Watchling Privacy Policy

Last updated: 4 November 2026

The short version (for grown-ups, in plain language)

Watchling is a video app for children that you, the grown-up, control. We try to know as little about your child as possible.
To play videos, Watchling uses YouTube's own official player. When a video plays, your child's device talks directly to Google/YouTube, and YouTube may set its own cookies and show its own ads inside that player. We cannot remove those ads, and we cannot see or delete what Google collects. YouTube's autoplay is switched off. The only time one video follows another is "Play all" on a list you made, which plays only that list and stops at its end or at the time limit. We also ask YouTube to keep any videos it suggests to the same channel, and never place anything on top of the player.
We keep your email address and a hashed PIN so you can sign in to the grown-ups area, plus the name, avatar and age band for each child — you choose them, and your child can change how their avatar looks.
We keep a record of what your child watches and saves inside Watchling — how far they got through a video, and their favourites, their watch-later list and the lists you make for them — so a video can resume and so you can see a weekly summary of what they have been watching. These lists are ours, not YouTube's: we never add anything to a YouTube account, and we never hand them to anyone. (The thumbnail pictures in them still load from Google, as the rest of this policy explains.)
Your child's device also talks directly to Expo, which delivers updates to the app: when the app opens, Expo receives the device's IP address and a random identifier for that installation (and, after a crash, error details).
We do not show our own ads, we do not sell anyone's data, and we do not build an advertising profile of your child.
You can delete your whole account and all of your children's data at any time, from inside the app: open the grown-ups area, go to Account, and tap Delete account. We explain below the few places deletion cannot reach.
Questions, or want us to delete your household for you? Email compliance@getwatchling.com.

The rest of this policy is the full detail.

Who we are

Watchling ("Watchling", "we", "us") is operated by Joshua Cain, 861 Williston Road STE 8 #1022, South Burlington, VT 05403, United States. You can reach us about privacy at compliance@getwatchling.com.

This service is offered in the United States. If we begin offering it elsewhere, we will update this policy first.

Who this is for

Watchling is directed to children and designed to be set up and controlled by a parent or guardian. A child cannot create an account or reach the grown-ups area — that area is behind a PIN. Everything that decides what a child may watch is a grown-up's choice, within one fixed limit: Watchling plays only videos marked as made for kids on YouTube, for every child, and no setting changes that. (A child can type words to search, or to ask you for something — see below. Search covers the channels you allow. If the search setting on the Channels screen is on (it starts on for a child you add), it also covers the channels we recommend for your child's age or younger. Everything search shows passes your rules and that limit, and a channel you removed or blocked never appears.)

What information we collect, and why

We collect only what the service needs. Here is everything, and why:

Your email address (the grown-up's). So you can create and sign in to your household, verify your address, and recover your PIN. Used for nothing else. We do not send marketing email to your account address.
When you confirmed you're the parent or guardian. Creating an account asks you to confirm that you're the parent or legal guardian of the children who'll use Watchling, and that you're 18 or older. We record when you created your account after confirming it — not your age or your date of birth. (Accounts created with an earlier version of the app were not asked, so we hold no such record for them.)
Your PIN, stored only as a secure hash — never the PIN itself. So we can check the PIN that unlocks the grown-ups area. A short-lived session token is kept on your device after you enter it. We also count failed PIN attempts since the last correct one, and lock the grown-ups area for a while after too many, so someone cannot guess their way in.
A name, avatar, and age band for each child — the ones you choose. So your child can pick their face on the home screen and so we can set sensible starting rules for their age. A first name or nickname is all the app needs. You choose the name and age band; your child can also change how their avatar looks.
A credential for each time the app is set up or signed in. Created when you create the account, and again each time you sign in with your email and PIN, including on a device that signed in before, and stored only as a secure hash. It is what lets the app on that device reach us at all — separately from the PIN, which unlocks the grown-ups area. It has no expiry date. Resetting your PIN by email cancels every one, so each device has to sign in again, but the hashed record of each is kept until your account is deleted. We also count failed sign-in attempts, and pause sign-in for a while after too many.
Your content rules, the channels you allow or remove, your search setting, any single videos you add for a child, and the screen-time limits you set. So the app can show your child only what your settings allow, for as long as you have allowed.
Requests a child sends for you to review. If a child taps "ask a grown-up" — or searches for something — we may store that request (the video, or the words they typed) so you can approve or decline it.
Records of videos we withheld from a child, or that your child flagged. When our rules hide a video, we keep a record of which video and which rule applied. If your child taps to report a video, or asks you about one, we keep that too — so all of it can appear in your review queue for you to allow or keep blocked. We also count how many families have reported each video, so we can find and remove a video for everyone; the count and the alert it sends us say which video and how many, never who reported it.
What your child watches inside Watchling. Which videos they started, how far through they got, and when. So a video can pick up where they left off, and so we can show you a weekly summary — how much they watched, and which channels and kinds of video. (The daily time limit is counted on the device itself, not from this record.)
What your child saves inside Watchling. Favourites, a watch-later list, and any lists you make for them in the parent area, with the names you give those lists. These are Watchling's own lists — we never write anything to a YouTube account, and we never share them with anyone. (The thumbnail pictures in those lists still load from Google when the screen is shown, as described under "Playing videos".)
Your child's device IP address. Like every internet service, our servers and Google's receive your device's IP address as part of delivering the app and playing videos. It can appear in our server's operational logs (see retention below) and is received by Google when a video or thumbnail loads. Our app-update provider, Expo, also receives it when the app opens. When a device signs up, signs in or asks for a PIN-reset email, or a grown-up enters the PIN, our server also stores the address in hashed form, to limit how many attempts can come from one address. That record is no longer needed five minutes after the last attempt. We normally delete it within minutes of that; when nobody is signing in, it waits for our daily maintenance run (or a later one, if that run fails), so it can last a little over a day. It is not linked to your account, so deleting your account does not remove it; it expires on its own. Like anything we delete, it can stay in our database provider's backup history (described below) for up to 7 days.
A random identifier for each installation of the app, and error details after a crash. When the app opens, it checks with our app-update provider (Expo) for a newer version, and sends a random identifier the app created for that installation. A new one is created if the app is removed and installed again. If the app crashed while starting up, that check also sends Expo a short technical description of the error (or of several, if they built up since the app last checked). Error messages are written by software, and some of ours include the web address the app was requesting, which can contain your child's profile identifier or the words they typed into search. So a crash report can carry those, although it rarely will.

We do not need your child's real name — a first name or nickname is fine — and we never ask for their birth date, photo, location, contacts, or any government identifier. We do not use cookies or trackers of our own for advertising.

Checking age on an iPhone or iPad. When someone creates a Watchling account on an iPhone or iPad, the app asks Apple whether an age-checking law applies to the person signed in to that device's Apple Account (Texas has one, for example). If one does, the app asks Apple whether that person is 18 or older, and Apple may show its own message asking to share an age range. On iOS 26.2 or later, the account is created only if Apple says no such law applies, or that the person is 18 or older. Otherwise it is not created on that device: a grown-up can create it on their own device and then sign in on this one. Versions of iOS older than 26.2 cannot answer, so on them the app does not check, and neither do versions of the Watchling app before 1.0.2. The answers are used for nothing else. They stay on the device, are never sent to us or to anyone else, and are not kept once the check is done. Signing in to an existing account never asks.

Playing videos: YouTube's player, and what that means

Watchling plays videos using YouTube's official embedded player. This is the only way to play a YouTube video within the rules YouTube sets, and it is core to how the app works. It has consequences we want to be honest about:

When your child plays a video, their device communicates directly with Google/YouTube. Google receives the video's identifier, your device's IP address, and device and browser characteristics, and YouTube may set its own cookies and identifiers inside the player and may show its own advertising. We cannot strip out or turn off YouTube's ads, and we do not receive, store, or control them.
Because we choose to embed the player and decide which videos are available, we are jointly responsible with Google for causing this transmission — we do not pretend it is nothing to do with us.
What we do control: YouTube's autoplay is switched off (one video follows another only through "Play all" on a list you made), YouTube is asked to keep any related videos it suggests to the same channel, no video is playable until your rules allow it, only videos marked as made for kids on YouTube play at all, and nothing is ever drawn on top of the player.
What Google does with this data, and how long they keep it, is governed by Google's own privacy policy and is on Google's schedule. We cannot inspect it and we cannot make Google delete it.
If a video opens outside Watchling — in your device's browser or the YouTube app — and that app is signed in to a Google account, that view can be linked to that account. This happens in the outside app, beyond our control.

We display thumbnail images the same way — they load from Google's servers, which again receive your device's IP address.

Watchling uses YouTube API Services. Your use of YouTube through Watchling is also governed by YouTube's Terms of Service (youtube.com/t/terms) and Google's Privacy Policy (policies.google.com/privacy), which describes how Google and YouTube handle the data collected through the player.

Who else can see this information

We keep your household's data private and never sell it. A small number of service providers process limited data on our behalf so the app can function. We require our providers to protect the data they handle under their agreements with us; we are finalizing the formal data-processing agreements with them.

Google / YouTube — plays the videos and serves thumbnails (receives your child's device IP and the data described above); and separately supplies the video catalog information we classify (this does not involve your child's data).
Our hosting provider (Fly.io, United States) — runs our servers.
Our database provider (Neon, United States) — stores your household's data at rest.
Our email provider (Resend) — sends account emails such as verification and PIN-reset links (receives a grown-up's email address), and passed waitlist sign-ups from our website on to us while the waitlist was open.
Our app-update provider (Expo) — delivers fixes to the app. When the app opens, Expo receives your device's IP address and the app's random installation identifier, and after a crash a short description of the error.
A content-classification provider (currently Google Gemini) — helps us label what kind of video each one is. We send it video information (titles and descriptions from the catalog), not information about your child. If we change this provider, we will update this policy.
Cloudflare — hosts our website and a small public compliance page, and routes email to our inboxes.
Google Fonts — supplies the lettering on our website (not the app), and receives a website visitor's IP address and browser type.

We may also disclose information if the law requires it, or to protect the safety of a child or the public.

Our website

Our website, getwatchling.com, is for grown-ups and asks nothing about a child. When you visit it, your browser loads the site from Cloudflare and its fonts from Google Fonts, and both receive your IP address and browser type. The waitlist closed on 4 November 2026, and the website no longer asks for your email address. If you joined it before then, we received your email address by email through Resend, together with the country Cloudflare estimated from your connection, the address of the page you signed up on, and your browser type. We use it only to tell you when Watchling is available, and we delete our copy 30 days after we send that announcement, or sooner if you ask; Resend's records of passing it on are kept on Resend's schedule. Your browser may also still store the email address you entered, on your own device, until you clear the site's data.

Advertising and tracking

We do not show our own advertising in Watchling, and we do not create an advertising profile of your child.
We do not sell or rent personal information.
As described above, YouTube's player may show YouTube's own ads and set its own identifiers, which we cannot control or remove. That is YouTube's activity within its player, disclosed here so you can make an informed choice.
Watchling plays only videos marked as made for kids on YouTube. YouTube says it does not show personalised ads on those videos; that is YouTube's practice, which we cannot check or control, and YouTube's ads can still appear on them.

How long we keep information, and how to delete it

You are in control of your household's data, and you can erase it.

Deleting your account. Open the grown-ups area (tap the lock and enter your PIN), go to Account, and tap Delete account. This permanently erases your household and every child's data from our database — profiles, rules, the channels you allowed, what your children watched and saved, your review and request records, and your grown-up login — in a single action you cannot undo. If you cannot get into the app, email compliance@getwatchling.com from the address you signed up with. We will reply to that address to check the request really comes from you, and once you confirm, we will delete your household for you. Deleting your account also withdraws the consent you gave for us to process this data.

What deletion cannot reach. To be honest about the limits:

Information already held by Google/YouTube from playing videos (including via the player's cookies, or if a video ever opened in the Safari or YouTube app). This is on Google's systems and schedule; we cannot delete it. Removing the app from your device also clears the player storage and cached images that earlier versions of the app left on it.
Our servers' operational logs, which can include your device's IP address (and, on an error, other identifiers such as an email address or an internal account id). These are kept for security and reliability, separately from your account record, and are not removed by deleting your account.
Emails we have already sent you, such as a verification or PIN-reset message already in your inbox, and the records our email provider keeps of sending them (including of a waitlist sign-up from our website).
Diagnostic/crash reports collected by Apple or Google from the app, under their own policies, and the error details our app-update provider receives after a crash.
Records our app-update provider keeps of the app checking for updates (your device's IP address, the app's random installation identifier, and any error details), on Expo's own schedule.
Some information the app keeps on your device. The app stores a few things on the device itself: one child's name and age band so the home screen appears quickly, and a few settings and today's screen-time counters for each child. It does not keep the lists of videos it shows, thumbnail pictures or weekly summaries on the device: the app holds those only in its memory while it is running, and the video player keeps nothing on the device once the app closes. Deleting your account clears the name and every child's settings and counters from the device. Deleting one child while others remain removes that child's settings and counters. Settings and counters, which hold no name or viewing history, can stay behind in four cases: a child deleted from a different device, a child this device had not loaded when you deleted the account, a deletion interrupted after our server finished it (for example, the app closed or the connection dropped), and a storage failure during the deletion. When you delete one child, an interrupted deletion, or deleting that child from a different device, can also leave the child's name and age band until the app next loads your children's list; a storage failure can leave them longer. When you delete your whole account, the name and age band can stay on a device until you remove the app or set it up again if the deletion was interrupted after our server finished it, the device's storage failed during it, or the account was deleted from a different device, by us at your emailed request, or by our daily maintenance run as an unused account: once the account is gone, the app can no longer reach us to tidy up by itself. Deleting your last child resets the app on that device but keeps your account (your email, hashed PIN and device credentials) until you delete the account itself, unless it is an unused account we delete as described under "How long we keep things otherwise". Removing the app clears all of these. On an iPhone or iPad, the app's two sign-in credentials can stay in the device's keychain after the app is removed; deleting your account cancels both. Versions of the app before 1.0.1 also kept copies of recently shown lists of videos, weekly summaries, thumbnail pictures and the video player's own storage on the device, and deleting your account did not clear all of them. Version 1.0.1 and later no longer store them, and try to delete the old copies each time the app opens; if that is interrupted or fails, they can stay until a later opening succeeds.
Copies in our database provider's backup history. Deleting your account removes your data from the live database straight away. Our database provider also keeps a short history of the database, so that it can be restored after a mistake, and your data can stay in that history after you delete. The history is currently set to 7 days, so a copy can remain for up to 7 days after you delete your account. This is a setting we chose, and it could change; if it does, we will update this policy.

How long we keep things otherwise. Account information (your email, hashed PIN, your children's profiles and rules, their saved lists, and the review records above) is kept for as long as your household exists, and erased when you delete it. One exception: an account whose email address was never confirmed, that has no children, and in which nobody has set the app up or opened the grown-ups area for 30 days may be deleted by our daily maintenance run. That erases the same records from our database as deleting the account yourself, but the app cannot tidy up a device it is not running on, so what the app keeps on a device can stay there as described under "Some information the app keeps on your device". An account with a child in it is never deleted this way. A child's request to watch something is deleted from our live database when you answer or dismiss it (backups are covered above). A request for a particular video is also deleted if we block that video, or a channel we know it comes from, for everyone who uses Watchling, and the block is still in place at our next daily maintenance run (or at a later run, if that one cannot finish it).

Viewing history is kept to a limit, and we want to be precise about how. A record of a video your child watched is deleted after 30 days, and their place in a part-finished video after 90 days. The 90 days runs from the last time your child touched that video, not from the first. These limits are applied by a maintenance job that runs every day. If a run fails, records can outlive the limit until the next successful run.

Verification links and PIN-reset links expire quickly, and the records behind them are erased by our daily maintenance run once they have been used or have expired. Session tokens expire quickly too, and the record of a session is erased by the same run 30 days after it expires: we keep it that long to tell an account that is still in use from an abandoned one. If a run fails, these records can stay until the next successful run. All of them are erased when your account is deleted. Each device's credential lasts until the account is deleted. Our operational logs currently have no fixed retention schedule; we are establishing one.

How parents are in control

The grown-ups area — where accounts, rules, and deletion live — is behind a PIN, so a child cannot reach it.
You choose every child profile and every content rule, within the made-for-kids limit described above; nothing a child sees is decided without a grown-up.
You can review videos that were withheld, allow or block channels, delete a child's profile, or delete the whole account, at any time.
Setting up the account (providing your email and PIN, and confirming you're the child's parent or legal guardian and 18 or older) is how a parent establishes and consents to the service on their child's behalf. We are finalizing the details of how we confirm parental consent, in line with children's-privacy law.

Children's privacy (COPPA and children's data)

Watchling is intended for children and is built to be data-minimal about them. The only information we hold about a child is the profile details a parent enters (and the avatar look the child picks), the rules, screen-time limits and single videos a parent sets for them, what the child has watched and saved inside Watchling, the requests a child sends for review, records of videos we withheld or the child flagged, the information the app keeps on the device (described under "What deletion cannot reach"), the technical data described above that reaches Google and our logs when videos play, and Expo when the app opens — the device's IP address, the app's random installation identifier and any crash details — and the hashed credential, stored only by us, that identifies the device to us. We do not use any of it for advertising or to build a profile of a child. Parents have the right to review the information associated with their household, to refuse further collection (by deleting a child's profile or the whole account in the app), and to have it deleted. To exercise any of these rights, use the in-app controls above or email compliance@getwatchling.com.

Because Watchling embeds YouTube's player, some data reaches Google as described in "Playing videos" above; we disclose this so a parent can decide whether the service is right for their family.

Changes to this policy

If we change what we collect, who we share it with, or how we handle your data, we will update this policy and change the "Last updated" date above, and — for material changes — tell you in the app.

Contact us

Questions, requests, or a deletion you cannot do yourself: compliance@getwatchling.com.