Daybreak — Privacy Policy
Draft for legal review. Not in force.
Effective: [DATE] · Version 1
Daybreak is operated by Parse Labs Ltd, a company registered in England and Wales (company number [NUMBER]), registered office [ADDRESS]. Parse Labs Ltd is the data controller for the information described here.
Contact for anything in this policy: [privacy@atdaybreak.news]
The short version
Daybreak is a daily newspaper for children aged nine to eleven. An adult sets up the account. We keep as little as we can, we keep it in Britain, and we do not sell it, share it or advertise to your child.
There is no third-party analytics in this app and no advertising of any kind. Your child's information is not sent to anyone whose business is knowing about your child.
Who holds the account
An adult creates the household. Children do not have their own accounts, do not sign in, and cannot set anything up.
We use Sign in with Apple, which means:
- We never see or store a password.
- We do not collect an email address. Apple gives us an identifier for your Apple account and nothing else. There is no email address anywhere in Daybreak, which is why recovering a forgotten passcode is done by signing in with Apple again rather than by email.
- Apple's own sign-in token is checked once and thrown away. Nothing in our database could hold it.
What we hold about a child
For each child profile the adult creates:
| What | Why |
|---|---|
| First name | So the child can find their own profile |
| Year of birth — the year only, never a date — or an age range declared through Apple. Never a birth date worked out from a range | To show writing at the right reading level |
| Chosen topics | To order the paper the way they like it |
| Whether harder news is allowed, and whether Pip is switched on | An adult's settings, applied to what is shown |
| Pip messages — only if an adult has separately switched Pip on | To answer a question about the story just read |
| A profile revision number and an operation identifier for each change | So a change made on one iPad reaches another, and a retried change is not applied twice. Not analytics, and never used to build a picture of a child |
| A record of stories opened: the issue date, when it was opened, whether it was finished, and how many times it was returned to | So the child can see what they have read, and so an adult can see it too |
That is the complete list. We do not collect a surname, an email address, a device fingerprint, where they are, photographs or drawings. We do not collect how long a child spends on a page, and we do not collect how long they listen for. Apart from Pip, where it is switched on, there is nothing in Daybreak a child can type into.
What we hold about the adult
The identifier Apple gives us, the household passcode (stored so it cannot be read back), and the times the account was created and last used.
Where it is held, and for how long
Everything is stored in Google Cloud in London. It does not leave the United Kingdom in the ordinary course of running the service.
The iPad also keeps its own copy of the profiles, the adult's settings and the reading record for the household signed in on it, so that the paper works without an internet connection. That copy belongs to the account and is cleared when the account is deleted or signed out.
- Reading records are deleted after 30 days. The same 30 days applies to the copy held on the iPad, so the two agree.
- Everything else is kept until the account is deleted.
Who else is involved
We use these companies to run the service. None of them is given your child's information to use for their own purposes.
| Who | What they do |
|---|---|
| Apple | Sign in with Apple, and the App Store |
| Google Cloud (London) | Hosts the service and the database |
| Cloudflare | Delivers the paper and its pictures and recordings |
Google's speech and language services are used to make the newspaper. They are not given anything about your child.
There is no analytics company, no advertising network, and no tracking of any kind in this app.
Deleting everything
An adult can delete the account from inside the app. When they do:
- Every child profile, every reading record and the account itself are erased.
- We ask Apple to revoke the sign-in, so the connection between your Apple account and Daybreak is broken at Apple's end too.
- The copies held on the iPad are cleared.
Deleting requires signing in with Apple again first, so that only the person who owns the account can do it.
Your rights
You can ask us to show you what we hold, correct it, delete it, or stop using it, and you can ask for a copy in a portable form. Write to [privacy@atdaybreak.news] and we will answer within one month.
If you are not satisfied you can complain to the Information Commissioner's Office, ico.org.uk, 0303 123 1113.
Why we are allowed to hold it
We rely on consent, given by the adult who sets up the household. Children under 13 cannot give that consent themselves under UK law, which is why the account belongs to an adult and the child never sets anything up.
You can withdraw consent at any time by deleting the account.
Children's privacy
Daybreak is made for children and is designed around the ICO's Age Appropriate Design Code. In practice that means:
- The smallest amount of information that makes the paper work.
- No profiling, no recommendations built from behaviour, and nothing designed to keep a child using the app longer.
- A child is told, in the app and in their own words, that an adult in their household can see which stories they have read. They are not tracked without knowing it.
- No links out of the app, and nothing to buy, anywhere a child can reach.
Changes
If we change this policy we will say so in the app before the change takes effect. We will not make a change that reduces your protection and apply it to information we already hold without asking you first.