Privacy policy

Last updated October 7, 2026 · Version 2026-10

Tumbly is made by Winding AI Inc., doing business as Winding Labs ("we", "us"). We build apps for children, so we collect as little as we can, never show ads, and never sell or share personal information for advertising. This policy covers the Tumbly apps (iOS, Android and web), the back-seat screen at tumbly.ai/t, and the tumbly.ai website.

Parents: please also read our Children's Privacy Notice, which is the COPPA "direct notice" describing exactly what we collect from kids and the choices you have.

Contents

1. Who this covers
2. What we collect
3. How we use it
4. Live AI features
5. Service providers
6. When we disclose information
7. How long we keep data
8. Your rights and choices
9. Analytics and cookies
10. Security
11. California, EU and UK
12. Changes and contact

1. Who this covers

Tumbly is for families with children roughly 3 to 12. Accounts are for adults only. When the app is first opened it starts as an anonymous guest so a parent can try it; a guest has no name or email. A parent (or legal guardian) signs up with Apple, Google or an emailed code, agrees to this policy, and gives consent for their children to use Tumbly. Children use Tumbly only through a profile the parent creates.

We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule. Section 2 explains what we collect and section 8 explains a parent's rights.

2. What we collect

From parents

• Account: email address; if you use Sign in with Apple or Google, the name and email they share (Apple lets you hide your email). A record of when you gave consent and which version of this policy you agreed to.
• Optional parent PIN, stored only as a one-way hash.
• Purchases: plan, status and renewal date from Apple, Google or Stripe. We never see your full card number.
• Messages you send to support or privacy requests.
• "Notify me" email if you leave one on our website.

About kids (entered by the parent)

• A nickname (up to 20 characters; we ask you not to use a full name), an avatar, a companion character, and an age range (3–5, 6–8 or 9–12). No birthdays, photos, school or contact details.

Collected while kids play

• Location (RoadStory, only if a parent allows it): the device's location while a trip is running, used on the device to start the story for the place you're passing. Our servers receive a rounded location (about 5 km) to find stories for the area, and the location at the moment a "Tell me about here" story or a question is requested. We don't store a trail of where you drove. RoadStory works without location using the simulated drive.
• Voice questions (only if a parent allows it): while someone holds the "ask" button, audio is recorded and sent to our speech-to-text provider, turned into text, answered, and then the recording and the text are deleted. See section 4.
• Activity: which stories were played and finished, quiz answers, island items earned, and topics a kid seems to like (based on the stories they finish, not on what they say). This is what lets the app remember progress.
• Device and technical data: device type, operating system, app version, an app-generated ID for the household and each kid profile, and the IP address and browser details of your session (used for security and kept only while the session is active).
• Back-seat screen: a 4-digit room code that pairs a screen to the phone for one trip. The screen shows what the phone is playing; nothing typed or said on it is stored.

Kids can't create accounts, chat with other people, post anything publicly, upload photos, or share their information with anyone through Tumbly.

3. How we use information

• To run Tumbly: play stories, answer questions, save progress, sync the back-seat screen, sign you in and manage your plan.
• To improve Tumbly: measure which features families use, using our own product analytics (see section 9).
• To keep Tumbly safe and working: prevent abuse, debug problems, enforce limits, and comply with law.
• To contact parents about the account, purchases and important changes. Marketing emails go only to parents who ask for them, and every one has an unsubscribe link.

We do not use anyone's information for advertising, build advertising profiles, sell personal information, "share" it for cross-context behavioral advertising, or use kids' information to train AI models (ours or anyone else's).

4. Live AI features

RoadStory has two optional live AI features that a parent can turn off: Ask (hold to ask a question out loud) and Tell me about here (a new story about the current location). When they're used:

• The audio goes to ElevenLabs to be transcribed. We tell our providers not to keep it and not to train on it, and we don't store it.
• The question text, the story that's playing and a rounded location go to an AI model (Anthropic Claude or Google Gemini, through OpenRouter) to write a short, kid-safe answer. We never send a kid's nickname, a parent's email or any account ID.
• Answers are filtered for kid-appropriateness before they're spoken. If a question isn't appropriate, the narrator gently changes the subject.
• We keep only a count of questions asked (for the daily limit) and timing data. We do not keep the question, and Tumbly has no long-term "memory" of what a child said.
• Answer audio is cached for up to 24 hours so it can replay, then deleted.

AI can make mistakes. Our hand-written and generated stories are fact-checked against sources before they're published, and you can report a mistake to support@tumbly.ai.

5. Service providers

We use these companies to run Tumbly. Each processes data only on our instructions and under a contract that limits use to providing the service to us. None may use kids' information for advertising or their own purposes.

6. When we disclose information

Besides the service providers above, we disclose personal information only: if required by law or valid legal process; to protect the safety of a child or anyone else, or the security of Tumbly; or as part of a merger, acquisition or sale of assets, in which case the buyer must honor this policy for information it receives. We will never disclose a child's information to a third party for advertising or any other purpose without a parent's separate, specific consent, and declining that consent never limits your child's use of Tumbly.

7. How long we keep data

We keep personal information only as long as needed for the purpose we collected it, then delete it. This is our written data retention policy:

We don't keep children's personal information indefinitely.

8. Your rights and choices

• Review and change: see and edit kid profiles in the grown-up area of the app (behind the parent check).
• Get a copy: request a copy of your family's data at tumbly.ai/data-request.
• Delete: delete a kid profile or the whole account in the app, or see how to delete your account.
• Withdraw consent: you can stop further collection from your child at any time by turning off a feature, deleting their profile, or emailing us. You can consent to us collecting and using your child's information without consenting to disclosure to third parties.
• Turn features off: live AI questions, "Tell me about here", generated stories and location can be switched off in the grown-up area or in your device settings. See the parents' guide.
• Marketing: unsubscribe from any marketing email.

We'll respond within 45 days (or sooner if the law where you live requires) and will verify that you are the parent on the account before releasing or deleting data.

9. Analytics and cookies

Inside the apps we don't use advertising identifiers (IDFA or Android advertising ID), we don't track you across other companies' apps or websites, and we don't use third-party analytics or ad SDKs in the parts kids use. App analytics go through our own servers to PostHog; kid events have no IP address or location. On our website we use first-party cookies and, if you haven't turned on Do Not Track or Global Privacy Control, PostHog and Google Analytics. See our cookie notice.

10. Security

We keep a written information security program, reviewed at least once a year, with a named person responsible for it. It includes encryption in transit, hashed sign-in codes, PINs and session tokens, least-privilege staff access with two-factor authentication, vendor security review, and an incident response plan. No system is perfect; if a breach affects your information we'll notify you and regulators as the law requires.

11. California, EU and UK

California: California residents have the right to know, access, correct and delete personal information and to limit use of sensitive personal information. We don't sell or share personal information (as those terms are defined in the CCPA), including of consumers under 16, and we honor Global Privacy Control. We use precise geolocation only to provide the service you asked for. Use tumbly.ai/data-request; we won't treat you differently for exercising your rights.

EU, EEA and UK: Winding AI Inc. is the controller. Our legal bases are: performance of our contract with the parent; consent of the parent (location, microphone, live AI) which you can withdraw at any time; and legitimate interests in securing and improving Tumbly, with the best interests of the child taken into account. Features are off or set to the most private option by default for kids. You have rights to access, rectify, erase, restrict, port and object, and to complain to your data protection authority. Data is processed in the United States under Standard Contractual Clauses or the EU–U.S. Data Privacy Framework where our providers are certified.

12. Changes and contact

We'll post changes here, update the date and version above, and email parents about material changes. If a change affects how we collect, use or disclose children's information, we'll ask for a parent's consent again before it applies to your child.

Winding AI Inc. (Winding Labs) · Mill Valley, California, USA · privacy@tumbly.ai