Privacy Policy

1. Who We Are (Operator Identification)

SparkForge is operated by SparkForge LLC ("we," "us," or "our"). SparkForge is a gamified AI learning platform designed for children ages 7–16.

This Privacy Policy describes our practices regarding the collection, use, and disclosure of personal information from children and parents/guardians who use SparkForge. We comply with the Children's Online Privacy Protection Act (COPPA) and the 2025 COPPA Rule Amendments (16 CFR Part 312).

2. Information We Collect

We collect only the minimum information necessary to provide the SparkForge learning experience. Children are never required to disclose more information than is reasonably necessary to participate in any activity.

2a. Parent/Guardian Account Information (Actively Provided)

• Email address (for account creation and communication)
• Password (stored as a cryptographic hash — we never store plaintext passwords)
• COPPA consent timestamp (date and time parental consent was given)
• Subscription tier and billing status (Free, Plus, or Forge)
• Stripe customer ID (for paid subscriptions only — payment details are held by Stripe, not by us)
• Authentication factors: passkey public keys (WebAuthn credential IDs), MFA backup codes, and account-recovery tokens when you choose to enable them

2b. Child Profile Information (Created by Parent)

• Display name (chosen by the parent — no real name required)
• Age band (A: 7–9, B: 10–12, C: 13–16 — used for content difficulty, not stored as exact birthdate)
• Avatar configuration (visual appearance selections)
• Learning preferences (optional content personalization)

2c. Automatically Collected Usage Data

• Game progress: scores, completion status, rounds played
• XP (experience points), level, badges earned, and streak data
• Session duration (time spent on platform per session)
• Prompt Lab interactions: text prompts submitted to the AI learning tool (ages 14–16 only)
• Security event logs: login timestamps, IP addresses, user-agent strings, MFA challenges, and administrative actions retained for a bounded period for abuse prevention and security monitoring

2d. Information We Do NOT Collect

• Real names of children (display names only)
• Birthdates or exact ages (age bands only)
• Photos, videos, or voice recordings
• Geolocation or GPS data
• Biometric identifiers (fingerprints, facial templates, voiceprints)
• Government-issued identification numbers
• Contact information from children (email, phone, address)
• Social media accounts or friend lists

2e. No Conditioning on Unnecessary Disclosure

Consistent with 16 CFR § 312.7, SparkForge does not condition a child's participation in any game, lab, activity, or feature on the child disclosing more personal information than is reasonably necessary for that activity. For example, gameplay in any of the 35 labs is available without the child providing free-text input; the Prompt Lab game (which does accept free-text input) is limited to age band C (ages 14–16) and is never a prerequisite for earning XP, leveling up, or completing any lab.

3. How We Use Information

4. Third-Party Services

We share limited data with the following third-party services solely to operate SparkForge. No child data is shared with advertisers, data brokers, or any party for the purpose of targeted advertising or profiling.

Parents may consent to our collection and use of a child's information without consenting to disclosure to third parties, except where disclosure is integral to the service (e.g., Supabase for data storage).

5. Parental Consent Process

SparkForge requires verifiable parental consent before collecting any personal information from children under 13. Our consent process:

1. Parent account creation: Only adults (18+) can create a SparkForge account.
2. Age confirmation: The parent confirms they are at least 18 years of age.
3. COPPA consent checkbox: The parent explicitly checks a consent box acknowledging they have read this Privacy Policy and consent to their child's use of SparkForge.
4. Consent recorded: The exact timestamp of consent is stored in our database.
5. Child profile creation: Only after consent is recorded can the parent create a child profile.

If we do not receive verifiable parental consent, we will not collect personal information from the child and will delete any parent contact information collected during the consent process within a reasonable time.

5a. VPC Method Used

SparkForge uses the "email-plus" method of Verifiable Parental Consent permitted under 16 CFR § 312.5(b)(2)(iii). The process is:

1. A parent creates the account and provides their email address.
2. The parent verifies the email by clicking a confirmation link sent to that address.
3. The parent checks a COPPA consent checkbox affirmatively acknowledging this Privacy Policy.
4. A server-side timestamp of the affirmative consent action is recorded and retained for at least three years.
5. Before the child's first interaction, a confirmation email is sent to the same verified address summarizing the consent granted and explaining how to revoke it at any time.

Under COPPA 16 CFR § 312.5(b)(2), the email-plus method is valid only when a child's personal information is used solely for internal operations and is not disclosed to third parties other than service providers acting on SparkForge's behalf under written agreements with equivalent safeguards (see Section 4).

5b. Separate Consent for Third-Party Disclosure

As amended by the FTC in 2025, COPPA requires separate verifiable parental consent before any third-party disclosure of a child's personal information that is not covered by a service-provider relationship (e.g., targeted advertising, cross-service profiling, disclosure to data brokers). SparkForge does not currently engage in any such disclosures and therefore does not seek separate VPC beyond the email-plus method above. If this ever changes, we will obtain separate affirmative parental consent using a higher-bar VPC method (such as a verified payment-card transaction, government-ID match, or live video-call verification) before the new disclosure begins, and we will update this Privacy Policy and notify existing parents in advance.

6. Parental Rights

Parents and legal guardians have the following rights under COPPA. You may exercise these rights at any time.

To verify your identity when exercising parental rights, we may ask you to confirm account credentials or respond to a verification email sent to your registered email address.

7. Data Retention Policy

Per the 2025 COPPA amendments, we maintain a written data retention policy. We do not retain children's personal information indefinitely.

Absolute maximum retention. Consistent with 16 CFR § 312.10 (as amended in 2025), no category of children's personal information is retained indefinitely. Except where a longer period is required by a specific legal obligation (for example, Stripe invoice records that must be retained for tax-audit purposes), the maximum retention for any child's personal information is three (3) years from the last active use of the associated account, after which the data is deleted or irreversibly de-identified.

8. Data Security Program

Per the 2025 COPPA amendments, we maintain a written children's personal information security program with safeguards appropriate to the sensitivity of the data we collect. Our security measures include:

• All data transmitted via TLS/HTTPS encryption
• Database encryption at rest (Supabase managed PostgreSQL)
• Row Level Security (RLS) policies on every database table — users can only access their own data
• Passwords stored using industry-standard cryptographic hashing (bcrypt via Supabase Auth)
• Rate limiting on all API endpoints to prevent abuse
• SECURITY DEFINER functions with locked search paths to prevent SQL injection
• Content Security Policy (CSP) headers to prevent cross-site scripting
• Multi-layer AI content moderation (regex pattern matching + LLM safety screening)
• Sentry error reporting configured to strip child PII before transmission
• Regular code audits and automated security testing

We require all third-party service providers that receive children's data to maintain adequate security measures consistent with this policy.

8a. Written Children's Information Security Program (2025 Amendment)

The 2025 COPPA amendments (16 CFR § 312.8) require operators to establish, implement, and maintain a written children's personal information security program with safeguards appropriate to the sensitivity of the data, the operator's size, and its business activities. Our program includes:

• Designated responsible party: the SparkForge LLC Privacy & Security Lead identified in Section 1 holds documented accountability for the program and is the point of contact for all COPPA obligations.
• Annual risk assessment: at least once every twelve (12) months, we review the confidentiality, integrity, and availability risks to children's personal information and update safeguards accordingly.
• Written service-provider agreements: every third party that processes children's personal information on our behalf is under a written data-processing addendum (DPA) requiring security and confidentiality safeguards at least as protective as those in this Section 8.
• Incident response and breach notification: we maintain documented incident-response procedures and notify affected parents and applicable regulators within the timeframes required by the strictest applicable federal or state law (see Section 16).
• Access control and audit logging: access to systems holding children's PI is role-based, least-privilege, and logged; administrative access requires multi-factor authentication.

9. Cookies & Persistent Identifiers

SparkForge uses a limited set of cookies and persistent identifiers strictly for "support for internal operations" as defined under COPPA. We do not use cookies or persistent identifiers for behavioral advertising, user profiling, or cross-site tracking.

We do not use any analytics cookies, advertising pixels, or third-party tracking scripts.

10. Advertising & Monetization

11. Demo Mode

SparkForge offers a demo mode that allows exploration without account creation. During a demo session:

• Sessions are limited to 1 hour maximum
• No personal information is collected or stored
• A temporary session cookie (sparkforge-demo-active) tracks session timing only
• All demo session data is discarded when the session expires
• Game progress, XP, and achievements are not saved

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. If we make material changes that affect how we collect, use, or disclose children's personal information, we will:

• Post the updated policy on this page with a new effective date
• Send email notification to all registered parent accounts
• Obtain new parental consent before applying material changes to existing child data

13. Contact Us

For privacy-related inquiries, parental rights requests, or COPPA-related questions:

14. State Privacy Law Disclosures

In addition to the federal protections above, residents of certain U.S. states have additional rights under comprehensive state privacy laws and state-specific children's/teens' codes. The table below summarizes applicability; the California and Maryland subsections below describe rights in greater detail.

14a. Notice to California Residents (CCPA/CPRA)

California residents (parent account holders and, where applicable, teens aged 13–17 via a parent) have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know what personal information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Right to access a portable copy of the personal information we hold about you.
• Right to delete personal information, subject to a narrow set of statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt-out of sale or sharing of personal information. SparkForge does not sell or share personal information as defined under the CCPA/CPRA.
• Right to limit use of sensitive personal information. SparkForge does not use sensitive personal information beyond the narrow business purposes permitted by Cal. Code Regs. tit. 11, § 7027(l).
• Right to non-discrimination for exercising any of these rights.

Global Privacy Control (GPC): SparkForge honors the GPC browser signal. Because we do not sell or share personal information, GPC has no additional effect on our primary data flows; however, we treat GPC as an opt-out signal for any future analytics or advertising integrations.

Submit California rights requests by email to privacy@sparkforge-labs.com or by the Parental Rights page at /privacy/rights. We will verify identity (as described on that page) and respond within 45 days, extendable once by 45 days when reasonably necessary with notice.

14b. Notice to Maryland Residents (MD AADC)

Under the Maryland Age-Appropriate Design Code Act (HB 603), SparkForge configures default privacy settings to the highest level of privacy for users under 18, collects only the minimum personal data needed, does not use dark patterns that encourage minors to weaken privacy settings, and maintains a Data Protection Impact Assessment (DPIA) for features reasonably likely to be accessed by minors.

15. International Users & Cross-Border Transfers

15a. Primary Audience and Data Location

SparkForge is operated from the United States by an Illinois limited liability company and is primarily intended for users physically located in the United States. Personal information processed by SparkForge is stored in the United States using Supabase-managed infrastructure (AWS US regions). Certain operational telemetry is also processed in the United States by our service providers (see Section 4).

15b. Use of the Service from Outside the United States

If you access SparkForge from outside the United States, you understand that your personal information will be transferred to and processed in the United States. U.S. data-protection law may differ from the law of your country of residence. By using SparkForge from outside the United States, you consent to this transfer and processing. Where we are required to implement a specific transfer safeguard for your jurisdiction, we rely on the mechanism described below.

15c. Transfer Safeguards (EU/EEA, United Kingdom, Switzerland)

• Standard Contractual Clauses (SCCs). Where applicable, transfers of personal data from the EU/EEA to the United States rely on the European Commission's 2021 Standard Contractual Clauses, executed with each service provider that receives such data on our behalf.
• UK International Data Transfer Addendum (IDTA). Transfers from the United Kingdom rely on the ICO-issued IDTA, appended to the SCCs where the relevant service provider supports it.
• EU–U.S. Data Privacy Framework (DPF). Where a service provider is certified under the DPF, we additionally rely on that certification as an adequate transfer mechanism.
• Transfer impact assessments. For each service provider that processes data of EU/EEA, UK, or Swiss residents, we maintain a transfer-impact assessment (post-Schrems II) that considers U.S. surveillance-law exposure and supplemental measures (end-to-end encryption, jurisdictional data residency where available, and minimum-necessary data sharing).

15d. Digital Consent Age (GDPR Article 8)

Under Article 8 of the EU General Data Protection Regulation, the age at which a child can provide their own consent to information-society services defaults to 16 and may be lowered by each Member State (typically to 13, 14, or 15 depending on jurisdiction). SparkForge is designed so that a parent or legal guardian is the contracting party regardless of the child's age, which satisfies the parental-authorization prong of GDPR Article 8 where that prong applies. Teens aged 13–17 in the United Kingdom and EU/EEA retain the data-subject rights described in Section 15f below.

15e. Canada & Australia

Canadian residents are protected by the Personal Information Protection and Electronic Documents Act (PIPEDA), and, in Quebec, Law 25. Australian residents are protected by the Privacy Act 1988. Where these laws apply, we implement equivalent rights of access, correction, and deletion, and we process complaints through the same Parental Rights workflow described in Section 6 and at /privacy/rights.

15f. Data Subject Rights for International Users

Regardless of where you are located, you have the right to access, correct, delete, or port the personal information we hold about you or your child, and to object to or restrict certain processing. You may withdraw consent at any time. These rights are subject to narrow exceptions permitted by applicable law. Submit requests through /privacy/rights or by email to privacy@sparkforge-labs.com.

EU/EEA and UK residents have the additional right to lodge a complaint with a supervisory authority. A list of EU/EEA data-protection authorities is available at edpb.europa.eu; the UK Information Commissioner's Office is at ico.org.uk.

16. Breach Notification

16a. Our Commitment

In the event of a data breach that involves children's personal information or parent account credentials, SparkForge will investigate the scope of the incident, contain and remediate the vulnerability, and notify affected parents and applicable regulators within the timeframe required by the strictest applicable federal or state law. We will not delay notification beyond what is reasonably necessary for a law-enforcement request or legitimate investigative need.

16b. Timing Standards

All 50 U.S. states (and the District of Columbia and U.S. territories) have breach notification laws. We commit to the following notification windows, measured from the time we determine a breach has occurred:

• Affected residents in 30-day states (including California, Colorado, Florida, New York, Washington): notification within 30 calendar days.
• Affected residents in 45-day states (including AL, AZ, IN, NM, OH, OR, RI, TN, VT, WI): notification within 45 calendar days.
• Affected residents in 60-day states (including CT, DE, LA, SD, TX): notification within 60 calendar days.
• Affected residents in other states with "without unreasonable delay" standards: notification within 60 calendar days, our internal ceiling.
• Federal Trade Commission (when a breach affects more than 500 children's personal information under the 2025 COPPA amendments): notification within 30 calendar days.
• International supervisory authorities (e.g., EU lead supervisory authority under GDPR Article 33): notification within 72 hours of becoming aware of a personal-data breach where required.

16c. Contents of the Notice

A breach notification from SparkForge will include, at minimum:

• A description of what happened and when we became aware of it;
• The categories of personal information involved;
• The steps we have taken to contain and remediate the incident;
• Recommended protective steps the parent can take (for example, changing the account password, monitoring relevant services);
• A direct contact channel for questions, staffed by our Privacy & Security Lead (see Section 1 for contact information); and
• Any additional content required by the recipient's state or national law.

16d. Method of Notification

We will send the initial notification by email to the address registered on each affected parent account. Where state or national law additionally requires postal notification, substitute notification, or public disclosure (for example, to a state Attorney General, consumer-reporting agencies, or a prominent website notice), we will provide that additional notification in the form prescribed by that law.

16e. Post-Incident Review

After every confirmed incident, we complete a root-cause analysis, document corrective actions taken, and update our written children's personal information security program (see Section 8a) as needed. Nothing in this section creates liability in excess of what is imposed by applicable law.