Last updated: September 10, 2026

Privacy Policy

Introduction

iWonder is operated by iwonder Pte Ltd (“we,” “our,” or “us”), 1 Keong Saik Road, Singapore 089109. We are the controller responsible for personal information processed to operate our service. This policy explains our information practices, including Kids features. Contact us about privacy at support@iwonder.com or the postal address above.

Information You Provide

Account information (username, email) when you create an account
Playlists and collections you create
Comments and ratings you submit
Preferences and settings
Support enquiries, copyright notices and other communications you send us
Information associated with subscriptions, purchases and account management
Kids settings, saved items, viewing activity and questions, as explained below

Automatically Collected Information

Usage data (pages visited, time spent, search queries)
Device information (browser type, operating system)
IP address and location data (general geographic area)
Cookies and similar tracking technologies

How We Use Your Information

We use information to operate the features you request, manage accounts and subscriptions, respond to enquiries, and protect the service. Where the GDPR applies, processing requires an applicable legal basis, such as performing our contract with you, consent, a legal obligation or legitimate interests. A cookie choice is not consent to every use of information described here.

To provide and maintain our services (Art 6(1)(b) — performance of our contract with you)
To provide saved items, viewing history and recommendations associated with the features you use
To process transactions and manage subscriptions (Art 6(1)(b) — performance of contract; Art 6(1)(c) — compliance with tax and accounting obligations)
To send you marketing updates and communications (Art 6(1)(a) — your consent, given under Art 7 and withdrawable at any time)
To understand how the service is used and diagnose technical failures; the Cookies and Consent section explains the website banner controls
To detect and prevent fraud or abuse (Art 6(1)(f) — our legitimate interest in a secure platform)

Where we rely on consent, you may withdraw it at any time. For marketing, use your email preferences or the unsubscribe link. For integrations controlled by the website cookie banner, select “Reject non-essential”. If the banner is no longer visible, remove the cookie_consent cookie in your browser settings and reload the page to make a new choice. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

With providers that help operate hosting, authentication, payments, communications, search, AI answers and diagnostics
When required by law or to protect our rights
In connection with a business transfer (merger, acquisition, etc.)
With your explicit consent

Your Rights

Your rights depend on applicable law and may include the rights below. Some tools are available in account settings; you may also contact us to exercise your rights or report an incomplete result. Where the GDPR applies, we normally respond within one month, subject to its permitted extensions and exceptions.

Right of access (Art 15): review the personal data we hold about you and how it is processed.
Right to rectification (Art 16): correct inaccurate or incomplete data — most fields can be edited directly in your profile.
Right to erasure (Art 17): request deletion of your personal data. Account settings include an account-deletion tool. Some records may need to be retained for legal obligations, security or the establishment, exercise or defence of legal claims; deletion is not a promise that every record disappears immediately.
Right to restriction of processing (Art 18): ask us to limit how we process your data while a dispute or accuracy question is resolved.
Right to data portability (Art 20): request an eligible machine-readable copy of your data. Account settings offer a JSON export; contact us if information you expect is missing.
Right to object (Art 21) and to withdraw consent (Art 7): opt out of marketing and object to processing based on legitimate interests.

You also have the right to lodge a complaint with your local data protection authority (GDPR Art 77).

Cookies and Consent

The cookie banner records your choice about optional website analytics. Your choice is stored in a first-party cookie_consent cookie for up to one year and controls the integrations connected to that setting. It is not a switch for all data processing. Some first-party product usage events, such as film views, searches and playback events, and technical diagnostics are processed separately from banner-controlled integrations. Sign-in, preferences, subscriptions and features you use also require information processing.

Functional cookies and storage

Authentication and session cookies that keep you signed in and secure your account.
The cookie_consent cookie itself, which records your consent choice.
Security and load-balancing cookies needed for the site to function.
Device preferences and Kids-mode state used to provide the selected experience.

These support service functionality rather than optional audience measurement. Browser settings can remove or block storage, but doing so may sign you out or affect saved device preferences.

Website analytics integrations

Google Analytics loads only if you accept optional analytics, because it stores identifiers on your device and shares data with Google.
Vercel Analytics is a privacy-preserving measurement tool that sets no cookie, stores nothing on your device and builds no profile of you. It runs by default so we can count how many people visit, on the legal basis of our legitimate interest in understanding our audience (GDPR Art 6(1)(f)). If you select “Reject non-essential”, we switch it off for you as well.

Rejecting these integrations does not prevent account functions, service activity records, security diagnostics, subscription processing or requested media from processing information. Kids features also process the information described in the Children's Privacy section below.

Third-Party Services

Services involved in delivering the product include:

Google Analytics: We use Google Analytics to analyze website usage and improve our services. Google may collect information about your browsing behavior.
Amplitude: After you accept analytics, we send a limited set of pseudonymous website product events to Amplitude. Our subscription service also sends pseudonymous lifecycle events so we can understand signup and subscription journeys. We do not enable Amplitude autocapture or session replay.
YouTube: Third-party videos may play in YouTube's official embedded player. Outside Kids, a player may use youtube.com after cookie acceptance and the privacy-enhanced youtube-nocookie.com host otherwise. Preview clips use the privacy-enhanced host. The Kids film player loads a privacy-enhanced embed after a play click. Loading or playing embedded media sends information, such as the IP address and device/request information, to its provider. Privacy-enhanced mode does not mean no data processing or no advertising. See Google's Privacy Policy and YouTube's embedding guidance.
Authentication Services: We may use third-party authentication services that set essential cookies for session management.
Payments: Stripe and, where used, app-store billing services process transactions and maintain their own payment records.
Search and AI answers: Search services process search terms. Kids questions may be sent to OpenAI for moderation and an answer based on Wikipedia material; Wikipedia is queried to find the source. Do not include private information in questions.
Diagnostics: Sentry helps us investigate technical failures using error reports, request/device information and sampled session replays. Replay is configured to mask text and block media; this is not a guarantee that diagnostic records contain no personal information.

The analytics cookie choice is not a blanket on/off switch for external media. A privacy-enhanced embed still connects to a third party, and links within a player can take you to that provider's service. Providers may process information in countries other than your own. Contact us for information about the providers and safeguards relevant to your request.

Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Data Retention

Retention depends on the purpose and type of record, whether you continue to use the feature, applicable legal obligations and the need to resolve disputes. Relevant considerations include:

Account, saved items and activity: used to maintain your account and requested features. You can manage available items in the product and request deletion, subject to applicable exceptions.
Analytics and diagnostics: kept according to the purpose and configured retention of the relevant system; aggregated information may be retained separately.
Billing records: may remain with us and payment providers after account deletion where required for accounting, tax, refunds or disputes.
Support, rights and security records: may be retained to handle an enquiry, prevent abuse or establish, exercise or defend a claim.
Cookie consent record: the cookie_consent cookie persists for up to one year, or until you clear it.

Where data must be retained for legal reasons after you delete your account (for example, billing records), we restrict its processing to that legal purpose only.

Data Breach Notification

We assess security incidents and provide notifications required by applicable law. Where GDPR notification duties apply, these can include notifying the competent authority without undue delay and, where feasible, within 72 hours, and notifying affected people where the breach is likely to result in a high risk to their rights and freedoms.

Children’s Privacy

Kids is a parent-managed experience for primary-school children ages 6–10. It includes documentary discovery, saved items, viewing history, recommendations and search answers. These features process information; Kids is not a no-data-collection service.

Device and parent settings: Kids-mode state and a device identifier link the experience to the managing parent's account. An optional exit PIN is stored as a hash, not as the plain PIN.
Activity and saved content: where the feature is used with an authenticated account, film-view and playback events, saved articles and playlists can be associated with that account. History and saved interests support recommendations.
Questions: search terms are processed to find films and, where an answer is available, to moderate and generate a Wikipedia-grounded answer through the providers described above. A generated answer can be wrong; children should not enter names, contact details or other private information.
Media and security: playing a YouTube video involves YouTube's processing. Necessary service and security requests continue even when optional analytics are off.

Parents can manage Kids settings and review or clear available Kids watch history in account settings. Contact us to ask about, access, correct or request deletion of information associated with your child's use, or to raise a privacy concern. We may need to verify your authority before releasing information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last updated” date.

Contact Us

For privacy questions, rights requests or complaints, contact iwonder Pte Ltd at 1 Keong Saik Road, Singapore 089109, telephone +65 6027 6855, or support@iwonder.com. Please identify your request as a privacy matter.