COPPA Compliance

What Is COPPA?

The Children's Online Privacy Protection Act (COPPA) is a United States federal law that protects the privacy of children under 13 years of age. It requires operators of websites and online services directed at children to obtain verifiable parental consent before collecting personal information from children.

1. Data We Collect From Children

We collect only the minimum information necessary to provide our educational services. Child data is always created and managed through a parent/guardian account.

Information collected:

• First name or nickname — chosen by the parent for display within the app (we recommend using a nickname rather than a full name)
• Age or age range — used solely to deliver age-appropriate educational content and difficulty levels
• Avatar selection — a pre-set character image, not a photo
• Game progress and scores — educational performance data displayed on the parent dashboard
• Skill assessment results — used to personalize the learning experience
• Workbook exercise responses — answers to educational exercises
• AI coaching interactions — questions asked to ThinkBot (not stored permanently; used only for the active session)

Information we do NOT collect from children:

• Email addresses
• Phone numbers
• Physical addresses
• Photos or videos
• Geolocation data
• Social media identifiers
• Persistent identifiers for behavioral advertising

2. Parental Consent Process

We require verifiable parental consent before any child data is collected:

1. Account creation — Only a parent or guardian (age 18+) can create an account using their email address
2. Child profile setup — The parent creates child profiles through their authenticated dashboard
3. Consent acknowledgment — Parents must acknowledge our privacy practices during the onboarding process
4. Ongoing control — Parents retain full control over child profiles and can modify or delete them at any time

3. How Parents Can Review and Delete Data

Parents and guardians can:

Review data:

• View all child profiles from the parent dashboard
• See game progress, scores, and achievements
• Review skill assessment results
• Request a complete data export by emailing us

Modify data:

• Edit child name, age, and avatar from the dashboard
• Reset game progress and scores

Delete data:

• Delete individual child profiles from the dashboard
• Request complete account deletion (removes all child data within 30 days)
• Email privacy@thinkquestai.com with subject line "Data Deletion Request"

4. No Behavioral Advertising

ThinkQuest AI does not display advertising of any kind to children. We do not:

• Show behavioral or targeted advertisements
• Share child data with advertising networks
• Use child data for marketing purposes
• Create advertising profiles based on children's activity
• Allow third-party trackers that target children

Our revenue comes from parent subscriptions and one-time digital product purchases, not from advertising.

5. Data Sharing

We do not sell, rent, or share children's personal information with third parties, except:

• Service providers — Supabase (database hosting), Vercel (application hosting), and Anthropic (AI coaching) process data on our behalf under strict contractual obligations
• Legal requirements — If required by law, court order, or to protect the safety of a child

6. Data Security

We protect children's data through:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security (RLS) ensuring data isolation between accounts
• Regular security audits and updates
• Minimal data collection principle (we only collect what we need)
• Secure authentication through Supabase Auth
• No public-facing child data (all child content is private to the parent account)

7. Data Retention

• Active accounts — Child data is retained as long as the parent account is active
• Deleted profiles — Child data is permanently deleted within 30 days of profile deletion
• Inactive accounts — Accounts inactive for 24 months will receive a notification before data is archived or deleted
• AI interactions — ThinkBot conversation data is session-based and not permanently stored

8. Safe Harbor

ThinkQuest AI is committed to working with the FTC and adhering to COPPA Safe Harbor guidelines. We regularly review our practices to ensure ongoing compliance.

9. Updates to This Policy

If we make material changes to our children's data practices, we will notify parents by email and obtain new consent where required by law.

10. Contact the COPPA Team

For questions about our COPPA compliance or to exercise your parental rights:

• Email: privacy@thinkquestai.com
• Subject line: "COPPA Inquiry"
• We will respond within 5 business days