Before your child taps Play: a practical privacy check
A colorful interface can tell you what a children’s app looks like. It cannot tell you what the service collects, shares or keeps. Before handing over a device, take a few minutes to look at the product as a grown-up. Start with the privacy notice, the account requirements and the settings, rather than assuming that a friendly character means a private experience.
Know what the privacy rules are about
The Federal Trade Commission explains that COPPA gives parents control over information websites can collect from children. The rule generally covers services directed to children under 13 and services with actual knowledge that they collect personal information from a child under 13. Covered collection can require notice and verifiable parental consent. The FTC finalized amendments in 2025 that strengthen protections, including requirements concerning third-party disclosure and data retention.
A parent area, a birthday box or a simple arithmetic question is not, by itself, proof that a service has met all applicable requirements. This guide is a practical reading checklist, not a legal assessment of an individual app.
1. Look at what is requested before play begins
Open the experience yourself. Does a child need an account? Are a real name, exact birthday, email address, photograph, school or location requested? Which fields are optional? If a request seems unrelated to the activity, stop and read the explanation before supplying anything. Consider whether there is a way to use the product without creating a profile.
Check device permission prompts as well. A drawing game, for example, should have a clear reason if it asks for the camera or microphone. Denying an optional permission can be a useful way to understand which features actually depend on it. Avoid entering a child’s details simply to see what happens next.
2. Find the difference between local progress and an online account
“Saved” can mean several things. A game may remember a setting only in the browser, sync a profile across devices or send activity events to a server. Look for an explanation that says where progress is stored and how it can be removed. Browser-local storage can disappear when the browser’s site data is cleared; an online account may need a separate deletion request.
On a shared device, think about who can open the same browser. A local setting is convenient, but it should not be treated as a secret place to keep personal information.
3. Read the advertising and partner-link explanation
Look for advertising pixels, behavioral analytics, third-party embeds and personalization. Ask whether the service uses a child’s actions to choose ads or commercial recommendations. A link leading outside the product introduces another service and another privacy policy. Read the disclosure before deciding to follow it.
An affiliate disclosure explains that the publisher may receive a commission. It does not automatically explain every privacy practice of the destination. Keep the purchase decision with the grown-up and check the partner’s own terms, age suitability and data policy.
4. Locate the controls before you need them
Find the reset, deletion, sound, permission and account settings. Notice whether the instructions identify what a reset removes. If a product offers a contact address, use it to ask a focused question about data handling; do not send a child’s sensitive information in the message.
Revisit the notice when a product introduces accounts, social features, uploads or advertising. A privacy check is most useful when it follows what the product actually does today.
How this applies to the FoxyTales MVP
FoxyTales play does not require a child account. Story completion, chosen language, drawing colors and meadow decorations are stored in the current browser. They can be reset in the grown-up settings. The play interface does not include advertising pixels, behavioral analytics or external social embeds.
Hosting and security services still process basic web requests to deliver and protect the site. Optional read-aloud uses the device’s speech service; depending on the browser, displayed text may be processed remotely. No microphone is used. The arithmetic door is a navigation aid, not verifiable parental consent.
Read FoxyTales Privacy & Care for the product’s specific explanation. For authoritative information, start with the FTC’s Children’s Privacy resources and its 2025 rule update announcement.
Try a small check before sharing the device
For the FoxyTales release, our browser check opened the parent settings and inspected the available controls. The break reminder offers 10 minutes, 20 minutes and 30 minutes. Those numbers describe the configurable notice, rather than a pediatric recommendation or a promise that the device will switch off. Choose an option only if a reminder would be useful for your family.
We also completed a story, reloaded the page and checked that its passport stamp remained in the same browser. A picture was colored with a pointer and a keyboard, then downloaded as an SVG. No third-party page requests were observed during that bounded play-interface check. This observation is specific to the tested product flow; it is not a certification of every hosting or partner service.
Use a similarly concrete approach with another app. Complete a small activity yourself, revisit the settings and check where its result appears. You do not need to provide a child’s real information to practice this routine. If a service’s explanation differs from what you see, pause and ask the provider to clarify the difference before your child continues.
