Family learning data stays private and understandable.

Effective September 16, 2026

Fippo is operated for caregivers. Children do not create accounts, publish profiles, or enter contact information.

Information we collect

A caregiver account uses an email address and authentication identifiers. A caregiver may create up to four child profiles containing a nickname, age, appearance preference, interests, learning choices, activity progress, and child-created story choices. Billing providers process payment and tax information; Fippo receives subscription status and identifiers, not full card details.

Why we use it

We use this information to authenticate the caregiver, personalize an age-appropriate learning path, preserve separate progress for each child, synchronize devices, provide support, prevent abuse, and administer a requested family subscription. We do not sell personal information or show behavioral advertising in the child experience.

Parental consent

A verified caregiver must confirm adulthood or legal authority, authorize storage of the child-profile data they provide, and accept this policy and the Terms before cloud synchronization. Consent records include the policy version and acceptance time. A caregiver can withdraw consent by deleting family data and the account.

Storage and security

Learning remains available locally when offline. Signed-in changes are queued and sent over encrypted transport when connectivity returns. Family snapshots are encrypted at rest at the application layer and isolated by the caregiver's verified account. No system is perfectly secure; we maintain access controls, deletion tools, and operational safeguards to reduce risk.

Service providers and transfers

Fippo uses contracted providers for authentication, hosting, database infrastructure, and—only when activated—billing. These providers may process data in countries other than the caregiver's country under their contractual safeguards and applicable law.

Retention, export, and deletion

A caregiver can export family data and request deletion from the protected caregiver area. Local data is removed immediately; if offline, a durable deletion request removes the synchronized copy after reconnection. Limited security, legal, or transaction records may be retained where required by law.

Children's privacy

Fippo is designed for caregiver-directed use and data minimization. We do not knowingly ask a child for an email address, phone number, precise location, contacts, public profile, or open-chat content. If you believe a child's information was provided without valid permission, contact us so it can be removed.

Your choices and contact

Caregivers may inspect, correct, export, or delete family information from Fippo. Questions and privacy requests can be sent through the contact page. We may update this policy and will present a new consent request when a material change affects child-profile processing.