Privacy Policy

Effective date: July 24, 2026  ·  Last updated: July 24, 2026  ·  Cottontail LLC (Washington State, USA)

Cottontail AAC is a mobile app that helps non-verbal children communicate. We built it for our own daughter, and we treat your child's data the way we'd want ours to be treated. This policy explains — in plain English — what we collect, what we don't, and why.

1. Who this policy covers

This policy applies to the Cottontail AAC mobile app on iOS and Android, and to the website at cottontailapp.com.

Cottontail is designed to be used by a non-verbal child under the supervision of a caregiver. The account is created and controlled by the caregiver (a parent, guardian, therapist, or teacher), not the child. All references to "you" in this policy refer to the caregiver who owns the account.

2. What information we collect

We collect the minimum necessary to run the app.

From caregivers (on our servers)

• Username you choose (may be a nickname; does not need to be a real name)
• Password (stored only as a one-way bcrypt hash — we cannot read it)
• Caregiver email address (used only for password/username recovery and account notices)
• Purchase status and tier (Free, Premium, Pro, or School)
• Timestamp the account was created

From caregivers (on our servers, only if you choose to sync)

• Favorites, custom cards, custom folders, and personal scripts created inside the Mine tab
• Voice preferences (pitch, rate, selected voice)
• Per-card customizations (rename, hide, replace image)
• For Pro and School accounts: child profile labels and caregiver notes entered into the Caregiver Dashboard (see Section 5A)

On your device only (never sent to us)

• Every card tap, every spoken sentence, every activity
• Usage history and search history
• Any photos you attach to custom cards — stored locally on the device, never uploaded to our servers or shared with any AI service

We do NOT collect

• Your child's real name, birthday, age, gender identity, or medical information
• Your location or GPS coordinates
• Your phone contacts or address book
• Microphone audio — Cottontail speaks out loud, it never listens
• Camera access, unless the caregiver explicitly attaches a photo to a card
• Analytics, telemetry, tracking pixels, or advertising identifiers of any kind
• Any behavioral data used for advertising or profiling

3. Why we collect what we do

• Username + password — so the caregiver can log back in
• Caregiver email — to recover a lost password or username, and to send required account or security notices
• Purchase status — to restore your unlock on a new device
• Favorites & custom cards — so your child's personalized vocabulary follows the account instead of being lost if a device breaks

We do not use any of this data for marketing, profiling, advertising, or resale.

4. Who we share data with

We share nothing except the strictly necessary technical hand-offs below. We do not sell, rent, or trade data with anyone.

• Apple App Store / Google Play Store — standard purchase receipts flow through Apple and Google when a caregiver buys a paid tier. Their own privacy policies apply to that transaction.
• RevenueCat (payment validator) — receives an anonymous internal user ID so we can verify a purchase was made. RevenueCat does not receive names, emails, or child data.
• Resend (transactional email) — if you use "Forgot Password" or "Forgot Username," Resend delivers the recovery email. Resend receives the caregiver email address only.
• YouTube / Google (Calm Videos playback only) — see Section 5B below.
• Cloud infrastructure — hosts our servers and stores the account data described above.

We will never share data with advertisers, data brokers, analytics companies, social networks, or generative-AI training providers.

5. Video and audio content in the Calm tab

The Calm tab includes several tools (breathing exercises, count-to-10, a draw-and-color canvas, a "pop it" sensory activity, Sing-Along, and Calm Videos). All of these run entirely on the device with no outside content, with one exception — Calm Videos — described below.

5A. Sing-Along — licensed audio, no third party involved

• Sing-Along plays a small set of licensed children's songs that are bundled directly into the app, along with matching picture cards the child can tap along with.
• These songs are not streamed from YouTube or any other outside service — they are stored on the device like any other app asset, so Sing-Along works fully offline and involves no third party and no data transmission of any kind.

5B. Calm Videos — third-party video content (YouTube)

• Calm Videos plays video through YouTube's privacy-enhanced, no-cookie embedded player (youtube-nocookie.com). A small default set of calming videos is chosen and reviewed by Cottontail LLC.
• The player is configured to block outbound links, related-video suggestions, comments, and any other way to navigate away from the selected video — the only interactive control available is the button to play it. Nothing else on YouTube is reachable from inside the app.
• Playing a video still connects the device to Google's servers to stream the video, which is subject to Google's own Privacy Policy and Terms of Service. We do not control, and do not receive, any data about what your child watches.
• Caregivers can edit this page and replace or add their own YouTube videos. Any video a caregiver adds is chosen and controlled entirely by that caregiver. Cottontail LLC does not review, endorse, or take responsibility for caregiver-added videos, and recommends previewing any video before assigning it to a child's device.

6. AI-generated content in the app

Some pictogram images used in Cottontail's Grid and other tabs were created using AI image-generation tools during development, before the app was ever installed by a family. This is a content-creation choice, not a data practice: no caregiver or child data, photos, or personal information is ever sent to an AI model by the app. Photos that a caregiver attaches to a custom card stay on the device and are never processed by any AI service.

7. Children's privacy (COPPA)

Cottontail is designed for use by children, but the account is created and managed by an adult caregiver. We do not knowingly collect any personal information directly from a child. We do not require, request, or store a child's real name, birthday, photograph, biometric data, or contact information. No child-directed advertising ever runs in the app, and the app contains no ads.

If you are a caregiver and believe we have inadvertently received information from a child, please email us at privacy@cottontailapp.com and we will delete it immediately.

8. Your rights

Regardless of where you live, you can:

• See everything we have about you — email us and we'll send it to you.
• Delete your account and all associated data at any time, directly from the app (Settings → Delete Account) or by emailing privacy@cottontailapp.com. Deletion is permanent and immediate.
• Correct any information by editing it in the app.
• Export your data — use Settings → Backup & Restore for a JSON copy, or email us.
• Opt out of email — you'll only ever receive password recovery and required account emails; we do not send marketing emails.

9. Security

• Passwords are stored using bcrypt one-way hashing.
• Data in transit is protected by TLS/HTTPS.
• We keep our infrastructure up to date and follow standard operational security practices.
• No system is perfect. In the unlikely event of a security incident affecting your account, we will notify you via the caregiver email on file, as required by applicable law.

10. Data retention

• Account data is retained as long as the account exists.
• Deleting the account permanently removes all associated data from our servers.
• Recovery-code entries (from "Forgot Password") automatically expire after 30 minutes.

11. International users

We are based in the United States. If you are using Cottontail from outside the US, your data will be transferred to and processed in the US. By using the app you consent to this transfer.

12. Changes to this policy

If we materially change this policy, we will notify caregivers by email and update the "Last updated" date at the top. Non-material changes (typo fixes, clarifications) may be made without notice.

13. Contact

• General support: support@cottontailapp.com
• Privacy requests: privacy@cottontailapp.com
• DMCA / copyright: dmca@cottontailapp.com
• Legal / arbitration opt-out: legal@cottontailapp.com

© 2026 Cottontail LLC. Cottontail AAC is a communication aid. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any medical condition.