Privacy Policy

Effective date: July 18, 2026 · Last updated: July 18, 2026

Cottontail AAC is a mobile app that helps non-verbal children communicate. We built it for our own daughter, and we treat your child's data the way we'd want ours to be treated. This policy explains — in plain English — what we collect, what we don't, and why.

Short version:

Almost everything your child does in Cottontail stays on their device.
We do not sell data. We do not run ads. Ever.
The only personal information stored on our servers is the caregiver's email address (for password recovery), a hashed password, and the customizations you choose to sync. That's it.

1. Who this policy covers

This policy applies to the Cottontail AAC mobile app on iOS and Android, and to the website at cottontailapp.com.

Cottontail is designed to be used by a non-verbal child under the supervision of a caregiver. The account is created and controlled by the caregiver (a parent, guardian, therapist, or teacher), not the child. All references to "you" in this policy refer to the caregiver who owns the account.

2. What information we collect

We collect the minimum necessary to run the app.

From caregivers (on our servers)

Username you choose (may be a nickname; does not need to be a real name)
Password (stored only as a one-way cryptographic hash — we cannot read it)
Caregiver email address (used only for password/username recovery)
Purchase status (whether you've unlocked the $29.99 Lifetime Unlock)
Timestamp the account was created

From caregivers (on our servers, only if used)

Favorites, custom cards, custom folders, and personal scripts created inside the Mine tab
Voice preferences (pitch, rate)
Per-card customizations (rename, hide, replace image)

On your device only (never sent to us)

Every card tap, every spoken sentence, every activity
Usage history and search history
Any photos you attach to custom cards (stored locally on the device)

We do NOT collect

Your child's real name, birthday, age, gender identity, or medical information
Your location or GPS coordinates
Your phone contacts or address book
Microphone audio (Cottontail speaks out loud — it never listens)
Camera access, unless the caregiver explicitly attaches a photo to a card
Analytics, telemetry, tracking pixels, or advertising identifiers of any kind
Any behavioral data used for advertising or profiling

3. Why we collect what we do

Data	Reason
Username + password	To let the caregiver log back in
Caregiver email	To recover a lost password or username
Purchase status	To restore the Lifetime Unlock on a new device
Favorites & custom cards	So your child's personalized vocabulary follows the account (not lost when a device breaks)

We do not use any of this data for marketing, profiling, advertising, or resale.

We share nothing except the strictly necessary technical hand-offs below. We do not sell, rent, or trade data with anyone.

Apple App Store / Google Play Store: standard purchase receipts flow through Apple and Google when a caregiver buys the Lifetime Unlock. Their privacy policies apply to that transaction.
RevenueCat (payment validator): receives an anonymous internal user ID so we can verify a purchase was made. RevenueCat does not receive names, emails, or child data.
Resend (transactional email): if you use "Forgot Password" or "Forgot Username," Resend delivers the recovery email. Resend receives the caregiver email address only.
Cloud infrastructure: hosts our servers and stores the account data described above.

We will never share data with advertisers, data brokers, analytics companies, social networks, or generative-AI training providers.

5. Children's privacy (COPPA)

Cottontail is designed for use by children, but the account is created and managed by an adult caregiver. We do not knowingly collect any personal information directly from a child. We do not require, request, or store a child's real name, birthday, photograph, biometric data, or contact information. No child-directed advertising ever runs in the app.

If you are a caregiver and believe we have inadvertently received information from a child, please email us at privacy@cottontailapp.com and we will delete it immediately.

6. Your rights

Regardless of where you live, you can:

See everything we have about you — email us and we'll send it to you.
Delete your account and all associated data at any time, directly from the app (Settings → Delete Account) or by emailing privacy@cottontailapp.com. Deletion is permanent and immediate.
Correct any information by editing it in the app.
Export your data — email us and we'll send you a JSON copy.
Opt out of email: you'll only ever receive password recovery emails; we do not send marketing emails.

7. Security

Passwords are stored using bcrypt one-way hashing.
Data in transit is protected by TLS/HTTPS.
We keep our infrastructure up to date and follow standard operational security practices.
No system is perfect. In the unlikely event of a security incident affecting your account, we will notify you via the caregiver email on file, as required by applicable law.

8. Data retention

Account data is retained as long as the account exists.
Deleting the account permanently removes all associated data from our servers.
Recovery-code entries (from "Forgot Password") automatically expire after 30 minutes.

9. International users

We are based in the United States. If you are using Cottontail from outside the US, your data will be transferred to and processed in the US. By using the app you consent to this transfer.

10. Changes to this policy

If we materially change this policy, we will notify caregivers by email and update the "Last updated" date at the top. Non-material changes (typo fixes, clarifications) may be made without notice.

11. Contact

Questions, requests, complaints? Please email privacy@cottontailapp.com.

For general support: support@cottontailapp.com