Privacy at Peabody

Who is responsible

Peabody is run by Aaron, an individual in Colorado, USA. [Legal entity name, postal address and a contact address for privacy questions to be added before launch.]

Who makes the account

A family account. A parent or guardian creates the family account and adds each child. Those children never give an email address. By creating the account and adding a child, the grown-up agrees to Peabody collecting that child’s information as this page describes.

A kid’s own account. A kid can also make their own account from I’m a kid, with a first name and 4 secret numbers they pick. There is no email, no grown-up and no payment. Peabody keeps less for these kids, and their stories stay just theirs: see Kids on their own below.

What Peabody keeps

About grown-ups

• Email address, password (stored only as a one-way hash) and, if set, a parent PIN (also hashed).
• Which devices were marked as trusted family devices (a random token, stored only as a hash).
• Settings, such as each child’s scariness level and whether their name may appear in their stories.
• Optionally, how you heard about Peabody.

About each child

• First name, avatar, a generated pen name, a 4-digit sign-in code (drawn by Peabody, or picked by a kid who made their own account), and a color theme.
• Their reading level, and how they’re doing in numbers, skill by skill. The reading level comes from a short reading game, a starting point a grown-up picks, or the grade a kid tells Peabody, and Peabody checks it against their own reading. Never their age or birthday.
• Their school, only if a grown-up picks one.
• Their stories, and the ideas they gave for them (for a kid on their own, the ideas only until the story is checked).
• For some of their stories, a quality review: what the story teaches, which parts came from their ideas, and notes on how to make the next story better. Only their grown-ups see it; it’s how Peabody checks and improves its own writing, never a grade for the child. It is never done for a kid on their own.
• How they read: word-check answers, questions answered, time spent on each page, words they tapped to hear, who they read to, and their guesses at how a story ends.
• Thumbs, reactions and share-link opens on their stories, from readers outside the family.
• Which other kids follow them and which they follow (story buddies, by pen name), and any private label a parent gives a buddy.
• What they ask Peabody, when the Ask Peabody box is on: the words they typed or said, kept 30 days and readable by their grown-ups, with which face asked. See Asking Peabody below.

About visitors without an account

• Guest stories. A kid can make up to three stories without an account. Peabody asks for nothing personal. A guest cookie counts the stories, and a one-way hash of the network address is kept for about two days, only to stop abuse. The ideas are used to write the story and not kept afterwards. The stories themselves are kept so they can be read and shared, and move to the child’s shelf if a grown-up signs up in the same browser, or the kid makes their own account there. A kid on their own keeps those stories private, and any links to them are turned off.
• Shared stories. Opening a shared link is counted, and a reaction face is counted once per browser; neither records who you are.
• The front page. Opening its sample story is counted per day, with nothing about who opened it.
• Peabody’s library stories. Anyone can read Peabody’s own library stories without an account, and they may appear in search engines. How many times each one is opened and finished is counted per day, with no cookie and nothing about who read it; a scrambled form of the network address is used only to slow floods of requests, and is gone within two days.

What Peabody never does

• Ask for a child’s age, birthday, last name, photo, address, email or phone. (A kid may tell Peabody their grade, or say they’re not sure; it only sets where their books start.)
• Record anyone’s voice, or receive a recording. Some boxes have a microphone button that turns speech into typed words. Peabody first tries the browser’s own speech recognizer, which in browsers like Chrome and Safari sends the sound to the browser maker to do that; where it is missing, a small speech model runs on the device and no sound leaves it. Either way the sound is held only in memory while listening, and a kid can always type or tap instead.
• Show ads, sell data, or share it for anyone else’s marketing.
• Show a child’s real name outside their own family, including inside a story.
• Send anything about a child to a school.
• Let kids chat with an AI anywhere except Talk with Peabody, typed, a short chat for 3rd grade and up in a family account, which is switched on. The Ask Peabody box looks in Peabody’s own answers first. When there is none, a model may write one answer card for every child who asks, from an open-source passage and the question cut down to keywords; it never replies to a child.
• Send a child to another website without a grown-up’s yes. The window is switched on today, and a yes is the only way a link opens. A web address typed into the box gets a line that it is outside Peabody and no link out, until a grown-up has said yes: see Asking Peabody.

What other people can see

• Inside the family, parents see everything about their children, and siblings can see each other’s stories and activity.
• The library. Unless a grown-up marks a story private, it joins Peabody’s library, where kids from other families, including kids who made their own account, can read the whole story. They see its title, reading level, labels and the author’s pen name, never a real name. Names of the family’s children are replaced in the story text for other readers. Stories children write are not shown to visitors without an account, and are kept out of search engines. Stories by kids on their own never join the library.
• Share links. A story shared by link can be read by anyone who has the link, without an account, until the link is turned off. Share pages are kept out of search engines. A visitor can type a name for the story’s hero to see there; that swap happens only in their own browser and is never sent to Peabody. Kids on their own can’t make share links.
• Story buddies. A child can follow another kid’s pen name (found in the library, or swapped in real life as a buddy code) and be followed back. A parent sees every follower and can remove any, turn following off, or give a buddy a private label only their own family sees. When two kids swapped buddy codes, each one’s grown-ups see which of their own child’s stories the other read, by pen name. Kids on their own can follow other kids, but other kids can’t follow them.
• Who’s here. A signed-in kid can see the pen names and faces of other kids using Peabody in the last two minutes. Nothing else shows: no real name, age, level, or what they’re doing. Grown-ups aren’t listed. A child whose grown-up chose “family only” isn’t listed and sees an empty list.
• Peabody phrases. Two kids who are both on Peabody can send each other phrases from Peabody’s own list (“Hi!”, “What are you reading?”, a reaction face, or the number of one of their own stories), by pen name. Phrases can’t be typed, so no names, places or numbers can be sent that way. A kid can block anyone or tell Peabody. A child’s grown-ups can read every message and block from their child’s settings, and turn chat off; “family only” turns it off too. Messages are deleted after 30 days.
• Doomcrawl co-op. In the Doomcrawl game’s online co-op, up to four players in a party, including players from outside the family matched by Quick Play, can type short messages to each other (up to 200 characters, or spoken into the box with the microphone button), send emote faces and ping the map. They see each other only by pen name. Every message is checked by code before it is sent and again on each player’s screen: phone numbers, emails, links, usernames, street addresses, asks like “where do you live?” and rude words are not sent, and the kid is told why. Hero names other players see pass the same check. Messages are not kept by Peabody, so a grown-up can’t read them later, but in each child’s settings a grown-up chooses who that child can type to: anyone in the party (the default), family only, emote faces only, or no one. “Family only”, the chat switch being off and “buddies only” hold here too, and while chat is resting under a daily limit it is emote faces only. A kid can mute or block any player, and the party’s host can take a player out.

Asking Peabody

A kid can type or say a question to Peabody, on the home page, in the Menu and on the front page. Peabody says first that it is a computer, not a person. [This section is new and marked for legal review, which has not happened yet. The box that writes new answers is switched on, ahead of a lawyer reading this page and of Anthropic’s terms for minors being in hand.]

• What is kept. For a kid in a family account, the words, for 30 days, readable by that family’s grown-ups in the Limits page with which face asked, then deleted. For a kid on their own, and for a visitor, only a scrambled fingerprint of the words, so a repeated question can be counted. For a question Peabody’s word check refused, only the kind of thing it was, never the words.
• A worry. If a kid’s words are about being hurt or hurting themselves, the box shows a Help card with the 988 line and Childhelp (1-800-422-4453). The family’s list never shows the words. They go to a private pile that a person at Peabody reads, to check the Help card did its job, from a family, a kid on their own or a visitor alike. They are deleted 30 days after that person has looked and 90 days after they arrived at the latest. Peabody does not call, text or email anyone about a worry, the family included, and cannot tell whether a kid went on to call.
• What reaches an AI. Never the words as typed. Peabody’s code looks for an answer first. A single word a kid asks about goes to the same word explainer as a word they tap. When Peabody has no answer and a grown-up allows new answers, a model may write one card from a passage of an open source, given only the question cut down to its plain keywords with the family’s first names taken out, and nothing about who asked. The card is screened, shown with its source and licence, and kept for every kid who asks the same thing. A grown-up can turn “new answers” off, or the AI switch for the child, in Limits.
• What reaches other sites. Wikipedia, Wikidata, NASA, the Met and the Smithsonian are asked by Peabody’s own servers for a page by title, from Peabody’s own list. A kid’s words and network address never go to them.
• The window, switched on. A kid in a family account can ask a grown-up about a site; a kid on their own, and by default a kid in Kindergarten to 2nd grade, stays on Peabody only. Peabody keeps the ask (which kid, which site, the answer, and whether a PIN on the kid’s device or the console gave it) so the family can see it. [How long these asks are kept is not settled yet.] A waiting ask runs out after 24 hours, and a Today yes at midnight. A yes opens the site’s front page in a new tab and nothing more; once the tab is open Peabody can’t see or stop what happens there. The family’s Always list stays until a grown-up removes it, and is checked again each night. To check a site a kid asked about, Peabody’s servers send only the site’s name to Cloudflare’s family resolver and, when Peabody has a key, to Google Web Risk; never the kid, the family or a page. Peabody also keeps a log of the sites it blocked, by site, with no kid attached, so a person can see whether its list is too strict.
• Reports. A kid can report a written card as wrong or upsetting. It is hidden at once and a person at Peabody reads the report.
• The browser remembers one thing: that Peabody has said it is a computer, for three hours, in the browser’s own storage. It is not sent anywhere.

Talk with Peabody, typed

A short typed chat with Peabody, for a kid in 3rd grade or up in a family account, when a grown-up has left it on in Limits. Peabody says first that it is a computer, not a person. [This section is new and marked for legal review, which has not happened yet. Typed Talk is switched on, ahead of a lawyer reading this page and of Anthropic’s terms for minors and retention being in hand.]

• Who. Never a visitor, a reader who has not given a first name, a kid on their own, or a grown-up reading along. A grown-up can turn Talk off for a kid, or turn off Peabody’s AI, at any time.
• What is kept. Every line of the chat, the kid’s and Peabody’s, for 30 days, readable by that family’s grown-ups on the kid’s page in the console, then deleted. A message Peabody’s word check refused is kept as the kind of thing it was, never the words, and contact details are never kept. A reply that did not pass Peabody’s checks is not kept.
• A worry. The same Help card and the same private pile as above. The family’s list shows that the Help card was shown, not the words; a worry that names someone at home is not shown to the family at all. Peabody does not call, text or email anyone.
• What reaches an AI. What a kid types in the chat, once Peabody’s word check has passed it, goes to Anthropic’s Claude to be answered, with the last few lines of the same chat and the kid’s grade band and reading level, and no name, school, age or email. Every reply is checked by Peabody’s code and by a second model call before the kid sees it. [Anthropic’s retention and training terms for Peabody’s account are to be stated here once they are confirmed in writing.]
• Talking instead of typing. The chat has a microphone, opened only by a tap. Peabody asks the speech model on the device first, so the sound stays there; only where that cannot run does the browser’s own recognizer hear it, and then the sound goes to the browser maker as under Voice above. What is said lands in the text box as words and is sent only when the kid taps Send, after they have read it. Peabody never receives or keeps any audio.
• How long. A chat stops after 14 messages, and each kid has a small daily share of a monthly allowance. When the share is spent, Peabody says goodnight to the chat until tomorrow.

Kids on their own

A kid can make their own Peabody account, with no grown-up. For these kids, Peabody keeps as little as it can, and what they make stays theirs:

• They sign in with a first name and 4 secret numbers they pick. No email, no grown-up and no payment.
• Their stories are just theirs: never in the library, and no share links.
• Their first name is never sent to the AI. If they type it into their story ideas, it is taken out first.
• Their ideas are used to write the story and check it is safe, then deleted. A story the safety check blocks is not kept.
• Other kids can’t follow them. When they follow a kid from a family, that family only ever sees a made-up pen name and face, never a real name.
• Stories are gentle to start, and can be at most spooky (from 1st grade up), never scarier.
• If they tell Peabody their grade, it only sets where their books start. They can change it, or never say.
• They can tell Peabody about a story that upset them. It is hidden for them, and a person at Peabody reads the report.
• They stay signed in for 8 hours at most on a browser.
• They can delete their account themselves, on My page, with their secret numbers. An account that is never used is removed after 14 days, and one with no sign-in and no reading for 180 days is removed.

News, names and switches

What kids from other families can see about your child, and what your child sees about them. [These lines are new and are marked for legal review.]

• Peabody tells your child once a day, in words, when kids from other families read their stories and which faces they tapped. It never shows numbers of readers below “5+”. Nothing new arrives at bedtime or overnight.
• The first kid from another family to finish a story is named to the author by pen name, once. If your child is the first kid from another family to finish a story, that story’s author sees your child’s pen name, once. Either family can switch this off, and it is off until you have seen our notice. It is off by default for PreK and K readers.
• A buddy who follows your child is named only if they swapped buddy codes. Anyone else is “a new reader”, and we tell you when one arrives.
• On your Stories page, you see which of your child’s buddies read each story, by pen name, if they swapped buddy codes. If your child swapped buddy codes with a kid from another family, that kid’s grown-ups see which of their child’s stories your child read, by pen name. This follows the switch that names your child to other kids: off until you have seen our notice, and off by default for PreK and K readers.
• Readers can tap “More please!”; your child sees “a few kids want to know what happens next”, never how many or who.
• Authors can send one thank-you face to everyone who read a story.
• Peabody is a cartoon with hand-written lines, including one joke a day. The one chat with an AI is the short typed Talk with Peabody, for kids in 3rd grade and up in a family account, which is switched on.
• We keep a note of each day your child opened Peabody (the date only, with no time of day after a week) for 60 days, the day’s news for 30 days, and “More please” taps for 45 days, to show the news and to count, in totals only, whether Peabody is working. We never measure minutes. Other children’s pen names are never stored in your child’s news; they are looked up when the news is shown.
• Every one of these has a switch on your child’s settings page, and one switch keeps everything inside your family.
• Kids can also make their own account, with no grown-up. A kid on their own is never named to kids from other families and can’t be followed, and their stories stay out of the library. If one follows your child, you see only their made-up pen name and face.

Who else touches the data

Only the services that run Peabody, each for that job alone:

• Anthropic writes, safety-checks and reviews the stories. It is sent the child’s first name (only if the grown-up allows it in stories, and never for a kid on their own), their reading level and the words they’re practicing, the scariness setting, their ideas, and the earlier books in a series. Never an age, school or last name. If a child draws their own face, the drawing (a small picture, with nothing else about the child) is sent to Anthropic once to check it follows the rules before the child’s device keeps it; Peabody never stores it, and it stays on that device. For the Ask Peabody box, Anthropic is sent only the question cut down to keywords and an open-source passage, never who asked. [Confirm Anthropic’s data-use and retention terms for Peabody’s account.]
• OpenRouter passes a kid’s Studio game idea, after Peabody has screened it, to an open model that builds the game, with settings that allow only hosts that keep nothing and never train on it; if it is down, Claude builds the game. [Confirm OpenRouter’s terms for minors.]
• Cloudflare and Google are asked whether a site a kid asked about is blocked, once the window is on: Cloudflare’s family resolver always, Google Web Risk when Peabody has a key. Each is sent the site’s name only. [Confirm both services’ terms before the window is switched on.]
• Wikipedia, Wikidata, NASA, the Met and the Smithsonian are the open sources an answer card can be written from. Only Peabody’s servers talk to them, by a page title from Peabody’s own list.
• Supabase stores the data (accounts, stories, reading history).
• Vercel hosts the site and counts page visits without cookies. Before a visit is counted, every identifier is taken out of the address, and nothing is sent when the browser asks for Global Privacy Control.
• Resend sends the emails Peabody sends a family: password resets, invitations, a PIN locked after too many wrong tries, a child’s scariness ceiling changing, a kid’s story shared to a grown-up, and, only if a family opts in, an occasional gentle reminder.

Cookies

Only the cookies Peabody needs to work: the sign-in session, a trusted-device cookie on a family’s own device, one that remembers a kid has signed in on this browser (so the front page opens the kids’ door), the guest-story cookie, and, for someone reading a shared story with no account, a cookie that only stops the same browser tapping a reaction twice or being counted as two opens. No advertising or tracking cookies.

How long things are kept

• Account, child and reading data: for as long as the family account exists.
• Hashed network addresses for guest stories: about two days.
• What a kid asked Peabody: 30 days, then deleted. A worry in the private pile: 30 days after a person has looked, 90 days at most.
• Rate-limit counters (to slow down password and secret-number guessing, and too many new kid accounts at once): short-lived; they only count recent attempts.
• Deleting: a parent deletes a child, or the whole account, any time from the grown-ups’ privacy screen. It happens right away (that child’s sign-in, every story they made, and all their reading) and it can’t be undone. For a family that came from Peabody’s first version, their old account traces and Supabase’s own sign-in log entries for them are removed too.
• A kid’s own account, and everything in it: until the kid deletes it on My page. One that is never used is removed after 14 days, and one with no sign-in and no reading for 180 days is removed.

Your choices

• Mark any story private, so it stays out of the library.
• Turn off a share link at any time.
• Set each child’s scariness level, their pen name, whether their name appears in their stories, and whether they can follow or be followed.
• Download any child’s data, or delete a child or your whole account, any time, from the grown-ups’ privacy screen.
• Ask about anything this page doesn’t cover, at the contact address above.

Changes

If this page changes in a way that matters, families will hear about it by email before it takes effect. [How kids on their own, who give no email, hear about a change: to be settled.]

See also the terms of use.