Data privacy and your rights

Your child's data is never a product. We built RocketPhonics under COPPA (the U.S. Children's Online Privacy Protection Act) and treat every piece of data like it belongs to you — because it does.

What we store

Parent account

• Name, email, hashed password
• Subscription plan + billing history (Stripe stores card details, not us)
• Consent records (when you accepted the Terms, Privacy Policy, and COPPA consent)

Child profile

• First name and age
• Avatar (either your uploaded photo or a character we provide)
• Progress data: which lessons they've completed, how they scored, how many minutes they played
• Adaptive-learning signals: which letter sounds need more practice

What we explicitly do NOT store

• Your child's last name
• Your child's email, phone number, or address
• Location data (we don't use GPS)
• Microphone recordings (lessons ask the child to echo sounds, but audio is processed on-device and discarded)
• Anything your child types — we don't ask them to type free text
• Behavioral advertising profiles. Zero. We don't run ads.

COPPA compliance in plain English

COPPA is a U.S. law that says apps for kids under 13 can only collect data from a child if the parent consents. Here's how we handle it:

1. You create the account — not your child.
2. You verify your email before any child profile can be added. This is the "email-plus" verification method the FTC blesses under 16 C.F.R. § 312.5(b)(2).
3. You approve every piece of data we collect by adding the child profile. We only collect the minimum needed for the app to work.
4. You can revoke consent any time — just delete the child profile. All of their data is scheduled for deletion immediately.

Your parental rights

As a parent, you have the right to:

• See everything we have about your child. Use the Export data button in Settings → Privacy. You'll get a JSON file with every progress record, consent timestamp, and profile field.
• Correct any inaccuracy. Change a name, age, or avatar anytime from the child's settings.
• Delete all data permanently. From Settings → Privacy → Delete my account, a full wipe happens within 30 days and we send a confirmation email. Nothing survives in backups past 90 days.
• Withdraw consent at any time. Deleting a child profile revokes consent for that child.

Who we share data with

We share data only with a small number of service providers, each contractually bound to treat your data as confidential and delete it on request:

• Supabase — our database and auth provider (data lives in U.S. regions)
• Stripe — payment processing only; they see your card, we don't
• Resend — transactional email delivery (receipts, verification, weekly digest)
• Vercel — hosting for the website and API routes

We do not sell, rent, or share data with advertisers, data brokers, or social media companies.

Law-enforcement requests

If law enforcement sends a valid subpoena or warrant, we comply with the minimum required. We notify the account holder unless legally prohibited.

Questions

Full details live in our Privacy Policy. For anything specific to your account, email privacy@rocketphonics.com — that address goes to a human who can pull your records and answer within 48 hours.