. This mechanism is intended to avoid the indefinite retention of data that no longer serves any purpose. We will never delete an active account without your request.
Data that Stripe, Google, Apple or Cloudflare retain on their own account is governed by their respective retention policies. We can instruct them to delete the data they process on our behalf, and we will do so upon your request.
We apply technical, administrative and physical measures proportionate to the risk:
If a security breach affecting your data occurs:
In all cases we will document the incident, its effects and the corrective measures taken.
As a data subject, or as a parent or guardian in respect of a child's data, you may exercise the following rights:
Write to contacto@peekabookkids.com stating the right you wish to exercise and providing what we need to identify you, normally the email address associated with your account.
Proportionate verification. We will request only the information necessary to confirm your identity. Where account ownership suffices to establish it, validation of the registered email address will be enough. We will require identity documents only where the nature of the request or the associated risk justifies it, and we will in no case retain such documents beyond the time needed for verification.
What to include in your request. Your name or the means by which you wish to receive our reply, a clear description of the right you are exercising and of the data concerned, and any element that helps locate the information. If your request is incomplete, we will let you know so that you can complete it.
Exercising these rights is free of charge. Only justified shipping or reproduction costs on media other than electronic may be passed on, where you so request.
If we refuse your request, if you consider our response inadequate or if we fail to respond in time, you may apply to the competent supervisory authority. In Mexico, you have 15 days to bring proceedings before the Ministry of Anti-Corruption and Good Governance, through Transparencia para el Pueblo. Section 17 lists the authorities for each jurisdiction.
The Purchase Site honors privacy preference signals sent by your browser, including those of the Global Privacy Control mechanism, where applicable law gives them effect. In any event, we neither sell nor share personal data for advertising purposes, so such signals do not alter our processing.
Rights of Access, Rectification, Cancellation and Opposition (ARCO), together with the right to withdraw your consent and to limit the use or disclosure of your data under Section 6.3. The right of cancellation extends to the deletion of your data in the files, records, dossiers and systems in which it is held. The right of opposition may also be exercised where your data is subject to automated processing that affects you.
Supervisory authority: the Ministry of Anti-Corruption and Good Governance, acting through its decentralized body Transparencia para el Pueblo, which assumed the powers of the former INAI as of March 21, 2025. Current channels are published on the Ministry's official portal at gob.mx.
All rights described in Section 11, together with the right to lodge a complaint with the supervisory authority of your country of residence. The directory of authorities is available at https://edpb.europa.eu.
Representative in the European Union. We have assessed whether a representative should be designated under Article 27 GDPR. That assessment is reviewed periodically in light of the volume and regularity of processing of data of individuals in the Union. Regardless of its outcome, we handle any request directly at contacto@peekabookkids.com, in Spanish or English.
Rights equivalent to those under the GDPR. Authority: the Information Commissioner's Office, www.ico.org.uk.
A parent or guardian has the right to review any information we may have collected from their child, to request its deletion and to refuse any further collection, without this conditioning access to content already acquired. Authority: the Federal Trade Commission, www.ftc.gov, 1-877-FTC-HELP.
Rights to know, delete, correct and limit the use of sensitive information. We do not sell or share personal information within the meaning those laws give to those terms, so there is no opt-out mechanism to exercise. We do not discriminate against those who exercise their rights.
A number of states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, have comprehensive consumer privacy legislation. If you reside in one of them, we recognize the rights that legislation grants you, including access, correction, deletion, portability and opt-out of targeted advertising, sale of data and profiling. As we do not engage in targeted advertising, do not sell data and do not profile, the corresponding opt-out rights have no object in our case. Exercise any of them by writing to contacto@peekabookkids.com.
Office of the Privacy Commissioner of Canada, www.priv.gc.ca.
Autoridade Nacional de Proteção de Dados, www.gov.br/anpd.
If your country has personal data protection legislation, we will respect the rights that legislation affords you.
The iOS application is a native application and uses no browser cookies. It employs the operating system's local storage mechanisms, such as iOS UserDefaults, solely to retain your settings and language preferences, playback progress and signed-in session state.
The Android application is a Trusted Web Activity: technically, the same Application website running inside an instance of Google Chrome embedded in the app. Because of this, instead of UserDefaults, it employs the browser's own storage mechanisms — local storage, IndexedDB and strictly necessary session cookies — solely for the same purpose described in the paragraph above: settings and language preferences, playback progress and signed-in session state. No advertising, tracking or third-party cookies are used.
The Purchase Site uses cookies strictly necessary for the registration and payment process to function, together with those Stripe requires for fraud prevention. Should analytics cookies or cookies serving any other non-strictly-necessary purpose be used, your prior consent will be sought through the appropriate mechanism.
The best interests of the child, enhanced protection, effective parental supervision, and design oriented toward calm rather than attention capture.
The Application does not direct children outside its environment. Elements intended for the adult, including sign-in and account management, sit behind a parental gate.
We integrate no third-party analytics tools for advertising purposes and no persistent identifiers for tracking purposes. The providers listed in Section 7 are involved solely in the service infrastructure.
We adopt the principles of the UK Information Commissioner's Office Age Appropriate Design Code, applicable to services likely to be accessed by children. Specifically:
Our model rests on a deliberate design decision: the child is never an account holder and never the subject of identifiable processing. The only identified person in our systems is the adult who contracts. Any question on this point may be directed to contacto@peekabookkids.com.
Locally stored data, including any content you have created, is deleted from the device by the operating system itself.
Your account and your right of access to the content acquired remain in force. If you reinstall the Application and sign in, you recover your access at no cost.
Minor changes. Publication of the updated version with a new effective date at https://peekabookkids.com/politicadeprivacidad.
Material changes. These are changes affecting the categories of data processed, the purposes, the providers, international transfers or your rights. In such cases:
Version control. We will keep earlier versions of this Policy available, stating the period during which each was in force.
Data protection, rights and complaints: contacto@peekabookkids.com
Tax receipts: factura@peekabookkids.com
Postal address: Carlos Alberto Duarte Ortega, Bosque de Cedros, Manzana 46 Lote 1, Col. Los Héroes de Tecámac Sección Bosques, C.P. 55764, Tecámac de Felipe Villanueva, State of Mexico, Mexico.
Languages: Spanish and English.
Our resources: https://peekabookkids.com/recursos-padres
External references on privacy and digital parenting:
By downloading and using Peek a Book Kids, or by creating an account on the Purchase Site, the parent or legal guardian represents that they: