Privacy Policy for StreamBook

Owner / Operator: Blue Hexagon LLC
Effective Date: June 21 2025
Last Updated: June 21 2025

Introduction

StreamBook (the "App") is an interactive reading application designed for children. This Privacy Policy explains in plain language how Blue Hexagon LLC ("Blue Hexagon," "we," "us," or "our") collects, uses, discloses, and protects information in compliance with:

The U.S. Children's Online Privacy Protection Act (COPPA)
The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
Article 8 of the EU and UK General Data Protection Regulation (GDPR)
Apple App Store Review Guidelines (Kids Category) and Google Play Families Policy

We do not condition a child's use of the App on providing more personal information than is reasonably necessary. We never sell or rent personal information.

1 Definitions

Child / Children – an individual under 13 years of age (or the higher age of digital consent in your region).
Parent – a parent or legal guardian who registers for and manages a StreamBook account.
Personal Information – information that can reasonably be used to identify or contact a Child or Parent.

2 Information We Collect (DIRECT NOTICE TO PARENTS — COPPA § 312.4(c))

We collect only what we need to run, secure, and personalize the App:

Account Information (Parent)

Parent's email address – used for account creation, login, password reset, and mandatory legal notices.

Child Profile

Child's age (in years only) and preferred illustration styles – used to select age-appropriate reading level and artwork.

Parental Consent Record

Date and time consent was given, result of the parental-gate quiz, and a hashed version of the policy accepted.

Device & Usage Data (auto-collected by Google Firebase)

Truncated IP address, device model, operating-system version, and anonymous in-app events – used solely for security, crash reporting, and service delivery.

We do not collect the child's real name, exact birthdate, home address, phone number, precise location, advertising identifier, contacts, photos, or any data that tracks a child across other apps or websites.

3 How We Obtain Verifiable Parental Consent

We display this Privacy Policy and a concise "just-in-time" notice.
The Parent completes a simple arithmetic + reading-comprehension quiz (parental gate).
The Parent verifies a valid email address by clicking a link we send.
Parents can withdraw consent at any time from the Parent Dashboard; doing so disables the account and schedules deletion of all child data.

4 How We Use Information

Operate, maintain, and secure the StreamBook service
Personalize stories (text difficulty, vocabulary, art style)
Provide the password-protected Parent Dashboard and reading statistics
Generate aggregate, de-identified analytics to improve quality and accessibility
Comply with legal obligations and protect the rights, property, or safety of Blue Hexagon, our users, or others

No Third-Party Advertising: StreamBook contains no ads or cross-app trackers.

5 Disclosure of Information

We disclose Personal Information only in these limited circumstances:

Google Firebase – Provides authentication, database, and crash reporting. Data is stored on Google Cloud servers in the United States under a Data Processing Addendum that includes Standard Contractual Clauses where required.
Microsoft Azure Cognitive Services – Generates text-to-speech audio. Story text is processed transiently (typically under one minute) and is not stored.
Legal or Safety Authorities – If legally compelled (e.g., subpoena), and only after validating the request. Parents are notified unless prohibited by law.
Business Transfer – If Blue Hexagon is involved in a merger, acquisition, or asset sale, the successor entity must honor this Privacy Policy. Parents will be notified in advance and may delete data before the transfer.

We do not share data with social networks, advertisers, or analytics vendors.

6 Data Retention & Deletion

Data is retained while the Parent account remains active.

Parents may delete the account at any time from the Parent Dashboard; this permanently erases data from production databases within 30 days and from backups within an additional 30 days.

If an account is inactive for 24 months, we email a reminder. If there is no response within 60 days, all data is deleted.

7 Parental and Data-Subject Rights

Parents may, at any time:

Review the Personal Information we hold
Correct inaccurate information
Delete the child's data or the entire account
Withdraw consent and block future data collection
Receive a portable copy of the child's Personal Information (where GDPR applies)
Object to or restrict certain processing (where GDPR applies)

Requests can be made through the Parent Dashboard or by emailing teambluehexagon@gmail.com.

8 Security Measures

We apply reasonable administrative, technical, and physical safeguards, including:

TLS 1.3 encryption in transit
AES-256 encryption at rest (Firebase default)
Multi-factor authentication and role-based access controls for staff
Regular security testing and dependency scans
Vendor due-diligence and Data Processing Agreements

9 International Data Transfers

StreamBook servers are located in the United States. For users in the EEA or UK, we rely on Standard Contractual Clauses and additional safeguards. By creating an account, Parents acknowledge the transfer and processing of data in the U.S.

10 Children's Privacy Statement

The App is directed to children under 13 but can only be activated by a verified Parent. If we learn that a child has provided data without parental consent, we delete that data promptly and suspend the account until consent is obtained.

11 Links to External Sites

StreamBook does not include external links accessible to children. Any future Parent-oriented links will be protected behind the parental gate and governed by their own privacy policies.

12 Changes to This Policy

If we make material changes, we will email Parents at least 30 days before the new policy takes effect and obtain new consent where required.

13 Contact

Blue Hexagon LLC
1048 Union Street, Suite 300
San Francisco, CA 94133 USA
Email: teambluehexagon@gmail.com
Phone: +1 (415) 714-2035

You may also contact our Data Protection Officer at the email above.

Supplemental "App Store Privacy Details"

Data Collected: Parent email; usage data (crash logs, diagnostics); child's age and style preferences.
Purpose: App functionality, basic analytics, account management.
Tracking: Off — we do not link data to advertising or third-party identifiers.
Data Linked to You: Parent email address.
Data Not Collected: Contacts, search history, location, identifiers, purchases, photos, health, fitness, financial information.