Privacy Polucy

Last updated: 4 July 2026

1. What information we collect

Account information

When a parent creates an account, we collect:

• Email address
• Password (stored securely via Supabase Auth)
• Age bracket of the child listener (e.g., 3–5, 6–8, 9–12). We do not collect children’s names.

Usage information (for logged-in users)

To provide personalised features, we store:

• Listening history
• Likes and favourites
• Saved podcasts and playlists

Technical information

When you use SoundCarrot, we may collect:

• IP address
• Browser and device information
• Basic usage analytics via our self-hosted Plausible instance

This data is anonymised and does not use cookies or tracking pixels.

2. How we use your information

We use your information to:

• Create and manage your account
• Provide personalised listening features
• Improve the service and understand usage patterns
• Send essential account emails (e.g., signup confirmation)

We do not use your data for advertising, profiling, or behavioural tracking.

3. Children’s privacy

SoundCarrot is designed for families. Parents create accounts and manage access. Children may use the service, but:

• We do not collect children’s names
• We only store an age bracket
• Listening data is linked to the parent’s account
• We do not show ads or use tracking pixels

If you believe a child has provided personal information directly, contact us and we will remove it.

4. Cookies and tracking

We use no advertising cookies, no tracking pixels, and no third-party marketing tools.

Our analytics (Plausible) is self-hosted, privacy-focused, cookie-free, and fully anonymised.

5. Third-party services

We use trusted providers to run SoundCarrot:

• Supabase — authentication, database, and secure storage
• Linode — hosting our servers
• Cloudflare — DNS, caching, and security
• Vercel — hosting parts of our frontend
• Resend — sending essential account emails
• Plausible (self-hosted) — privacy-friendly analytics

These providers may process data on our behalf. Some data may be stored or processed outside the UK, but always with appropriate safeguards.

6. How long we keep your data

We keep your account information for as long as your account is active. If you delete your account, we remove or anonymise your personal data within a reasonable timeframe.

Listening history, favourites, and similar data are deleted when your account is deleted.

7. Your rights (UK GDPR)

You have the right to:

• Access the personal data we hold
• Correct inaccurate information
• Request deletion of your data
• Object to certain types of processing
• Request a copy of your data (data portability)

8. Security

We take appropriate technical and organisational measures to protect your data, including:

• Secure authentication via Supabase
• Encrypted connections (HTTPS)
• Restricted access to databases
• No storage of plain-text passwords

9. Contact us

If you have questions about this policy or how we handle your data, contact: .

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you via the website or email.