Puddibear Website and Subscription Privacy Policy

1. Who Is Responsible

2. Who the Website Is For

The website signup and payment functions are intended for adults. Children must not submit an email address, make a payment or send personal information through this website. We do not knowingly request a child's name, email address, voice, photo, precise location or child profile through the website covered by this policy. If you believe a child has submitted personal information through this website, contact us so we can review and, where appropriate, delete it.

Future Puddibear devices and applications are designed for children and may involve child information. This website policy does not describe that separate processing. Before a device or application collects child information, Puddibear will provide appropriate parent-facing privacy information and implement parental consent and controls required by applicable law.

3. Information We Collect

3.1 Launch-list information

When you select "Notify me," we collect the email address you submit, whether signup came from the homepage hero or lower signup section, an internal random signup identifier, and the signup date and time. The form does not verify email ownership. Submit only an email address you are authorized to use.

3.2 Subscription, payment and refund information

When you purchase the US$1 additional three-month service entitlement, Stripe processes your payment-method details on its hosted checkout. Puddibear may receive or store:

• a random subscription identifier and hashed access credential;
• the signup record associated with the purchase, if available;
• the version of the Terms accepted and relevant timestamps;
• Stripe Checkout Session, Payment Intent, refund and webhook event identifiers;
• the payment email returned by Stripe, amount, currency, environment and payment/refund status;
• subscription entitlement and access status; and
• limited Kickstarter purchase and device-activation references needed to associate the additional service entitlement with an eligible device.

Puddibear does not receive or store your full card number, bank account number or card security code through the website database. Payment and refund records are maintained separately; a legally required refund may be recorded separately from the original payment.

3.3 Cookies and browser storage

The subscription flow uses first-party, secure, HTTP-only cookies to associate the current browser with a recent signup or subscription status and reduce accidental duplicate payments. The signup association cookie lasts up to 24 hours. The subscription access cookie and related access period last up to 30 days. These cookies are not an account login and do not prove identity. Clearing cookies, changing browsers or devices may prevent the website from displaying an earlier purchase status, but does not itself delete Stripe or Puddibear transaction records.

The site may also use session storage to remember that checkout was opened or that you chose to view a previous purchase in the current browser tab.

3.4 Website usage and technical information

The homepage and community page automatically use Puddibear's first-party analytics to understand whether the pages work and how visitors use them. This analytics may collect:

• page views, page-load completion and load time;
• visible or active time, scroll depth and the approximate number of screens viewed;
• which named page sections were substantially visible;
• categorized clicks and interactions, rather than the text you type;
• signup attempt and outcome categories, without the submitted email address or other form contents;
• video play and completion events where videos are present;
• a coarse device category (mobile, tablet or desktop);
• a limited source category, such as direct, internal, Facebook, Instagram, search, email or other; and
• a random identifier for the current browser tab or session.

When unique-browser measurement is enabled, the site also stores a random first-party browser identifier with a fixed 30-day lifetime that is not renewed. The server stores a keyed hash of that identifier, not the raw identifier. It measures browsers rather than people, so different devices, private browsing or cleared storage may count separately.

This first-party analytics does not collect form input values, email addresses, payment identifiers or payment status, full referrer URLs, full page URLs or query strings. It does not record keystrokes, replay sessions or use device fingerprinting. An IP address may be used transiently for rate limiting, but is not stored in Puddibear's application analytics. Hosting and security providers may separately process request, network, device or security information under their own terms.

Analytics reports cover a rolling 30-day period. The application uses scheduled and opportunistic cleanup to remove analytics view records older than 30 days. Cleanup can be delayed by operational failures, and infrastructure backups or recovery systems may follow separate retention periods.

3.5 Advertising and external links

Puddibear may use Meta or other advertising measurement tools. The website's local Meta Pixel entry is currently disabled, so the local script does not itself load Meta's Pixel SDK or send its PageView, signup or community events. Separate Meta, advertising-platform, plugin, gateway or server-side configurations may operate when enabled and can process browsing or interaction information under the provider's terms. Advertising measurement is not intended to receive payment-card details, payment identifiers or payment status from Puddibear's website events. We do not sell personal information. If applicable law requires an opt-out or other choice for advertising measurement, we will provide it as required by law.

The community page links to a Facebook group. If you follow that link, Meta processes information under its own terms and privacy policy. A click does not prove that you joined the group.

3.6 Communications

If you email us, we receive your email address, message contents and message metadata. To investigate a payment question, we may ask for limited information from a Stripe receipt or Kickstarter/device record. Do not send full card details, passwords, API keys or unnecessary child information.

Service providers may process basic technical and security information to operate, protect and troubleshoot the website.

4. How We Use Information

We use personal information to:

• manage launch-list signups and send updates you requested;
• process the subscription purchase, provide access and manage the three-month entitlement;
• validate payment events and reconcile transaction records;
• associate the additional service entitlement with an eligible device purchase and activation;
• send transaction receipts, service notices and legally required refund notices;
• answer support and privacy requests;
• protect, troubleshoot and improve the website; and
• meet accounting, tax, legal, dispute and recordkeeping obligations.

Where applicable law requires a legal basis, we may rely on performing a contract or taking steps at your request, your consent for marketing, our legitimate interests in operating and securing the service, or compliance with legal obligations. The applicable basis depends on the activity and your location.

5. Marketing Email

Submitting the launch-list form requests email updates about the Puddibear Kickstarter launch. Eligible signup addresses may be synchronized to Mailchimp with a Puddibear website tag. You can unsubscribe using the link in a marketing email or contact us.

A subscription purchase does not by itself subscribe the payment email to Mailchimp or other marketing. Stripe receipts, service notices and refund notices are transactional communications. Unsubscribing from marketing does not prevent necessary transaction-related communications.

6. How We Share Information

We share information as needed for the purposes in this policy, including with:

• Cloudflare, for website hosting, security, databases and delivery;
• Stripe, to host checkout, process payments and refunds, and send enabled transaction emails;
• Mailchimp, to manage requested launch-list contacts and updates;
• Meta/Facebook, if you follow the community link or where advertising measurement is used;
• professional advisers and service providers supporting security, accounting, legal compliance or customer support; and
• authorities, courts or successors where required by law, necessary to protect rights or security, or involved in a legitimate corporate transaction.

Third-party providers process information under their own terms and privacy policies.

7. International Processing

Our service providers may process information in countries other than where you live. We will use data-protection measures where required by applicable law.

8. Retention

We keep personal information for as long as reasonably necessary for the purposes described in this policy, to meet legal obligations and to handle disputes. Some transaction records may be retained for accounting, tax, fraud-prevention or dispute purposes. When information is no longer needed, we will delete or de-identify it.

9. Your Choices and Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, objection to, or portability of personal information; withdraw consent; or opt out of certain sales, sharing or targeted advertising. These rights may be subject to identity verification and legal exceptions, including records that must be retained for tax, fraud prevention or disputes.

You may unsubscribe from marketing emails, clear browser cookies or storage (which may remove displayed purchase status without deleting transaction records), or contact [email protected] with a privacy request. Do not send full payment-card details. We may request information reasonably necessary to locate the record and verify the request.

10. Security

We use measures designed to protect information, including HTTPS, restricted server-side payment credentials, signed secure cookies, hashed access credentials, limited database access and validation of Stripe webhook signatures. No system is completely secure, and we cannot guarantee that information will never be lost, misused or accessed without authorization.

11. Changes

We may update this policy as the website, service providers or legal requirements change. We will update the effective date and provide additional notice when required by law.

12. Contact Us