Privacy Policy

Bonbon is operated by Kordelia, TOO (Товарищество с ограниченной ответственностью "Корделиа"), BIN 260840003233, registered address: 133/1 Gagarin Ave, NRP 104, Almaty 050000 Kazakhstan. Children watch videos in the app, and parents manage profiles, settings, accounts and subscriptions. This policy covers our Android and iOS apps, the connected TV features, and purchases made on our website. We do not sell personal data or use children's activity to target advertising.

Information the app collects

• Parent accounts. An optional email address, display name, account identifier and authentication records. Android parent accounts use email sign-in. On iOS, parents may also use Google, Apple or Facebook; those providers give us an account identifier, email and name when available. Passwords for email accounts are stored as hashes, not readable passwords.
• Child profiles. A name or nickname, age, selected languages, avatar choice and profile settings. The age selection is represented on our server by a derived date of birth so age-based filters can work. Profiles and usage records are associated with installation, profile and, when signed in, parent-account identifiers.
• App activity and search history. Videos shown, played, skipped, liked or blocked; playback duration; searches typed into the app; screen visits; and settings and feature interactions. We use these records to operate the catalog, enforce screen-time controls, personalize recommendations, calculate family rewards, prepare activity reports and understand how the app works.
• Device identifiers and technical information. A random installation identifier, app and operating-system version, device model, language and timezone. If notifications are enabled, a push token is sent to our server and the notification provider (Firebase Cloud Messaging on Android, Apple Push Notification service on iOS). We do not request the Android advertising ID or Apple's advertising identifier.
• Approximate location. Country or region inferred from the network IP address and device locale, used for regional video availability and service operation. Region may be stored with an installation identifier. We do not request location permission or collect GPS location.
• Purchases. For an optional Bonbon Family subscription, product and transaction identifiers, subscription status, purchase and renewal dates, and the account or installation to which access belongs. The App Store or Google Play processes payments made in the app. Payments made on our website are processed by FastSpring, our reseller and Merchant of Record, which collects the payment details and the contact and location details it needs to take the payment and charge tax, such as your email address and country; we receive the order details and that email address and country. We do not receive your full payment-card information. Adapty helps validate purchases and manage subscription access.
• Reports and support. Email addresses a parent adds for activity reports, confirmation and delivery records, and optional feedback messages, star ratings and reply-to email addresses. Report recipients are confirmed by email. Removing a report recipient stops future reports; its subscription record is retained until associated app data or the account is deleted.
• Crash reports and diagnostics. Production Android and iOS apps send crashes and app-hang reports to Sentry, including technical device/app information and error stacks, so we can diagnose faults. Screenshots, screen recordings and session replay are disabled; default personal-information collection is disabled.
• TV playback. Pairing tokens connect a TV to the parent's phone. The phone and TV exchange playback commands, video identifiers and playback position. Playback activity contributes to the family's history, limits and reports. While pairing, network information is used to match a nearby phone and TV; the TV does not hold the parent's sign-in credentials.

Service providers and video playback

We use Railway for hosting, Sentry for crash diagnostics, Adapty, the app stores and FastSpring for subscriptions, and email and push-notification providers to deliver requested messages. These services receive the information needed for those functions. FastSpring handles the information you give at checkout on our website under its own privacy statement. Adapty's Android integration disables advertising-ID and IP-address collection. Our services and providers may process data outside Kazakhstan, including in the United States and Europe.

Videos play through Google's embedded YouTube player. Your device connects to Google/YouTube, which receives connection information such as your IP address and the video requests needed to deliver playback. Google's handling of that information is described in the Google Privacy Policy; playback is also subject to YouTube's Terms of Service. An embedded player is a third-party service. We do not sell advertising space in Bonbon or use your child's activity for personalized advertising.

If a parent asks us to email a report to another confirmed recipient, we send that recipient the report. Parents should add only adults they want to receive their child's activity information.

Children and parent controls

Bonbon is designed for children. Watching, searching and other use of the app generates the activity and technical records described above; these records are not anonymous merely because the identifiers are random. Parents can manage profiles, filters, screen-time settings and deletion through the parent area. Account, purchase, support and report-recipient controls are protected by a parental gate.

An account, a subscription, report emails and feedback are optional. The app needs installation/profile identifiers, age-based settings and technical and activity data for its core functions. Parents can turn notifications off in the device settings, remove report recipients, and request deletion as described below.

Delete your account and data

Retention and security

Account, profile and usage records are retained while needed to operate the account or installation and are removed through the deletion controls described above. Removed report addresses remain in their subscription records until that deletion. Aggregate statistics that can no longer identify a person or installation may remain. Store transaction records can remain after their link to a deleted account/device is removed, for subscription validation and transaction administration; the app stores also keep their own transaction records. Support correspondence, diagnostic reports held by providers and backup copies have separate retention and deletion processes. Contact us to request deletion of associated support or diagnostic data as well.

Data sent to our services is encrypted in transit using HTTPS. Access to operational systems is restricted.

Changes and contact

We update this page and its date when these practices change. For privacy questions, access, corrections or deletion, contact [email protected].