Privacy Policy

At KidFounders, your family's privacy is a top priority. Because our service is designed for children ages 8–14, we take extra care to comply with the Children's Online Privacy Protection Act (COPPA) and to keep every family's data safe.

This policy explains what information we collect, why we collect it, and how you can control it. We've written it in plain language so it's actually readable—no legalese, no fine print.

1. What We Collect

From parents (account holders):

• Name and email address (to create and manage your account)
• Payment information (processed securely by Stripe; we never store card numbers)
• Communication preferences

From children (with parental consent):

• First name or nickname (for personalizing the experience)
• Age (to ensure age-appropriate content)
• Lesson progress, quiz answers, and activity submissions
• Portfolio content children create within the app (business plans, drawings, etc.)
• Messages your child sends to the AI business coach, and the coach's replies (saved to your family account)

Automatically collected:

• Device type and browser (to ensure the app works well on your device)
• General usage data (pages visited, features used) to improve the experience
• On our public pages, a first-party visitor cookie and a page-view record (the page you landed on and the campaign link that brought you here) so we know which marketing works. We use no third-party tracking cookies or scripts.

We do not collect precise location data, social media profiles, contact lists, or any information beyond what is listed above.

2. How We Use It

• Provide, personalize, and improve the KidFounders learning experience
• Track progress so parents and kids can see how they're doing
• Process payments and manage subscriptions
• Send important account-related emails (receipts, security alerts)
• Respond to support requests

We never sell your data. We never share children's information with third-party advertisers. Period.

3. Children's Privacy (COPPA)

We are committed to protecting children's privacy online. Here is how we do it:

• Parents create every child profile. A parent or legal guardian creates the family account with a verified email address and adds each child profile themselves. Adding a profile is how consent is recorded, and nothing about a child is collected before that.
• Kids do not provide data directly. All account management (email, payment, settings) goes through the parent dashboard.
• Minimal data collection. We only collect what is needed to deliver the learning experience.
• No behavioral advertising. We do not target ads to children. KidFounders is ad-free.
• Parents can review and delete. You can view, edit, or delete a child's profile at any time from your parent dashboard. To delete the whole family account, email us and we will remove it within 30 days.

4. Data Security

We use industry-standard security measures to protect your information:

• All traffic is encrypted in transit (TLS)
• Parents sign in with a passkey or an emailed magic link, so there is no parent password to steal
• Kids' PINs are hashed with bcrypt and never stored in plain text, and repeated wrong guesses lock the profile
• Payment processing is handled by Stripe (PCI-DSS certified); card numbers never reach our servers
• Every page is served with HTTPS-only, content-security-policy and anti-clickjacking headers
• Access to personal data is limited to essential team members

5. Your Rights

As a parent or guardian, you have the right to:

• Access the personal information we hold about you and your child
• Correct inaccurate information
• Delete your account and all associated data
• Withdraw consent for your child's data collection
• Receive a copy of your data

Child profiles can be edited or deleted from your parent dashboard. To delete the whole family account, receive a copy of your data, or withdraw consent, email us at the address below; we complete these requests within 30 days.

6. Third-Party Services

We use a small number of trusted services to run KidFounders:

• Stripe for payment processing
• Resend for transactional email
• Render for hosting (our servers and database run in Render's Oregon, USA region)
• Anthropic for the AI business coach (your child's coach messages are sent to Anthropic to generate replies under its commercial terms, which do not allow training on that data)

Each of these services has their own privacy policy and is contractually obligated to protect your data.

7. Changes to This Policy

If we make meaningful changes to this policy, we will notify you by email and update the date at the top. We encourage you to review this page periodically.