FFMPA / Privacy policy
Privacy policy
Draft for legal review. Items in square brackets must be confirmed by Founderfreedom Ventures LLP and its counsel before launch.
In short: we collect the least we can. A grown-up's email, a child's first name or nickname (optional), a reading level, a country and preferences. No personalised or targeted ads, no selling of data, no tracking across other sites, no profiling of children, no photos of your child and no precise location.
1. Who we are
FFMPA (ffmpa.com) is operated by Founderfreedom Ventures LLP, a limited liability partnership registered in India, based in Bangalore, India ("we", "us"). We are the data fiduciary (India) and data controller (UK and EU) for personal data processed through FFMPA.
2. Who FFMPA is for
FFMPA is a news service for children aged 5 to 15, used under the account and supervision of a parent or legal guardian aged 18 or over. Accounts can only be created by an adult. Children cannot create accounts or sign in on their own.
3. What we collect and why
| Data | From | Why |
|---|---|---|
| Parent or guardian email address | Parent | Sign in by one-time code, account security, essential service messages |
| Child's first name or nickname (optional) | Parent | Personal greeting on the home screen |
| Reading level, country, topic choices, limits, PIN (stored as a secure hash) | Parent | Showing the right edition and keeping parent controls in place |
| Stories read, saved words, quiz scores | Use of the service | Reading goal, word bank and progress for the child |
| Basic technical data (device type, app version, error logs) | Automatically | Keeping the service working and secure |
We do not collect a child's surname, date of birth, school, photo, voice recording, contact details or precise location. Read aloud uses the speech feature built into your device; no audio is sent to us.
4. Parental consent
Before any child profile is created, the parent or guardian verifies their email address with a one-time code and confirms that they are the child's parent or guardian. This is how we obtain verifiable consent as required by the Digital Personal Data Protection Act, 2023 (India), the Children's Online Privacy Protection Act (United States) and UK data protection law. The DPDP Rules, 2025 set out how a parent's identity and adult status must be verified, with the child data provisions due to apply from May 2027; we will add any extra verification step they require before then. [Counsel to confirm the method for each launch country.]
5. What we never do
- We never use children's data for advertising. Any sponsor card is chosen by our team, labelled Sponsored, and shown the same way to every child in a country. If we ever use an outside ad partner, it receives no personal data and must use child-directed settings.
- We never track children's behaviour across other websites or apps, or build profiles about them.
- We never sell or rent personal data.
6. Who we share data with
When a child shares a story, only a public link to that story is shared; no personal data goes with it. Otherwise we share data only with service providers who help us run FFMPA, namely Supabase (database), Google Cloud (hosting) and Resend (sign-in emails), under written contracts that require them to protect the data and use it only for us. [List of providers to be published.] We may disclose data if the law requires it.
7. Where data is stored
Data is stored on servers in [region, for example Google Cloud and Supabase in Mumbai, India]. Where data is transferred across borders, we use the safeguards required by applicable law.
8. How long we keep it
Account data is kept while the account is active and deleted within [30] days after the account is closed. Security logs are kept for up to [90] days.
9. Your rights
A parent or guardian can at any time access, correct or delete their own and their child's data, withdraw consent (which closes the child profile), and nominate another person to exercise these rights. Write to [privacy@ffmpa.com]. You can also complain to the Data Protection Board of India, the UK Information Commissioner's Office, or the US Federal Trade Commission.
10. Security
We use encryption in transit, hashed PINs, one-time sign-in codes that expire after 10 minutes, and strict access controls for our team.
11. Grievance Officer
[Name], Grievance Officer, Founderfreedom Ventures LLP, Bangalore, India. Email: [grievance@ffmpa.com]. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.
12. Changes
If we change this policy in a way that affects how we use data, we will email the account holder before the change takes effect. Last updated: [date].