1. Who we are
Coinsprout Inc. ("Coinsprout," "we," "us") is a Delaware C-Corp headquartered at 175 S Third St, Suite 520, Columbus, OH 43215. We operate the Coinsprout website at coinsprout.tech and the Coinsprout service: short, AI-run money-skills missions for children ages 6 to 13, with accounts owned and managed by their parents or legal guardians ("parents"). This policy covers both the website and the service. It applies to everyone who visits or uses them, and it is written to satisfy the Children's Online Privacy Protection Act (COPPA) and applicable US state privacy laws.
2. What we collect from parents
When you create and use a parent account, we collect:
- Account information: your email address and a password, which we store only as a bcrypt hash. You may optionally add a display name.
- Plan and billing status: which plan you are on and whether it is active. Payments are processed by Stripe, Inc. We receive a customer reference, the last four digits of your card, and the card brand. We never receive or store your full card number.
- Support communications: messages you send us through our forms or by email, and our replies.
- Technical information: IP address, browser type, and the pages you request, kept in server logs for up to 30 days for security and troubleshooting. We do not use third-party analytics or advertising scripts.
We use this information to provide the service, process payments, respond to you, keep the service secure, and send you service messages such as receipts, security notices, and the weekly conversation starter if you have it turned on. We do not send marketing email without your separate opt-in, and every marketing email includes an unsubscribe link.
3. What we collect about children
Children do not create accounts, enter contact information, or interact with other users. All information about a child is provided by the parent or generated by the child's play within the parent's account. Specifically, we collect:
- A nickname chosen by the parent. We ask parents not to use a child's full legal name.
- An age band: 6 to 8, 9 to 11, or 12 to 13. We do not collect a birthdate or exact age.
- Mission results: the world played, the choices selected, the short typed answer a child gives to one in-story question per mission, and the debrief and parent note generated for that mission.
We do not collect, and the product has no fields for, a child's full name, photo, voice, location, address, school, email, phone number, or any persistent identifier beyond an internal profile ID within the parent's account. We do not use children's information for advertising, profiling, or training machine learning models, and we do not disclose it to third parties except the service providers described in section 5, who may use it only to provide the service to us.
4. COPPA notice and parental consent
Coinsprout is directed to children under 13 and is designed to be used by a child under a parent's supervision. Under COPPA, we must obtain verifiable parental consent before collecting personal information from a child. Here is how we do that:
- Only an adult can create an account. During signup you confirm that you are at least 18 years old and the parent or legal guardian of any child you add.
- Before you add your first child, we present this policy and a short summary of what we collect about children, and you must affirmatively agree.
- For paid plans, the payment transaction itself serves as an additional consent signal under COPPA's approved methods.
As a parent, you have the right at any time to review the information we have collected about your child, to have it deleted, and to refuse further collection. You can do all three from Settings, or by emailing privacy@coinsprout.tech. We will verify that the request comes from the parent account email before acting. Deleting a child profile removes all of that child's mission results. If you refuse further collection, the child cannot continue to play, since play necessarily generates mission results, but you may keep your parent account.
We will not condition a child's participation on disclosing more information than is reasonably necessary to participate, and we do not collect more than the items listed in section 3.
5. How we use AI providers
Mission text is generated by large language models operated by third-party providers. To generate each turn, we send the provider: the fixed scenario and safety rules we wrote, the child's age band, the child's nickname if the parent set one, and the story so far, including the choices selected and the short typed answer. We do not send the parent's email, account identifiers, billing information, or anything that would let the provider connect the mission to a specific family.
We use providers only under terms that prohibit them from using our content to train or improve their models, and that limit retention to what is needed to provide the service and prevent abuse. We may route requests to more than one provider and may change providers; the safety rules and this policy apply regardless of which provider generates a given turn. Every provider response is validated against a fixed schema and scanned for personal details and links before it is shown to a child.
Our other service providers are: a US-hosted managed database for storing account data; Vercel for hosting; Stripe for payments; and an email delivery service for transactional email. Each receives only the data needed for its function and may not use it for any other purpose.
6. Cookies
We use only essential cookies: a session cookie that keeps you logged in to your parent account, and a security token that protects forms against cross-site request forgery. Both are HTTP-only, same-site cookies that are not readable by scripts and are not shared with any third party. We do not use advertising cookies, analytics cookies, or any third-party tracking technology, and we do not respond to or need to respond to "Do Not Track" signals because we do no tracking. See our Cookie policy for details.
7. Retention
- Parent account data and child profiles: for as long as the account exists.
- Mission results: for as long as the child profile exists. Deleting a child deletes their mission results.
- Billing records: seven years after the transaction, as required by US tax and accounting rules. These contain no information about children.
- Support communications: two years.
- Server logs: 30 days.
When you delete your family from Settings, all data except billing records is removed from our production database immediately and from encrypted backups within 30 days.
8. Your rights
Regardless of where you live, you may:
- Access the information we hold about you and your children, by viewing it in your account or requesting a copy.
- Export it as a machine-readable JSON file from Settings.
- Correct it, by editing your account or child profiles, or by asking us.
- Delete it, in whole or per child, from Settings or by asking us.
- Object to any use you do not agree with, and withdraw consent for your child's participation.
To exercise a right by email, write to privacy@coinsprout.tech from your parent account email. We respond within 30 days and do not charge a fee. We do not sell personal information and have not done so in the preceding 12 months, so there is no sale to opt out of. We will not discriminate against you for exercising any right.
9. Security
We protect information with encryption in transit (HTTPS everywhere), bcrypt-hashed passwords, HTTP-only session cookies, server-side storage of all provider credentials, least-privilege access for staff, and a weekly dependency update cadence. Child mode is isolated from account settings and billing and cannot make external requests. No method of transmission or storage is perfectly secure; if we learn of a breach affecting your information, we will notify you by email without unreasonable delay and as required by law. Our security practices are described in more detail on the Security page.
10. Changes to this policy
If we change this policy in a way that materially affects how we collect or use children's information, we will notify parents by email to the account address and obtain renewed consent before the change applies to their children. For other changes we will update the effective date above and, where the change is significant, show a notice in the parent app. The current version is always at https://coinsprout.tech/privacy.
11. Contact
Privacy questions and requests: privacy@coinsprout.tech
Phone: (614) 555-0142, Monday to Friday, 9 to 5 Eastern
Mail: Coinsprout Inc., 175 S Third St, Suite 520, Columbus, OH 43215, United States
If you believe we have not handled your information in accordance with this policy, you may also contact the Federal Trade Commission, which enforces COPPA, or your state attorney general.