Privacy Policy
Last updated: October 13, 2026
The short version
- Bot Cadets is an AI literacy course for kids ages 8 to 12. Only parents can create accounts.
- From your child, we collect a nickname, an avatar choice, a grade band, lesson progress, mastery check results, and the short final-project text your child types. Like any website, we also receive technical data such as an IP address and a login cookie, which we use only to keep the site working and keep your child signed in.
- We never ask for your child's real name, email, photo, voice, or location. There is no chat with a real AI and no chat with other people.
- We use this information only to run the course, keep it secure, and show you your child's progress.
- We do not sell or share it. We do not show ads. We do not use third-party analytics or trackers.
- You can see, download, or delete your child's information at any time in Settings, or by emailing mrcarterpark@gmail.com.
This policy explains what information Bot Cadets collects, why, how long we keep it, and the choices you have. It includes our notice about children's information under the Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule (16 CFR Part 312).
Bot Cadets is currently a free beta. The beta does not take payments.
1. Who we are and how to reach us
Bot Cadets is operated by [OPERATOR LEGAL NAME] ("Bot Cadets," "we," "us").
| mrcarterpark@gmail.com | |
| Mailing address | [MAILING ADDRESS] |
| Phone | [PHONE] |
We are the only operator that collects or keeps personal information from children through Bot Cadets. If you have a question about your child's information, contact us using any of the methods above.
2. Who this policy covers
- Parents and guardians who create a Bot Cadets account.
- Children who use Bot Cadets through a profile their parent creates.
- Visitors who join our waitlist or browse our public pages.
Bot Cadets is designed for children under 13 and is set up so that children cannot sign up on their own. Every child profile is created by a parent after the parent gives consent.
3. Information we collect from children
A child can only use Bot Cadets after a parent creates their profile and gives consent. Inside the course, we collect:
| Information | Where it comes from | Why we need it |
|---|---|---|
| Nickname | Chosen by the parent or child when the profile is made | So Bit can greet your child and you can tell profiles apart |
| Avatar choice | Picked from a set of pre-made avatars | To show your child's picture in the course |
| Grade band | Chosen by the parent | To show the right version of the course |
| Lesson progress, including which units are done and a simple streak (the days your child completed lessons) | Created as your child moves through lessons | To save your child's place and show you progress |
| Mastery check results | Created when your child answers check questions | To unlock the next skill and show you which skills are mastered |
| Final-project text (two short answers, up to 300 characters each) | Typed by your child in the final project | To save your child's work and show it to you |
| Technical data: IP address, browser type, and a login cookie | Received automatically when your child uses the course | To deliver the pages, keep your child signed in, and protect the site. See Section 5. |
What we do not collect from children: real name, email address, phone number, home address, school name, photos, video, voice recordings, precise location, contacts, or any other contact information. Children cannot upload files.
About the final project. In the final project, your child types a short piece of writing. We ask children not to type their real name or other personal details, and we remind them on screen. Because this is free text, a child could still type something personal. This text is visible only in your parent account. It is never posted publicly or shown to other users.
About Bit. Bit, our robot guide, is fully scripted. Everything Bit says was written ahead of time by our team. Children choose from answers on screen and never type into a live AI system. Nothing your child does is sent to an AI company.
There are no social features. Children cannot message, chat with, or see other users.
4. Information we collect from parents
| Information | Why we need it |
|---|---|
| Your name, email address, and password | To create and secure your account and send you account emails. Passwords are stored by our authentication provider in hashed form, so we cannot read them. |
| Consent record: your typed name, the boxes you checked, the date and time, and the notice version you agreed to | To keep a record that you gave consent, as COPPA requires |
| Your email preference (whether you want occasional Bot Cadets updates) | To respect your choice |
| Settings and requests | To carry out your choices, such as exports and deletions |
| Messages you send us | To answer you |
Waitlist visitors: if you join the waitlist, we collect your email address and, if you choose to tell us, your children's ages, your state, how you heard about us, and whether you want updates. We use this to tell you when a spot opens and to plan the beta. We do not collect any information from children on the waitlist. You can ask us to remove your entry at any time.
5. Information collected automatically
When anyone visits Bot Cadets, our hosting provider automatically receives technical information that every website receives, such as IP address, browser type, and the pages requested. We also use one type of cookie: an essential login cookie that keeps you or your child signed in.
We use this information only for what the COPPA Rule calls "support for the internal operations" of the service:
- keeping the site running and fixing errors,
- keeping you signed in (authentication),
- protecting the site from abuse, fraud, and security threats, and
- meeting legal requirements.
We do not use it to contact anyone, build profiles about anyone, show ads, or track anyone across other websites. To keep it that way, we:
- use no advertising cookies, no third-party analytics, no tracking pixels, and no social media plug-ins,
- do not combine this technical information with your child's profile for any other purpose, and
- keep server logs only for the short period set out in our Data Retention Policy.
Do Not Track. We do not track visitors across websites, so we treat every visitor the same way whether or not their browser sends a Do Not Track or Global Privacy Control signal.
6. How we use information
We use the information described above to:
- provide the course, save progress, and unlock the next lesson,
- show you your child's skills, final project, and dinner-table questions in your parent dashboard,
- send you account emails, such as consent confirmation, password resets, and important notices,
- respond to your questions and requests,
- keep Bot Cadets safe and secure, and
- improve the course using our own review of how lessons are working. When we do this, we use our own internal data only and never send it to an analytics company.
We do not use children's information for any other purpose. We will not send marketing emails to children (children have no email on Bot Cadets). We may send you, the parent, occasional updates about Bot Cadets, and you can turn these off at any time.
7. What we do not do
- We do not sell personal information.
- We do not share personal information for advertising, including "cross-context behavioral advertising."
- We do not show ads of any kind.
- We do not disclose children's personal information to third parties. The only companies that handle it are the service providers in Section 8, which process it for us to run Bot Cadets and may not use it for anything else.
- We do not make children's information public.
- We do not use children's information to train AI models, and we do not send it to AI companies.
8. Service providers
We use a small number of service providers to run Bot Cadets. They process information only on our behalf and only to provide their service to us. Before giving them access, we took steps to confirm they can protect it, and we rely on their written data protection terms.
| Provider | What they do for us | What information they handle | Where |
|---|---|---|---|
| Vercel Inc. | Hosts the website | Technical request data such as IP address. Account and course data pass through Vercel's servers on their way to the database. | [VERCEL REGION, e.g., United States] |
| Supabase Inc. | Login (authentication) and our database | Parent email, hashed password, consent record, child profiles, progress, mastery results, final-project text, and sign-in logs that include IP address and browser type | United States (Northern California, us-west-1) |
| Resend | Sends account emails | Parent email address and the content of account emails | United States. Not in use yet: during the beta we don't send email through Resend. |
Legal requests. We may release information when the law requires it, such as to respond to a valid court order, or when it is needed to protect the security of Bot Cadets or the safety of a child, as the COPPA Rule permits.
If Bot Cadets is sold or merged. We will not transfer your child's information to a new owner unless we first tell you and get your consent using a method the COPPA Rule accepts for that kind of transfer. If you do not consent, we will delete your child's information.
9. How we get parental consent
Before a child can use Bot Cadets, a parent must:
- Create an account and confirm their email address by clicking the link we send.
- Read our direct notice explaining what we collect from children and why.
- Check the consent boxes and type their name.
After the parent gives consent, we send a separate follow-up email to confirm it. That email repeats the full notice, explains that the parent can withdraw consent at any time and how, and tells the parent to contact us if they did not give consent. A child profile can only be created after consent is recorded.
The COPPA Rule allows this email-based method (often called "email plus") only when an operator uses children's information internally and does not disclose it, meaning it does not release it to third parties or make it public. Sharing information with service providers that support our internal operations and use it for nothing else does not count as disclosure under the Rule. If we ever wanted to disclose children's information, we would first ask for new consent using a method the Rule accepts for disclosure.
If a parent does not finish consent within 30 days, we delete the parent's account and email address. No child profile can exist before consent.
10. Your rights as a parent
At any time, you can:
- Review the information we have about your child.
- Download it as a file (JSON format).
- Correct your child's nickname, avatar, or grade band.
- Delete your child's information.
- Withdraw consent and stop any further collection. This deletes your child's information and ends their access to the course.
- Delete your whole account, including all child profiles.
How to do it:
- In Settings: sign in, go to Settings, and choose View data, Download data, Delete child profile, Withdraw consent, or Delete account.
- By email or mail: contact us at mrcarterpark@gmail.com or [MAILING ADDRESS]. To protect your child, we will confirm you are the account holder before acting, usually by asking you to reply from the email address on the account.
We respond to emailed requests within 10 days. Deletions you start in Settings take effect right away in the app, and all copies are removed within 30 days, as described in our Data Retention Policy.
We will never charge you to use these rights, and we will not treat you differently for using them.
11. How long we keep information
We keep children's information only as long as it is reasonably needed to provide the course, and we never keep it indefinitely. Section 3 lists why we collect each type of information. We keep it because the course needs past progress and mastery results to decide what unlocks next, and your parent dashboard shows them to you.
- While your account is active: we keep your child's profile, progress, mastery results, and final project so they can keep learning and you can see their work.
- When you delete a profile, delete your account, or withdraw consent: we delete your child's information within 30 days.
- If your account is inactive for 24 months: we email you a notice. If you don't sign in, we delete the account and your child's information.
- Backups are overwritten on a rolling schedule. Deleted information is gone from backups within [BACKUP WINDOW, e.g., 7 days] after deletion from the live database, and always within the 30 days above.
- Technical logs (which may include IP addresses) are kept only for our providers' short standard log periods, listed in the Data Retention Policy.
Our full written Data Retention Policy is part of this notice. It explains why we collect each type of information, why we keep it, and when we delete it.
12. How we protect information
We keep a written information security program. In short:
- Information is encrypted in transit (HTTPS) and encrypted at rest by our hosting and database providers.
- Only [RESPONSIBLE PERSON] and people who need it to run Bot Cadets can access production data, and their admin accounts require multi-factor authentication.
- Database rules let each parent see only their own family's data.
- We review risks and update our safeguards at least once a year.
- If we learn of a security incident that affects your information, we will notify you as required by law.
Read the summary of our Security Program.
No system is perfectly secure. If you think your account has been compromised, contact us right away.
13. If a child signs up without a parent
Bot Cadets is set up so that only parents can create accounts. If we learn that we collected information from a child without verifiable parental consent, we will delete it promptly. If you think this has happened, contact us at mrcarterpark@gmail.com.
14. California privacy rights
Bot Cadets is based in California, and we give these protections to all families, wherever they live.
- No sale or sharing. We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act (CCPA). This applies to everyone, at every age, so the CCPA's opt-in rules for selling or sharing the information of consumers under 16 are never triggered.
- Your requests. You can ask us what personal information we have collected about you or your child, the sources, the purposes, and who we disclosed it to. You can also ask us to delete or correct it. Use Settings or contact us as described in Section 10. You may use an authorized agent, and we will ask for proof that the agent may act for you.
- Categories. In the past 12 months we collected: identifiers (email address, nickname, IP address), account login credentials, records of consent, and education-related information (lesson progress, mastery results, final-project text). We disclosed these only to the service providers in Section 8 for the business purposes described in this policy. We did not sell or share any of them.
- Sensitive information. The only sensitive personal information we collect is the login credentials for your account, which we use only to sign you in.
- Minors' content removal. Under California Business and Professions Code Section 22581, minors who are registered users can ask us to remove content they posted. On Bot Cadets, children do not post anything publicly, and a parent can delete the child's final-project text at any time in Settings or by contacting us.
- Direct marketing. We do not give personal information to anyone for their own direct marketing.
- No discrimination. We will not treat you differently for using any of these rights.
15. Changes to this policy
If we make a change to this policy, we will update the date at the top. If a change affects how we collect, use, or disclose children's information, we will email you before it takes effect and, where the law requires, ask for your consent again. We will not apply a material change to information we already collected without your consent.
16. Contact us
[OPERATOR LEGAL NAME] [MAILING ADDRESS] mrcarterpark@gmail.com [PHONE]