Data Security & Privacy Plan

Puppet Pals 2 is a creative animation app family developed by Polished Play LLC. The standard app is intended for families and individual users. The one-time-purchase School Edition is intended for classroom use and may be distributed through Apple School Manager and a mobile device management system.

This plan applies to the current shipped versions of the standard app (App Store ID 589141096) and School Edition (App Store ID 557616416). Both editions currently share the no-collection posture described in this document.

The plan is intended to help educational agencies evaluate the product against requirements such as FERPA, COPPA, GDPR, and applicable local policy. It is a description of current practices, not a certification or a substitute for an agency's legal review.

If a future public release changes these data practices, Polished Play will update this plan, the privacy policy, and the applicable App Store privacy disclosures before that release is made available.

Polished Play does not collect information from users through the current Puppet Pals 2 apps. Neither edition sends:

• Names, email addresses, or other contact information
• User, student, or staff account identifiers
• Analytics events, advertising identifiers, or usage history
• Device identifiers or device-level technical profiles
• Movie recordings, custom faces, or other student-created work

Projects and imported media are saved locally by each app. They are not backed up, synchronized, or hosted by Polished Play. A school's device settings, backup configuration, and MDM policies may independently affect how local files are handled.

Administrative safeguards focus on preserving the current apps' no-collection posture:

• Changes that would introduce data collection require privacy and security review before release, together with updates to the applicable policy documents.
• Polished Play personnel are trained on privacy requirements relevant to children and educational technology, including FERPA, COPPA, and GDPR.
• Polished Play does not sell, rent, or use Puppet Pals 2 user data for advertising or profiling.
• Security and privacy questions from educational agencies are reviewed by the product owner.

• User-created content is processed and stored locally on the device rather than on Polished Play infrastructure.
• The current editions do not include user accounts, cloud project storage, advertising, or third-party analytics and tracking SDKs.
• Both editions include an operating-system-mediated ClassKit integration for Apple Schoolwork. On supported school-managed devices, it marks a “Make a movie” activity as started or stopped in Apple's CLSDataStore; that activity data is not sent to Polished Play.
• App updates and corrected versions are distributed through Apple's App Store infrastructure.

The current editions have no Polished Play-hosted user data path and do not embed subprocessors for analytics, ads, accounts, or cloud project storage. Apple is involved in app acquisition and distribution and, on supported school-managed devices, an operating-system-level Schoolwork activity. Neither is a Polished Play student-content service.

Apple distribution

Operates the App Store and Apple School Manager systems used to purchase licenses, distribute the app, and deliver updates. Apple handles those records under its own terms; Puppet Pals 2 projects are not uploaded to Polished Play through this distribution path.

Apple Schoolwork

Both editions include Apple's ClassKit framework. On supported school-managed devices, it exposes a “Make a movie” classroom activity and records its start and stop state in the operating system's CLSDataStore. This is an Apple- and school-managed path; Polished Play does not receive the ClassKit activity data.

Email sent separately to Polished Play for procurement or support is outside the app's data flow and necessarily includes whatever information the sender chooses to provide. Schools should avoid including student information in those messages.

Keeping user-created work off Polished Play systems substantially reduces the impact of a service-side incident, but it does not eliminate software-security risk. If a confirmed incident affects either current edition or information associated with a school deployment, Polished Play will:

• Investigate and begin containment upon discovery.
• Notify affected educational agencies within 72 hours of confirming the incident, when agency information is available and notification is applicable.
• Describe the nature and timing of the incident, the information involved, the remediation taken, and a contact for follow-up.
• Release a corrected version through the App Store when an app update is required.
• Cooperate with affected agencies and regulators as required by applicable law.

Polished Play does not receive or retain user PII or user-created content from either current edition. There is no Polished Play-hosted student dataset to delete at the end of a deployment.

Projects remain on the device and are controlled by the user or educational agency managing it. The school is responsible for local retention, backup, export, and deletion through its device-management and records-retention procedures. Apple controls App Store license and transaction records under its own policies.

Because the current Puppet Pals 2 editions do not store user information or projects on Polished Play systems, there is no hosted data to return to an educational agency when a deployment ends. Student work remains on school-managed devices and can be handled according to the school's local export, transfer, and disposal procedures.

The apps' local-storage design and lack of user accounts are intended to simplify institutional privacy review. Polished Play will respond to reasonable questions about the current product and its data paths.

If a district requires a vendor questionnaire, data privacy agreement, or written confirmation of a product behavior, contact privacy@polishedplay.com. Requests are evaluated according to their scope and proposed terms.

The following table maps the current Puppet Pals 2 apps' posture to the five functions used by NIST Cybersecurity Framework 1.1. It is a descriptive mapping and does not represent certification by NIST or an independent security audit.

IDIdentify

The current Puppet Pals 2 editions do not create user accounts or send user-created work to Polished Play. The product data inventory is therefore limited to the app binaries and their distribution records; creative projects remain on users’ devices.

PRProtect

Protection begins with data minimization: no user PII, analytics, advertising identifiers, cloud project storage, or third-party tracking SDKs are included in the current shipped editions.

DEDetect

Detection focuses on software integrity, reports of unexpected network behavior, and security concerns affecting the distributed apps. Because app content does not flow through Polished Play systems, Polished Play does not monitor projects or classroom activity.

RSRespond

Reported vulnerabilities are investigated and contained, affected educational agencies are notified when applicable, and corrected app versions are distributed through the App Store.

RCRecover

Recovery consists primarily of restoring a trustworthy app version through an update. There is no user-created content on Polished Play systems to restore; users and schools retain control of projects stored on their devices.

For questions about this plan, a procurement review, or Puppet Pals 2 data practices, contact privacy@polishedplay.com.