Privacy Policy

1. Who we are

SkyBuds is made by Firefly Jar, Inc., 521 Broadway, 2nd Floor, New York, NY ("we," "us," "our"). This policy covers the SkyBuds toy, the SkyBuds parent app, and this website (together, the "Services"). It covers both the information we collect from you as a parent or legal guardian and the information we collect from your child. SkyBuds is sold in the United States.

2. What we never do

• We never sell personal information, yours or your child's.
• We never show advertising to children, and there are no ad or marketing trackers in the toy or the app.
• We never use your child's conversations to train anyone else's AI. Our processors are barred from it in writing.
• We never keep voice recordings of your child without your permission as their parent or guardian, and we never keep any recording for more than 24 months.
• We restrict access to recordings and their consent records; only trained, individually authorized people working for SkyBuds listen to recordings.
• We never collect your child's location, photos, or video. The SkyBud has no camera.
• We never make your child's information public, and the SkyBud has no chat, social, or messaging features with other people.
• We never condition the toy working on you handing over more data than it needs.

3. What we collect from parents

When you register an account, make a purchase, subscribe, or contact support, we collect your name, email address, billing and shipping address, payment information, and phone number. We use it to provide the Services, process transactions, support you, send marketing you have opted into, and meet legal obligations.

On our quiz pages you may also give us your child's first name and age, your answers to the quiz, and your email address and phone number. We use them to match you with a SkyBud, show you your results and offer, and improve the quiz. Section 12 explains how those pages may be recorded.

4. What we collect from your child, and why

• Profile details you enter (first name, age, interests, names of family members): so the SkyBud can talk to your child appropriately. Kept while the account is open.
• Your child's voice while talking to the SkyBud: streamed live over an encrypted connection to turn speech into text and answer. Unless you have turned it off (section 7), we keep some of these recordings, labelled with random codes instead of names, to improve how SkyBuds understands children. If you turn it off, the audio is processed in real time and not kept.
• Transcripts of conversations: so the SkyBud remembers between sessions, so you can read conversations in the app, and to keep conversations safe. Kept 12 months, then deleted.
• Conversation summaries and learning stats: shown to you in the app. Kept while the account is open.
• Toy technical data (battery, connection, firmware version, error logs): to keep the toy working and track that bugs stay fixed across updates. Kept up to 12 months.

We never ask a child for more information than is needed to use the toy.

5. The data journey: who processes your child's information

To make the toy talk, data passes through a small set of companies. Each one processes it only on our instructions, only to run SkyBuds, and may not use it for anything of their own, including training their AI models. Since September 2026 the toy's speech recognition, conversation and memory run on our own servers instead of outside AI companies. Here is the full journey for the SkyBuds app (version 2) and the toy:

We also measure how the app is used, such as which screens and games are opened, with Tinybird, using account and install identifiers. It never receives conversation content or names, and we use it only to keep SkyBuds working and improve it. Our older app (version 1) still uses our previous providers for its own features, Railway, Supabase, Deepgram, OpenAI, Cerebras, Fish Audio, Sentry and Superwall, on the same terms, until that app is retired. Every SkyBud toy now uses our own voice server described above.

That is the complete list for the toy. Beyond these service providers, we disclose personal information only if the law requires it, to protect somebody's safety, or if our company is ever sold or merged, and in that case we would tell you first. A current copy of this list is always available by emailing hello@getskybuds.com.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. See section 13, Text messages and your mobile number.

The AI your child talks to runs on our own servers

When your child talks with their SkyBud, the AI that listens and answers is SkyBuds' own model: a fine-tuned open model running on data-center GPUs that we run (the computers rented from RunPod in the first row above). It is not ChatGPT, Claude, Gemini or any other AI lab's model, and no OpenAI, Anthropic or Google AI service is part of your child's conversations with the toy. Speech recognition (turning your child's voice into text), the memory model that works out what to remember, and the safety checks run on those same servers, so in those conversations your child's voice is not sent to any outside AI company's model. Accounts, transcripts and memories are stored with PlanetScale and Cloudflare, as the table shows. To give each character its voice, only the toy's own reply text is sent to Fish Audio, under a zero-data-retention agreement; your child's audio is never part of that. This part is only about the toy's conversations: the older app (version 1) above and the website voice demo and Help Teach Ash page (section 14) use the other providers named for them. As section 2 says, we never sell your child's information and never show advertising to children.

6. Children's privacy and consent (COPPA)

We follow the Children's Online Privacy Protection Act (COPPA). A parent or legal guardian sets up and approves every SkyBud before a child uses it. Wherever this policy says "parent," it includes legal guardians.

For the optional Help Teach Ash page (section 14), first read the current statement and confirm that you are the participating child’s parent or legal guardian. Then enter the code we text you or follow the link we email you. We send a separate confirmation describing your consent and how to withdraw. The page does not accept child information or recordings until verification is complete and that confirmation has been accepted for delivery. Text codes expire after 10 minutes; email links expire after 72 hours. Unconfirmed requests and contact information are deleted within 14 days. Consent to this research does not subscribe you to marketing.

If we ever want to use your child's information in a materially different way than described here, we will tell you and ask for your permission again first.

7. Improving SkyBuds with your child's voice

Kids do not talk like adults, and speech technology built on adult voices often gets them wrong. To make the SkyBud better at understanding children, we keep some of your child's voice recordings and use them, together with their transcripts, to train and test SkyBuds' own speech and AI models.

This is part of the permission you give when you set up SkyBuds, and the notice you agree to in the app, or at checkout on our website, says so. You can turn it off at any time in the app (Grown-ups, then Help improve SkyBuds) or by email, without withdrawing anything else. The toy works exactly the same either way. We will never make the toy, or any feature of it, depend on keeping recordings. If you set up SkyBuds before September 29, 2026, we do not keep your child's recordings under this section unless you agree to the updated notice in the app.

What we keep: short recordings of your child talking to the SkyBud, and the transcript of each one. For the Help Teach Ash page (section 14) we also keep the age you select after confirming consent, and, only if you choose to tell us, whether your child has a speech difference such as a speech delay. Both are filed with the same random code as the recordings, never with a name, and are used only to pick age-appropriate games and to check that our models understand every child. We never show you anything derived from them, and SkyBuds is not a medical or therapy product.

How we identify recordings: recordings use random codes rather than names. For Help Teach Ash, a restricted lookup connects the family’s contact information, consent receipt and recordings so we can check permission and carry out access, deletion and withdrawal requests. This is not irreversible anonymization: a voice recording remains your child’s personal information, and the protections in this policy continue to apply.

Who hears them: trained, individually authorized members of our team listen to recordings to check transcripts and label the data. We do not disclose these recordings to third parties as defined by COPPA. Our team may include individual contractors directly engaged by Firefly Jar, but only where their assigned work qualifies as support for our internal operations and is covered by the applicable parental notice and consent. They may use the information only for that assigned work, never for themselves or another client. Access is limited, logged, and covered by written confidentiality and security obligations. They may not subcontract access, retain personal copies, or use outside AI or transcription tools.

How they are used: to train and test SkyBuds' own models, and for nothing else. They are never sold, never shared with any other company, never used for advertising, and never used to train anyone else's models.

How long we keep them: every recording and its transcript is deleted 24 months after it was recorded. We chose 24 months because that is how long a recording stays useful for training and testing. Nothing is kept longer, and nothing is kept indefinitely.

Changing your mind: turn it off any time in the app or by email. Within 30 days we delete the recordings and transcripts we have kept and remove them from our training data, so no future version of our models learns from them. Deleting recordings does not automatically retrain models that were trained on them earlier.

8. How long we keep things

Nothing is kept indefinitely. We keep a written retention policy, as COPPA requires, and this table is it: each type of data has a purpose, a reason it is retained, and a deletion clock.

To stop free talking time and free trials from being claimed again with a new account, we keep a record of your SkyBuds toy's device ID and a coded form of your phone number, with the talking minutes used and the free time given. We keep it for up to 13 months, including after an account is deleted, and then delete it. It holds no names, no recordings and nothing your child said.

9. Your rights as a parent

At any time, you can:

• See your child's conversations, summaries, and profile in the app, or request a copy by email.
• Delete a single conversation, or some or all of your child's data, without closing your account, by emailing hello@getskybuds.com. Deletion reaches our processors, our backups on their roll-off schedule, and the training recordings (models already trained are not rebuilt; see section 7).
• Stop further collection or use of your child's information, or withdraw permission to keep recordings, without deleting anything else. If you stop collection entirely the SkyBud won't be able to chat, because it needs to hear your child to answer.
• Close the account, which removes your and your child's information within 30 days.

For requests by email we will verify you are the parent, usually by replying from the email address on the account, and complete deletion requests within 30 days.

10. Human review, safety, and security

Human review: trained members of our team may read conversation transcripts in two cases: when a conversation is flagged by our safety systems, and in limited spot checks to improve how the SkyBud responds. Unless you have turned it off (section 7), the same team may listen to recordings, labelled with random codes instead of names, to check transcripts and label data. Access is restricted and logged, and everyone with this access is bound by a confidentiality agreement: nothing they see or hear may ever be shared outside Firefly Jar. The same restrictions on individual contractor access described in section 7 apply to this human review.

Security: data is encrypted in transit and at rest, access is limited to team members and providers who need it, and every provider gives us written security assurances. Two-factor authentication is available for your parent account in the app. SkyBuds is kidSAFE Listed, and our COPPA certification review is underway.

11. If SkyBuds ever shuts down

Toys should not die with their company, and data should not outlive it. If Firefly Jar ever winds down the SkyBuds service, we will give you advance notice by email, delete children's personal information, and publish a plan for the toys themselves before anything goes dark.

12. This website

Our store at getskybuds.com is built for parents. Purchases, order data, and website analytics relate to you as the buyer, and nothing on the store asks a child for personal information. The one thing a child might play with is the voice demo on our product pages. That demo is not the toy and runs on different systems, so it has its own section below (section 14). Our site may link to other websites; their privacy practices are their own.

Recording our quiz pages. On our quiz pages (getskybuds.com/pages/quiz-…, including the order page at the end of the quiz) we may record your visit so we can see where the quiz is confusing or broken. A recording works like a video of the page: it captures what's on the screen, your taps and scrolling, and what you type, including your child's first name and age, your answers, and your email address and phone number. None of that is hidden in the recording. We never record checkout or payment pages, passwords, the codes we text you, or card details. Recordings are stored with Cloudflare and are not given to ad platforms. Only authorized SkyBuds staff can watch them, and every viewing is logged. They are deleted automatically after 30 days. To have yours deleted sooner, email hello@getskybuds.com from the address or with the phone number you used; deleting your child's data or your account also deletes the recordings we can connect to you. Privacy choices and Global Privacy Control turn off the ad measurement described below; they don't turn off these recordings.

Ads we measure. On our store pages we use Meta's pixel and Google's ads tag so we can tell which of our ads bring visitors and orders. They set cookies and read the ad click ID in the link you arrived from. Our own server can also save Meta's ad click ID in Meta's cookie on our site for up to 90 days, so an order you place later is matched to the right ad. Our servers also tell Meta when someone views a product, adds to cart, signs up for offers, starts checkout or buys; only a purchase carries contact details. For a purchase, that includes the order value and items and the email, name, and shipping city, state, ZIP code and country on the order. These details are hashed, so Meta can match them to an ad click but can't read them. We never send Meta a phone number, hashed or not. When you give your email at the end of our quiz, the pixel sends Meta a hashed copy of it with that step. When you finish one of our quizzes, the pixel tells Meta that this browser finished it, using a code for the quiz and none of your answers, so we can show our ads to people who finished a quiz. Nothing else you type on our pages reaches Meta: the pixel is set not to read forms and not to match anything on the page automatically. When you arrive from a Google ad and buy, our servers tell Google the order value and that ad click ID, with no contact details. Google's ad personalization is turned off. None of this runs on the Help Teach Ash page, on order confirmation pages, in the toy or in the app, and none of it involves your child's information.

Creator links. Some creators we work with share links through Trybe, the platform that runs our creator program. Only if you arrive on our store from one of those links do our pages load Trybe's tracking script, for up to 30 days. It sets a cookie and records the store pages you visit, so Trybe can tell which creator's video sent you. If you then buy, our servers tell Trybe the order number, order value and items, and that visitor ID, with no name, email, phone number or address. If you didn't arrive from a Trybe creator link, none of this happens. Declining in Privacy choices, or your browser's Global Privacy Control signal, turns it off. It never runs on the Help Teach Ash page, at checkout, on order confirmation pages, in the toy or in the app, and never involves your child's information.

Your connection's area. When you visit, our servers note the approximate area of your internet connection (postal code and metro area) and its type (for example mobile, home or business), and may compare that area with the shipping ZIP code on an order to tell whether visits came from the same household; we skip this if you decline in Privacy choices or your browser sends Global Privacy Control.

Which creator sent you. Creators we work with share links to our store (getskybuds.com/l/…). When you open one, our own server notes which creator's link it was and sets a cookie on our site, so an order you place later can be credited to that creator. The page address also carries a short code from that link, so if you open the same page in another browser, for example from Instagram into Safari, we can tell it came from the same creator link. Creator videos often open inside the Instagram or TikTok app, and many people buy later in another browser or on another device. To connect those visits, our servers compare the time of each visit, details of the device and browser (such as model, screen size, language and time zone), the type and approximate area of the network a visit comes from, and a hashed form of your internet address, which we can match but can't read. When you give us your email or phone number, at checkout or when you sign up for offers, we connect your earlier visits on our store to it. We use this only to work out which creators and posts bring orders, and a match made this way is marked as likely, never as certain. We don't share it with creators or ad platforms or use it for ads, and it never involves your child's information. Declining in Privacy choices, or your browser's Global Privacy Control signal, turns this matching off.

Links in our emails and texts. When you click a link to our store in an email or text message we sent you, the link carries a short code so we know the visit came from that message and can connect it to your account and orders, even when it opens in a different browser or on another device. The code doesn't contain your email address or phone number, and our store removes it from the page address right away. We use it only to work out which messages and creators bring orders, never share it with creators or ad platforms, and it never involves your child's information. If your browser sends a Global Privacy Control signal, or you declined in Privacy choices, the code is not used.

Your choice. "Privacy choices" at the bottom of every store page turns Google's measurement off in that browser, including the purchase report, stops the pixel reporting a finished quiz, and stops our server from saving Meta's click cookie (it also removes one already saved). If your browser sends Global Privacy Control, our pages don't load Meta's pixel or set Meta's cookies, and what our servers tell Meta carries no Meta browser or click ID. You control Meta's use of it under "Your activity off Meta technologies" in your Facebook or Instagram settings. Questions: hello@getskybuds.com.

13. Text messages and your mobile number

We send text messages only with your consent. Our SMS Terms are the one place that lists every SkyBuds text program, where you opt in, how often we text, and how to stop (reply STOP) or get help (reply HELP).

We keep your mobile number and a record of your consent (when, where, and the wording you agreed to) so we can honor it.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We never send a phone number to Meta, Google or any other advertising company, hashed or not (section 12). Text messaging originator opt-in data and consent are excluded from every category of disclosure in this policy and will not be shared with any third parties. The only company that touches these messages is the carrier-connected provider that delivers them on our instructions.

14. The website voice demo

What it is. On our product pages you can press a button and have a short live conversation with Ash, Pearl, or Sprout. It exists so you can hear what a SkyBud sounds like before you buy. It is a product demo, not the toy. The toy is described in sections 4 to 10 and runs on the companies listed in section 5. The demo does not: it runs on ElevenLabs, a voice company, and none of what happens in the demo reaches the toy, your account, or the parent app.

Who starts it. We ask a parent to press the button. The microphone turns on only after that press and turns off when the conversation ends. The conversation is open-ended, so you or your child can say anything, and it ends by itself after about 90 seconds. You can end it sooner at any time.

What happens to the audio. While the demo runs, the microphone audio streams to ElevenLabs, which turns it into a reply and speaks it back. That is the only use. We do not receive the audio or a transcript. We do not store anything in your browser, we do not set a cookie, and we do not record that a demo took place or who ran it. The short captions shown on screen live only in the page for that conversation and are cleared when it ends. Under our agreement with ElevenLabs, they do not keep the audio or transcripts after the conversation and do not use them to train anything.

What we ask you not to share. The demo never asks for a name, an age, or anything about your family, and it does not need any of that to work. Because the conversation is open-ended, a child could still say something personal. If that happens, it is treated exactly like everything else in the demo: used for the reply in that moment and not kept.

Help Teach Ash, the optional page for families who want to help. Separately from the demo, we run a page at getskybuds.com/pages/skybuds where, with your consent, your child can talk with Ash, Pearl, or Sprout in the browser, up to an hour of chatting in total per family, in as many sittings as you like, and we keep those chats to train SkyBuds' own models. Some of the chat is little games: the character shows a picture and asks what it is, or says a silly word for your child to repeat. These give us recordings where we already know the word, which is what makes them useful. There is no score and nothing your child needs to get right. This is the only place on the website where a child's voice is kept, and it works exactly like the recordings program in section 7: the audio and transcript are filed under a random code, with the restricted consent lookup described in section 7, along with your child's age and, if you chose to share it, whether they have a speech difference, kept for up to 24 months, heard only by our own trained team, used only to train and test SkyBuds' models, and deleted within 30 days if you withdraw. Consent is by text-message or email confirmation (section 6). The page saves a random access code in your browser so you can return to your family’s consented account on that device; it does not contain your contact details. For Help Teach Ash, Railway hosts our conversation service, Deepgram transcribes live speech, OpenRouter routes reply generation to DeepInfra's hosted Gemma model, OpenAI's moderation service checks text for safety, and Fish Audio turns reply text into speech. Cloudflare hosts our collection service and private recording and consent storage. We use Twilio for verification and confirmation texts to parents. These providers process information for SkyBuds; the recording purposes, retention periods and parental rights described above continue to apply. The page shows your saved chat time and lets you request deletion of saved chats. To withdraw consent or request access or deletion, email hello@getskybuds.com using your signup address or include your signup phone number. We verify the request, stop further collection and use, and delete the recordings within 30 days. Existing withdrawal links in consent messages also remain available.

The demo is a taste, not the product. The demo character has the same voice and personality as the toy but not the toy's full memory, parental controls, quiet hours, or safety review described above. Do not judge how the toy handles a sensitive moment by the demo. If you would like the demo turned off for your visit, simply do not press the button: nothing runs until you do.

15. Changes to this policy

We will post updates here and change the date at the top. For any material change to how we handle children's information, we will notify you and ask for your consent first.

Change history: November 8, 2026: section 12 now says that the pixel tells Meta when a browser finishes one of our quizzes, so we can show our ads to people who finished one, and that "Privacy choices" turns this off. November 7, 2026: section 12 now says that our quiz pages may be recorded, including what you type there (your child's first name and age, your answers, your email address and phone number), that checkout and payment pages are never recorded, that recordings are stored with Cloudflare, watched only by authorized SkyBuds staff, and deleted after 30 days or sooner if you ask; sections 3, 5 and 8 and the short version say the same. November 4, 2026: section 8 now says that, to stop free talking time and free trials from being claimed again with a new account, we keep a record of a SkyBuds toy's device ID, a coded form of the phone number, the talking minutes used and the free time given, for up to 13 months, including after an account is deleted; it holds no names, no recordings and nothing your child said. October 29, 2026: section 5 now has a short part, "The AI your child talks to runs on our own servers", that says in plain words what the table already showed: when your child talks with their SkyBud, the AI is our own model on computers we run, not ChatGPT, Claude, Gemini or another AI lab's, and only the reply text goes to Fish Audio; no provider, use or retention changed. October 26, 2026: section 12 now says our server can save Meta's ad click ID in Meta's cookie on our site for up to 90 days, that Privacy choices stops and removes that cookie, and that Global Privacy Control turns off Meta's pixel and cookies on our pages; it also says that a link to our store in an email or text message we sent you carries a short code, so we can connect the visit to that message and to your account and orders even in another browser or on another device; the code doesn't contain your email address or phone number, is never shared with creators or ad platforms, and isn't used when your browser sends Global Privacy Control or you declined in Privacy choices; and it says that our servers note the approximate area (postal code and metro area) and type of your internet connection and may compare that area with the shipping ZIP code on an order, which declining in Privacy choices or Global Privacy Control turns off; nothing about children's data changed. October 25, 2026: section 12 now describes how we credit creators for the orders their links bring, including connecting visits across browsers and devices by comparing visit times, device and browser details (such as model, screen size, language and time zone), the type and approximate area of the network and a hashed form of your internet address, which declining in Privacy choices or Global Privacy Control turns off; nothing about children's data changed. October 17, 2026: section 12 now describes Trybe, the platform that runs our creator program; its tracking runs only for visitors who arrive from a Trybe creator link, and our servers send it no contact details; nothing about children's data changed. October 15, 2026: we stopped sending phone numbers to Meta, so section 12 no longer lists the phone number among the purchase details our servers send, and it says the Meta pixel on our pages neither reads forms nor matches anything on the page automatically, so the email you give at the end of our quiz is the only thing typed on our pages that reaches Meta; section 13 now points to our SMS Terms as the one place for every text program, opt-in, message frequency and STOP and HELP, and states the no-sharing promise in the exact words carriers require; nothing about children's data changed. October 12, 2026: section 5 now names the providers of the current SkyBuds app and toy (our own voice server on RunPod, PlanetScale, Cloudflare, Fish Audio, Apple and Google) and our app usage measurement (Tinybird), and lists the providers that still serve our older app until it is retired; section 9 explains that a single conversation is deleted by emailing us. Less of your child's information now reaches outside companies than before. September 29, 2026: keeping recordings to train and test SkyBuds' own models is now part of the permission you give at setup instead of a separate permission, and you can turn it off at any time in the app; recordings are described as labelled with random codes instead of names rather than "de-identified". Families who set up SkyBuds before this date are not affected unless they agree to the updated notice. September 26, 2026: section 12 now describes the Meta and Google ad measurement on our store and how to turn Google's off; nothing about children's data changed. September 20, 2026: replaced the blanket contractor wording in section 7 with the COPPA third-party distinction and specific restrictions on individually authorized contractors. This update does not expand permission for recordings already collected; we will obtain new parental consent before any material change to the practices previously consented to. September 13, 2026: corrected Help Teach Ash verification, pending-request deadlines, restricted recording lookup and withdrawal instructions to match the current consent flow. Existing consent receipts are unchanged. September 3, 2026: added section 13, Text messages and your mobile number, with the exact no-sharing statement carriers require; nothing about children's data changed. August 24, 2026: full rewrite: named every processor, added the data journey and retention tables, the recordings program, expanded parental rights, and the shutdown commitment. Earlier versions described our practices in less detail. August 29, 2026: rewrote section 7 to explain how voice recordings are de-identified, who listens to them, and why they are kept 24 months; added the no re-identification promise, and added section 13 describing the website voice demo and the optional Help Teach Ash page separately from the toy; section 6 now describes the email consent used by that page.

16. Contact us

Firefly Jar, Inc.
521 Broadway, 2nd Floor, New York, NY
Email: hello@getskybuds.com
Phone: +1 (978) 541-3603

17. California privacy rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us using the information above.