Privacy policy - Streamu

Last updated: [15 May 2026]

1. Introduction

Streamu is operated by Sussex Venture Partners Ltd (company number 14451532), a company registered in England and Wales with its registered office at Bolney Place, Cowfold Road, Bolney, Haywards Heath, West Sussex, United Kingdom, RH17 5QT (“we”, “us”, “our”).

This Privacy Policy describes what personal data we collect when you use the Streamu website and mobile and connected-device applications (together, the “Services”), how we use it, who we share it with, and the rights you have in relation to your data. It should be read together with our Terms and Conditions of Use (the “Terms”), which govern your use of the Services.

This policy provides information; it is not itself a contract. The legal bases on which we process your personal data are set out in Section 4.

Contact:

Sussex Venture Partners Ltd Bolney Place, Cowfold Road, Bolney, Haywards Heath, West Sussex, United Kingdom, RH17 5QT Email: support@streamu.app

2. Information We Collect

Account information

When you register for a Streamu account we collect:

Your name
Your email address
A hashed representation of your password (we never store your password in plain text)
The household account name you provide during sign-up

Parental controls

If you set a parental PIN to protect parent-only areas of the app, we store it as a hash. We never store the PIN itself in plain text.

Subscription, billing, and parental verification

When you complete sign-up, you provide payment-card details, which are processed and stored by our payment processor, Stripe. We use a small verification transaction at sign-up to confirm that you are an adult cardholder and to satisfy the “verifiable parental consent” requirement under U.S. children’s privacy law (see Section 8). This verification transaction is refunded or credited toward your first subscription payment. We do not store full payment card details ourselves; subsequent billing events and your subscription status are also processed and stored by Stripe.

Where you purchase a subscription through the Apple App Store or Google Play, that app store processes the payment and we receive subscription status and limited account identifiers from them. In that case, the app store’s own card-verification process serves as the parental-verification step.

Usage data

We automatically collect information about how you use the Services, including:

Screens and features you interact with
YouTube channels you search for, add, approve, or remove from your library
Allow-lists and per-video controls you configure for each kids profile
Videos watched and playback progress (per kids profile, to power resume-watching)
Session start and end times
Crash and performance diagnostic data

Device identifiers and push tokens

Our analytics, crash-reporting, and push-notification services collect a device identifier to aggregate usage data, attribute crashes to specific device types or app versions, and deliver push notifications you have opted into. If you enable push notifications, we and our push-delivery provider (Firebase Cloud Messaging, operated by Google) store a device token used solely to deliver notifications to your device. You can disable push notifications at any time in your device settings.

Kids profile data

Kids profiles are created by a parent or guardian within their Streamu account, after the parental-verification step described above. A profile contains:

A display name (and, optionally, a short name)
A chosen colour and theme from a curated picker — we do not accept photographic avatars or any uploaded image of a child
Optionally, the child’s year of birth (we collect year only, not full date of birth, where the parent provides it — used to support age-appropriate features)
The list of YouTube channels and videos the parent has approved for that child
The child’s viewing history within Streamu, including which videos have been watched, how far into each video, and whether each was completed — used to support resume-watching and to populate the child’s recent-watch view

We do not collect contact information directly from children, do not allow children to register their own accounts, and do not enable children to communicate with other users. Parents are responsible for the information they enter when creating or managing a kids profile, including any year-of-birth value, and warrant under our Terms that they have authority to provide that information and to consent on the child’s behalf to the processing described in this policy.

For more on the legal basis on which we process children’s data, see Section 4. Additional information for users in the United States is set out in Section 8.

Search history

When a parent searches for YouTube channels to add to a household library, we log those search queries to provide the search experience and to diagnose problems. We may, in future, use search history to help parents discover new content to assign to kids profiles. We will never use search history — or any other data we hold — to power recommendations served to a child inside kids mode. Content shown to a child is determined solely by the allow-list configured by their parent.

Phone number

We do not currently collect your phone number. This may change in future if we introduce phone-based account verification or a support contact feature. We will update this policy before doing so.

3. How We Use Your Information

Purpose	Data used
Creating and managing your account and household	Name, email address, account name
Authenticating you on sign-in	Email address, hashed password
Protecting parent-only areas of the Services	Parental PIN (stored as a hash)
Verifying you are an adult parent or guardian before kids profile creation	Payment-card details (handled by Stripe or the app store)
Processing your subscription and free trial, and handling billing-related queries (including refund requests via an app store)	Billing events, subscription state, app-store account identifiers where applicable
Sending transactional emails (for example email verification, billing notifications, security alerts)	Email address
Sending optional product updates and tips, where you have not opted out	Email address, push token
Delivering push notifications you have enabled	Device push token, device identifier
Letting parents discover, add, organise and manage YouTube channels and videos for their household, and letting kids profiles play approved videos	Search history, YouTube channel/video identifiers, allow-lists, per-kid watch history
Operating and improving the Services	Usage data, device identifiers
Diagnosing crashes and technical issues	Device identifiers, crash logs
Complying with legal obligations and responding to lawful requests	Any of the above as required

We do not use your personal data for advertising and we do not sell it to third parties.

4. Lawful Bases for Processing

Under UK and EU data protection law, we must have a lawful basis for processing personal data. The bases we rely on are:

Performance of a contract — to provide the Services to you under our Terms, including account creation, authentication, subscription management, and the core parental-control functionality.
Legitimate interests — to keep the Services secure, diagnose technical issues, prevent fraud and abuse, understand how the Services are used in aggregate, and respond to your queries. We balance these interests against your rights and would not rely on this basis where your interests override ours.
Consent — for non-essential marketing communications (such as newsletters and product tips) where required, for non-essential push notifications, and for any analytics that legally require consent. You can withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
Legal obligation — where we must retain or disclose data to comply with law (for example financial-records retention or lawful requests by a competent authority).
Consent given by a parent or guardian on behalf of a child — for processing of kids profile data. By completing the parental-verification step at sign-up and creating a kids profile, the parent confirms (under Section 3.2 of the Terms) that they have authority to provide the relevant data and to consent on the child’s behalf to the processing described in this policy.

For users in the United States, additional information about the legal framework applicable to children’s data (including COPPA) and California-specific privacy rights is set out in Section 8.

5. Children’s Privacy

Streamu is a parental-control service. Although the end users of kids mode are children, the Services are marketed to, purchased by, and configured by parents and guardians. Only adults (18 years or older, with legal capacity to enter into a contract under our Terms) may register a Streamu account. Children do not create their own accounts and use the Services only through a profile within a parent’s account, under that parent’s supervision and using the controls the parent has configured.

Before any kids profile can be created, the parent completes a verification step at sign-up that confirms they are an adult cardholder. This step is described in more detail in Section 8.

The data we hold about a child is limited to what is described under “Kids profile data” in Section 2 (a display name, optional short name, a chosen colour and theme, optionally a year of birth, the parent-approved allow-list of YouTube content, and viewing history within the Services). We do not collect contact information directly from children, do not allow children to message other users, and do not enable any feature that would expose a child’s data outside the parent’s account. Content shown to a child is determined solely by the allow-list the parent has configured — Streamu does not recommend, curate, or algorithmically rank content within kids mode.

Parents can review, correct, or delete any kids profile (and the associated allow-list and watch history) at any time from within the Services.

If you believe a child has provided us with personal data without appropriate parental consent, please contact us at support@streamu.app and we will promptly delete it.

6. Third Parties We Share Data With

We share data with the following service providers only to the extent necessary to operate the Services. We do not sell your personal data.

YouTube and Google LLC

The Services let parents discover, organise and play YouTube channels and videos. We use the YouTube Data API and embedded YouTube playback to do this. When the Services load channel or video metadata, or play a video, requests are made to Google’s servers; Google may collect technical information such as IP address, device identifiers, and viewing telemetry in accordance with Google’s privacy policy. Use of YouTube content within the Services is also subject to the YouTube Terms of Service. See policies.google.com/privacy and youtube.com/t/terms.

Supabase

We use Supabase for user authentication and account management. Your email address and account identifiers are stored in Supabase’s infrastructure. Supabase processes data in accordance with its own privacy policy.

Firebase and Google Cloud Messaging (Google)

We use Firebase for app crash reporting, performance monitoring, and (where you have opted in) push-notification delivery. Firebase may collect device identifiers and usage signals to help us diagnose technical issues, and stores a device push token used to deliver notifications to your device. Data is processed by Google in accordance with Google’s privacy policy.

Google Analytics

We use Google Analytics to understand in aggregate how users navigate the Services. Google Analytics collects device identifiers and interaction data. You can learn more at policies.google.com/privacy.

Stripe

We use Stripe to manage parental verification, subscriptions, and billing for subscriptions purchased directly through our Website. When you sign up or subscribe, payment-card information and payment events are processed by Stripe. Stripe is PCI-DSS certified. We do not receive or store your full card details. See stripe.com/privacy.

Apple and Google (app stores)

Where you purchase a subscription through the Apple App Store or Google Play, the relevant app store processes the payment and shares subscription status and limited account identifiers with us. As permitted under our Terms (Section 7.7(a)), we may share account and usage data with the app store to help it assess a refund request you have made.

Resend

We use Resend to deliver transactional emails such as email verification messages, subscription notifications, and account alerts. Your email address is shared with Resend for this purpose only.

Railway

Our backend application is hosted on Railway. Railway is a cloud infrastructure provider that runs the servers handling requests between your device and our databases.

7. Where Your Data is Processed

Our application servers and primary database are hosted in the United Kingdom. The Services are available to users in the United Kingdom, the European Economic Area, and the United States, and we may serve users in other regions who access the Services.

For users in the European Economic Area, the United Kingdom is recognised by the European Commission as providing an adequate level of data protection, so transfers of personal data from the EEA to our UK infrastructure are lawful on that basis.

For users in the United States and elsewhere, your personal data is transferred to and processed in the United Kingdom. Where we transfer personal data internationally to our third-party providers (in particular Google, Stripe and Apple, who operate global infrastructure), we rely on appropriate safeguards including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, depending on the destination.

8. Information for Users in the United States

This section provides additional information for users who access the Services from the United States.

Children’s privacy (COPPA)

The U.S. Children’s Online Privacy Protection Act (“COPPA”) governs the online collection of personal information from children under 13. Streamu is operated with COPPA in mind and is designed to minimise the data collected about children:

A Streamu account can only be opened by an adult (18 or over) who confirms they are a parent or legal guardian of any child whose profile they create.
We do not collect contact information from children. We do not allow children to register their own accounts, post content, or communicate with other users.
The information held about a child within a kids profile is limited to a display name, an optional year of birth, a chosen colour and theme, the YouTube content the parent has approved, and the child’s viewing history within the Services. The collection of this information is initiated, controlled, and revocable by the parent at any time.
Content shown to a child is determined solely by the parent-configured allow-list. Streamu does not algorithmically recommend, curate, or rank content within kids mode.
We do not knowingly use children’s data for advertising and we do not sell or share children’s data with third parties for advertising or marketing purposes.

Verifiable parental consent. Before a kids profile can be created and before any information about a child is collected, the parent completes a verification step: they provide payment-card details to our payment processor (Stripe), and we initiate a small verification transaction on that card. The transaction is refunded or credited toward the parent’s first subscription payment. Where the parent subscribes through the Apple App Store or Google Play, that app store’s own card-verification process serves as the equivalent step. We rely on this card-based verification as the “verifiable parental consent” method described in 16 CFR §312.5(b)(2). At the point of verification, this Privacy Policy serves as the direct notice to the parent of what we collect about children and how that information is used. You may withdraw consent at any time by deleting the relevant kids profile or closing your account (see Section 11).

As a parent or guardian, you have the right at any time to:

Review the information held about your child.
Refuse to permit further collection or use of your child’s information.
Delete your child’s profile (and all associated allow-list and watch-history data) from within the Services, or by contacting us at support@streamu.app.

If you believe we have collected information from a child without appropriate parental consent, please contact us at support@streamu.app and we will promptly delete the information.

California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), gives you certain rights in relation to your personal information:

Right to know the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
Right to delete personal information we have collected from you, subject to certain exceptions.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not sell or share the personal information of any user we know to be under 16.
Right to limit use of sensitive personal information.
Right not to be discriminated against for exercising any of these rights.

The categories of personal information we collect, the purposes for which we use them, and the categories of third parties with whom we share them are described in Sections 2, 3 and 6 of this policy. Sources of personal information are: you (directly), your device (automatically, via our applications), and our service providers (for example, Stripe and the app stores in connection with subscription processing).

To exercise any of these rights, contact us at support@streamu.app. We will verify your request by matching the information you provide against the information we hold for your account. You can also authorise an agent to act on your behalf, provided the agent supplies written permission and we can verify your identity.

Other U.S. states

If you are a resident of another U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have similar rights to those described above. Contact us at support@streamu.app to exercise them.

9. Data Retention

Account data is retained for as long as your account is active. If you close your account (see Section 11), we will remove your personal data within 30 days, except where we are required to retain it for legal or compliance reasons (for example, transaction records under applicable financial regulations).
Kids profile data, allow-lists, and watch history are retained for as long as the parent’s account is active or until the parent deletes the relevant profile or item. Watch history is preserved across the soft-removal of an approved channel so that resume positions can be restored if the channel is later re-approved; it is deleted when the parent uses an explicit “wipe everything” option, when the kids profile is deleted, or when the account is closed.
Analytics and crash data are retained in accordance with the standard retention policies of Firebase and Google Analytics.
Billing records may be retained by Stripe and (where applicable) the relevant app store for the period required by applicable financial regulations.
Email logs (records of transactional emails we have sent you) are retained for support and audit purposes for a reasonable period and then deleted.

10. Your Rights

You have the right to:

Access the personal data we hold about you.
Correct any inaccurate or incomplete data.
Request deletion of your account and personal data.
Object to or restrict certain processing activities.
Withdraw consent at any time where processing is based on consent.
Receive a copy of certain data in a structured, machine-readable format (data portability).
Complain to the UK Information Commissioner’s Office (ico.org.uk), your local supervisory authority in the EEA, or your state attorney general in the United States, if you believe we have not handled your data properly. We would, of course, ask you to contact us first so that we can try to put things right.

To exercise any of these rights, please contact us using the details in Section 13. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you and explain why. For California-specific rights, see Section 8.

11. Closing or Deleting Your Account

You can close your Streamu account and have us delete the personal data associated with it (including kids profiles, allow-lists, and watch history) at any time:

From within the app — go to Settings → Delete Account, confirm, and your account will be permanently deleted.
By email — if you cannot access the app (for example, you have forgotten your password or lost your device), email us at support@streamu.app and we will action the request within 30 days.

Account deletion is permanent. We will retain limited information only where required by law (for example, financial records of past transactions).

12. Data Security

We apply industry-standard technical and organisational measures to protect your personal data. These include encrypted data transmission (TLS), hashed credential storage, restricted access controls, and infrastructure provided by reputable hosting and authentication providers.

Access to the parent-facing areas of the Services is protected by your email and password and, where you have set one, a parental PIN. You are responsible for keeping these credentials confidential and for activity that takes place under your account, as set out in the Terms.

No method of transmission or storage is completely secure. If you believe your account has been compromised, please contact us immediately at support@streamu.app.

13. Contact

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact us:

Sussex Venture Partners Ltd Bolney Place, Cowfold Road, Bolney, Haywards Heath, West Sussex, United Kingdom, RH17 5QT Email: support@streamu.app

For data-protection complaints you also have the right to contact:

the UK Information Commissioner’s Office at ico.org.uk;
your local data-protection supervisory authority in the EEA; or
the attorney general of your state if you are in the United States.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will give you reasonable notice — for example by email or an in-App notification — before they take effect, in line with the change-notice approach in Section 1.3 of the Terms. Other changes will be reflected by updating the “Last updated” date at the top of this policy.