Privacy policies are long partly because length discourages reading. But you don't need to read one end to end. You need about five specific facts, and they live in roughly the same places every time. Here is the order I'd go looking.
Start with the App Store label, not the policy
Every app on the App Store has to declare what it collects, and Apple shows it on the listing page under “App Privacy”. It takes ten seconds and it is the single most useful thing on the page. Three categories appear:
“Data Not Collected” is a strong, public claim a developer can be held to. Treat “Data Linked to You” as the one that matters — that's information tied to your child rather than floating free.
It is self-reported, so it isn't proof. But a developer who declares one thing here and another in their policy has handed you a very clear signal.
- Data Used to Track You — the worst category in a children's app; there is rarely a good reason.
- Data Linked to You — tied to an identity, so it accumulates into a profile.
- Data Not Collected — the claim worth looking for.
Then find one thing in the policy: where does the data live?
Search the policy (⌘F works on a phone browser too) for “server”, “store” and “retain”. You are trying to answer one question: does your child's information sit on their computers, or on your phone?
On-device storage means a breach of the company doesn't expose your child, because there was nothing of your child's to breach. It is the single biggest structural difference between two apps that otherwise look identical.
Look for how long they keep it
“We retain personal data for as long as necessary to provide the service” means indefinitely, written politely. A policy that gives an actual number — thirty days, twelve months — has thought about it and is willing to be held to it.
Absence of a retention period is not a scandal, but it does tell you nobody has been asked the question before.
Check whether an account is required
No account means no central database of children, and that removes a whole class of risk at once — no credential stuffing, no list to sell if the company is acquired, nothing to hand over if it is compelled to.
If an account is required, look for why. Syncing between a phone and an iPad is a real reason. “To personalize your experience” usually is not.
Find out whether your child's words train a model
Any app with AI in it sends what your child types to a model somewhere. The question is what the provider is permitted to do with it afterwards.
Consumer accounts with AI providers often permit training on your input by default. Business agreements generally forbid it. A kids' app should be using the second kind and should be willing to say so in a sentence.
Read “COPPA compliant” carefully
COPPA is the US law covering children under 13, and it is real and enforceable. But the phrase “COPPA compliant” on a marketing page is almost always the developer's own assessment, not a certification.
There are FTC-approved Safe Harbor programs — kidSAFE, PRIVO, ESRB among them — that audit and certify. Those come with a badge you can click through and verify on the certifier's own site. If certification matters to you, check for the badge rather than the phrase.
Third-party SDKs are where it usually goes wrong
Most children's data doesn't leak because a developer was malicious. It leaks because they dropped in an analytics or advertising SDK to see how the app was doing, and that SDK quietly collects far more than they realised.
The policy section listing third parties is worth a glance. A children's app with a long list of advertising partners has made its choice.