Legal
Privacy Policy
Effective: August 27, 2026
This policy explains what Zoomies collects, why, how long we keep it, and who else touches it. We keep it short and specific on purpose — if anything here is unclear, email us and we'll explain it in plain language.
The operator ("we," and the controller under GDPR) is Felix Deffke, Germany — hello@offline-kids.com.
The short version
- We never store a child's name, birthdate, photo, or address. The only thing we hold about a child is an age range like "3–5".
- We do not sell or share your personal information, and we never hand individual records to advertisers or data brokers.
- We set no advertising or analytics cookies.
- You can get a copy of your data, or have it deleted, by emailing us.
What we collect
Browsing without an account
On your first visit your browser generates a random anonymous ID and we store that ID on our servers as an empty placeholder record. It contains no name, no email, and nothing about you — its only job is to give your saved activities somewhere to belong if you later create an account, so nothing you did before signing up is lost. If you never sign up, that record never gains any personal detail.
The activities you save and the ones you mark as "worked" or "not for us" are kept in your browser. When you mark an activity, we also record which activity and which outcome against your anonymous ID on our servers, so we can show honest aggregate signals like "this worked for most families".
With an account
- Your email address and a display name.
- An age range per child — one of 0–2, 3–5, 6–8, or 9–12. Nothing else. There is no field anywhere in the Service for a child's name, birthdate, photo, or voice.
- Which activities you saved or marked done, and your streak.
Gift lists
If you create a gift list, we store the occasion, an optional date, an optional budget range, and the items you add (title, image, price, and the product link). Each list gets a private link with a long, unguessable address. We do not list it anywhere and we tell search engines not to index it — but anyone you send the link to can open it, so share it only with people you want to see it.
When a guest reserves an item, we store a random token in a cookie on that guest's device (name: offlinekids:claim_token, kept for one year) so their own browser can recognise the reservation. It contains no name or email. Reservations are deliberately hidden from the list owner — the owner's view of their own list is technically incapable of showing who took what.
How the Service is used
We record a small, fixed set of product events so we can tell whether the Service actually works: a list was created, a list was shared, a list was opened, an item was reserved, and a product link was clicked. These carry the list involved and your account or anonymous ID — never the contents of a page you looked at elsewhere, and never anything from other websites.
Technical data
Your IP address is used briefly to rate-limit requests, which is what stops one person from flooding the Service. Our own abuse logs record only a truncated one-way hash of it, never the address itself.
Why we're allowed to (GDPR)
- To perform our contract with you (Art. 6(1)(b)) — your account, your saved activities, and your gift lists. Without this data those features cannot exist.
- Our legitimate interests (Art. 6(1)(f)) — keeping the Service secure and stable (rate limiting, error monitoring), and understanding in aggregate which parts of the Service work. You can object to this at any time; see below.
- Your consent (Art. 6(1)(a)) — only where we ask for it explicitly. Today we don't ask for any, because we run no advertising or analytics cookies. If that ever changes, you will be asked first and can decline without losing access to anything.
A possible future: opt-in research panel
If we ever build an opt-in research panel — for example, occasionally asking a small group of parents short questions to improve the activity library — we will describe exactly what it involves and ask for separate, explicit consent (recorded in the same consents system described above) before anyone is enrolled. No family is ever enrolled by default, and joining the panel is never required to use the rest of Zoomies.
How long we keep it
- Account data, saved activities, gift lists: until you delete them or ask us to delete your account.
- Individual usage events: automatically deleted after 12 months.
- Aggregate daily counts (for example "42 lists created on this day"): kept indefinitely. These contain no user ID and cannot be traced back to a person.
Who else processes it
We use a small set of vetted providers to run the Service. They act on our instructions and may not use your data for their own purposes. Some are in the United States; those transfers rely on Standard Contractual Clauses or an equivalent safeguard.
- Supabase — database and sign-in
- Netlify — hosting and content delivery
- Sentry — error monitoring, configured not to send personal data with error reports
- Upstash — rate limiting
- Stripe — payment records from the retired Premium purchase only. We have never seen or stored card numbers.
Retailers: when you click a product link on a gift list, you leave our site and that retailer's own privacy policy takes over. Some of those links earn us a commission (see our Terms). We pass no personal information to them — only the fact that the click came from us.
Children
Zoomies is a tool for parents and caregivers, not a site for children to use. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. We do not permit account creation by children.
The only information about a child that exists anywhere in the Service is an age range a parent selects — never a name, birthdate, photo, voice, or address. This is a deliberate design constraint, not a policy promise: there is no database field to put one in, including on a shared gift list.
If you believe a child has given us personal information, email us and we will delete it.
Do Not Sell or Share My Personal Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the California Consumer Privacy Act (CCPA/CPRA). There is nothing to opt out of, because we do not do it in the first place, and we have not done so in the preceding 12 months.
If we ever changed this, we would say so here first and provide a working opt-out before any such transfer took place. To confirm our practices in writing, or to exercise any right below, email hello@offline-kids.com.
Your rights
Wherever you live, you can ask us to do all of the following, free of charge, by emailing hello@offline-kids.com. We answer within 30 days and will never make the Service worse for you because you asked.
- Get a copy of the data we hold about you, in a portable format.
- Correct anything that's wrong.
- Delete your account and everything attached to it.
- Object to, or ask us to restrict, processing based on legitimate interests.
- Withdraw any consent you have given, at any time.
If you are in the EU or UK and think we have handled your data badly, you can also complain to your local data protection supervisory authority. In Germany that is the authority for the state in which the controller is established.
Changes to this policy
If this policy changes materially, we'll update the effective date above and, for significant changes, notify account holders by email before the change takes effect.
Contact
Questions, data requests, or deletion requests: hello@offline-kids.com