Whisklings Privacy Policy

Whisklings is a recipe app for kids ages 4 to 14. A parent or guardian creates the account and sets up a profile for each child, and the kids use those profiles to browse recipes and cook step by step. Because Whisklings is made for children, this policy explains in plain language what we collect about you and your children, what we do with it, and the choices you have. It is written with the U.S. Children's Online Privacy Protection Act (COPPA) in mind.

This is a standalone policy for Whisklings. It covers the Whisklings website and web app. It does not cover other Miltinson Technologies products, which have their own policies.

1. Who runs Whisklings

Whisklings is operated by Miltinson Technologies LLC, a Washington limited liability company ("Miltinson," "we," "us"). We are the only operator collecting or keeping personal information through Whisklings. Parents can reach us with any question about this policy or their child's information here:

2. The short version

• A parent or guardian creates the account and confirms they are 18 or older. Kids use the profiles you set up and do not get their own logins.
• For each child, we store only what you type in: a first name or nickname, an age group (4–7, 8–11, or 12–14), and an emoji avatar.
• Adding, changing, or deleting a child profile needs your account password, so a child using your device cannot do it.
• We do not ask for a child's birthday, last name, photo, voice, location, school, contact details, or any health, allergy, or dietary information.
• Kids cannot post, chat, upload, or share anything. There are no comments and no other users to meet.
• We do not show ads, we do not use analytics or tracking tools, and we do not sell or share anyone's information for advertising.
• You can see, change, and delete your children's profiles at any time on the Child Profiles page. To delete your whole account, email us.

3. What we collect

From you, the parent or guardian

• Email address and password, when you create an account. Your password passes through our servers over an encrypted connection to our sign-in provider (see section 6), which stores it in hashed form. We do not store your password.
• Messages you send us, such as a request to delete your account.

About your child, entered by you

When you add a child on the Child Profiles page (open it with Manage profiles on the profile picker), we store:

• First name or nickname: whatever you type. The form asks you not to use a full name, and Whisklings does not need one.
• Age group: 4–7, 8–11, or 12–14. We do not ask for an exact age or birth date.
• Avatar: one of our built-in emoji characters. There are no photos.
• Behind the scenes: a random profile ID, the date the profile was created, and a link to your account so that only you can see it.

From your child, while they use Whisklings

Children do not type in, upload, or send us any information. A child picks their profile on a device where you are already signed in, then browses and cooks recipes. We do not save a record of which recipes a child looks at, starts, or finishes.

Like any website, each time Whisklings loads a page or recipe, the device sends technical information along with the request. This happens whether a parent or a child is using the app, and is described next.

Collected automatically

• IP address and browser or device details (such as browser type and operating system), sent with every request. Our hosting provider processes these to deliver pages and keeps them in server logs for a limited time. Sign-in requests reach our sign-in provider through our servers, so it records browser details with each sign-in session along with our servers' IP address, not your device's.
• Sign-in cookie: keeps the account signed in on that device. It is required for the app to work.
• Parent unlock cookie: after you re-enter your password on the Child Profiles page, a cookie keeps that page unlocked for up to 10 minutes. It closes when you leave the page or sign out.
• On-device storage: the app remembers which child profile was last picked on that device by saving the profile's random ID (not the child's name) in the browser. This is cleared when you sign out. The app also saves copies of pages, icons, and images in the browser so it loads faster. You can clear these in your browser settings.

We use these identifiers only to run Whisklings: to deliver pages, keep you signed in, protect the Child Profiles page, and keep the service secure. We do not use them to show ads, build profiles, or track anyone across other websites. We do not use advertising or analytics cookies.

What we do not collect

We do not collect a child's last name, birth date, photos, video, voice recordings, precise location, address, phone number, email address, school, or any health, medical, allergy, or dietary information. We do not collect information from your contacts, camera, or microphone.

4. How we use information

• To create and run your account and keep you signed in.
• To show your child's profile and, using the age group, to show only recipes written for that age group or a younger one.
• To keep Whisklings secure and working, and to prevent misuse.
• To answer your requests and questions.
• To meet legal obligations.

We do not use any information, including technical information such as IP addresses, to show ads, build profiles of children, or market to children. We do not send marketing email.

5. Children’s privacy

Only parents give us information about children

Whisklings is set up so that a parent, not a child, provides all information about a child:

• Sign-up is for adults. To create an account, you must tick a box confirming that you are 18 or older and the parent or legal guardian of any child who will use Whisklings. The account cannot be created without it. Before you sign up, we show a short notice explaining what we collect about your child and why.
• Child profiles are behind a parent gate. Adding, changing, or deleting a child profile requires re-entering the account password. The page stays unlocked for up to 10 minutes and locks again when you leave it or sign out.
• Children only pick a profile and cook. They cannot type in, upload, post, or share anything, and we do not ask a child for any information.

We do not verify identity documents or payment details. If you believe a child has created an account, or that we have information about a child without a parent's permission, contact us at contact@miltinson-technologies.com and we will delete it.

No disclosure to third parties

We do not give children's information to any third party for its own use, for advertising, or for any purpose other than running Whisklings. Because we never do this, we never ask you for a separate consent to it. The service providers in section 6 handle information only to run Whisklings for us.

Your rights as a parent

You can, at any time:

• Review the information we have about your child. Profiles are listed on the Child Profiles page. You can also ask us for a copy of everything we hold about your account and your children.
• Correct it. Change a child's first name or nickname, age group, or avatar on the Child Profiles page.
• Delete it. Delete a child's profile on the Child Profiles page, or ask us to delete your whole account and every child profile on it.
• Refuse further collection or use. Delete the profile or ask us to delete the account. Your child will no longer be able to use Whisklings under that account.

How to make a request

To ask for a copy, to delete your account, or for anything you cannot do in the app, email contact@miltinson-technologies.com from the email address on the account, call (425) 470-3556, or write to us at the address in section 1. Before we share or delete account information, we confirm that the request comes from the account holder. We respond within 45 days. If we turn down a request, you can appeal by replying to our answer, and we will respond to the appeal within 45 days.

6. Who we share information with

We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising. We do not let any third party collect information from children through Whisklings for its own purposes. We share information only with these service providers, which run Whisklings for us, and only so they can provide that service:

• Vercel hosts the Whisklings website and app. It processes every request, including IP address, browser details, and the pages and recipes requested, and it runs the code that reads and saves account and profile information.
• Neon provides our database and our sign-in service. It stores your email address, password, sign-in sessions (with browser details and our servers' IP address), and your children's profiles. If email confirmation is turned on, it also sends the confirmation email.
• Recipe photos. If a recipe has a photo stored on another website, our hosting provider fetches it for you, so that website never receives your device's IP address or browser details.

We may also disclose information:

• If the law requires it, or to protect the safety of a child or anyone else.
• If Miltinson Technologies LLC is involved in a merger, acquisition, or sale of assets. Any new operator must keep protecting children's information as this policy describes, and we will tell account holders before that happens.

7. How long we keep information

This is our data retention policy. We keep each kind of information only as long as Whisklings needs it, then delete it:

• Your email address, password, and child profiles: kept while your account is open, because they are what the account is. Deleted when you delete a profile on the Child Profiles page (straight away), or when you ask us to delete your account (within 45 days of confirming the request). We delete the child profiles first and then the account itself.
• Sign-in sessions: kept with the account so we can keep you signed in and spot misuse. Deleted with the account.
• Database backups: our database provider keeps a rolling recovery history, currently 6 hours, so we can recover from a failure. Deleted information drops out of it within that window. We do not restore deleted profiles except to recover from a failure.
• Server logs: kept by our hosting provider for the limited period its service sets, for operations and security, and then deleted automatically.
• Messages you send us: kept as long as we need them to handle your request and show that we did, then deleted.
• Information on your device: the parent unlock cookie expires within 10 minutes; the sign-in cookie and the last-picked profile are cleared when you sign out; cached pages stay until you clear your browser data.

We do not keep children's information indefinitely.

8. How we protect information

We keep a written information security program for Whisklings. It names the person responsible, lists the risks we look for and the safeguards we use, and is reviewed at least once a year. Our safeguards include:

• All traffic to Whisklings is encrypted with HTTPS.
• Passwords are stored in hashed form by our sign-in provider. We do not store them.
• The database can only be reached from our own servers, never directly from a browser. Every request is checked against the signed-in account, so a family's profiles are only shown to that family's account.
• Changes to child profiles need the parent gate described in section 5.
• Access to the systems that hold personal information is limited to the people who run Whisklings.

We use reasonable safeguards, but no system is perfectly secure. If we learn of a breach affecting your information, we will notify you as the law requires.

9. Your privacy rights

Wherever you live, you can ask us to tell you what personal information we have about you, give you a copy of it, correct it, or delete it. Make a request as described in section 5. We respond within 45 days, and you can appeal a decision by replying to it. We will not treat you differently for making a request.

Whisklings does not collect consumer health data, including allergy or dietary information, as defined by Washington's My Health My Data Act.

10. Do Not Track and Global Privacy Control

Whisklings does not track visitors across other websites or services, so there is nothing for a Do Not Track signal to turn off. We do not change what we do when a browser sends one.

We do not sell or share personal information, so every visitor is already opted out. We treat a Global Privacy Control signal as a request to opt out, and it is honored by default.

11. Where information is processed

Whisklings is run from the United States. Our database is in the United States, and pages may be delivered from our hosting provider's servers nearest to you. If you use Whisklings from outside the United States, your information will be transferred to the United States.

12. Changes to this policy

When we change this policy, we will update the date at the top. If we make a material change to how we collect, use, or share children's information, we will email account holders before the change takes effect and ask for consent where the law requires it.

13. Contact us

Questions about this policy or your child's information:

See also the Whisklings Terms of Use.