Security, privacy, and compliance

Privacy and the rules for kids.

Children's privacy law is the reason this app looks the way it does. This page explains the law in plain words, shows exactly what we built, and names the places where what we say does not yet match what our code does.

What COPPA is, in one paragraph

COPPA stands for the Children's Online Privacy Protection Act. It is a United States law. In plain words it says this: if your website collects personal information from a child under 13, you have to get that child's parent to say yes first, you have to tell the parent what you collect, and you have to delete it if the parent asks.

The key words are from a child. The law is about information a child gives you.

This page or the your-data page?

This page is for someone checking us: a district, a league, a security firm, or a lawyer. It answers whether what we do is allowed, and it names the places where our own words did not match our code.

The your data page is for the person whose data it is. It answers what you can do about it: where the buttons are, what each one does, and what survives a deletion. Same subject, two different readers, so we kept them apart rather than making one page that serves neither.

Why this is simple

We do not collect personal information from a child, because a child has no account, no password, and no screen to type into. There is nothing for a child to give us.

A parent tells us their child's name. That is a parent giving us information, in their own account, about their own child. It is a different thing, and it is the thing that keeps this simple.

The safety net is still there

We built a full set of children's privacy protections in May 2026, back when children under 13 did have accounts. All of it still works. What we are launching does not depend on it, because we do not collect the thing it protects.

That is two layers instead of one. Below is what the machinery actually does, since a reviewer will want to see it whether or not we lean on it.

Asking permission properly

The law wants permission that is real, not a checkbox anyone could tick. Here is how ours works.

1
You tell us someone on the account is under 13.
We ask this directly during setup. Answering yes routes you into the permission flow before anything else.
2
We charge your card fifty cents.
Holding a real payment card is the standard way to show you are an adult. The charge is refunded. We call the payment company with a one-time key, so a double click cannot charge you twice.
3
We check the payment really belongs to you.
Before recording anything, we confirm the payment we are looking at was created for your account. Someone cannot reuse another person's payment to unlock their own.
4
We record the permission, then refund.
If recording it fails, we refund you straight away rather than keeping money for a permission we did not manage to store. If that refund also fails, we alert our team and we do not tell you that you have been refunded when you have not.
5
You say yes to each company by name.
Not one blanket yes. One line for each outside company that might touch data. The list is below.
6
The server checks again before letting you finish.
Being sent to the permission page is only a convenience. Before we mark your setup as complete, the server checks the permission is really on file. Skipping the page by sending a request directly does not work.

If we change what we ask for, we ask again

Every permission is stamped with a version. Ours is currently dated 26 August 2026. If we change the wording, the version changes, and the next time you visit you are sent to read the new version before you can carry on. Permission you gave to an older description does not silently cover a new one.

Every outside company that can touch data

These are the companies that actually receive family data today. AI companies get only the text of the feature a parent just used, not the child's profile or wallet.

Company
Stripe
What it does
Payments and bank connections
What it receives
Your name, email, and payment details. Your bank credentials go to Stripe and never to us.
Company
Resend
What it does
Email
What it receives
Your email address, your name, and the contents of the emails we send you.
Company
Anthropic
What it does
Study Hall and encouragement drafts, when a parent uses them
What it receives
The text of that request. Our permanent record stores a scrambled fingerprint, not the words.
Company
Google
What it does
The same AI features, as a fallback
What it receives
Same as Anthropic.
Company
Voyage
What it does
Search-by-meaning inside Study Hall and Scout
What it receives
The search text of that request.

Companies that receive family data today
Company	What it does	What it receives
Stripe	Payments and bank connections	Your name, email, and payment details. Your bank credentials go to Stripe and never to us.
Resend	Email	Your email address, your name, and the contents of the emails we send you.
Anthropic	Study Hall and encouragement drafts, when a parent uses them	The text of that request. Our permanent record stores a scrambled fingerprint, not the words.
Google	The same AI features, as a fallback	Same as Anthropic.
Voyage	Search-by-meaning inside Study Hall and Scout	The search text of that request.

Two more companies run our machines rather than receiving family data as a feature: Supabase runs the database and sign-in, and Vercel runs the website. Inngest runs background jobs and sees identifiers inside job messages.

Collecting less on purpose

What we do
Turn an under-13 child's exact birthday into an age range and throw the exact date away.
Is it in the code?
Yes, but it only runs when a child completes their own sign-up. No child ever completes one, so it never runs. This is a real gap and it is described below.
What we do
Store a scrambled fingerprint of AI text in our records, never the words.
Is it in the code?
Yes.
What we do
Turn on the do-not-share switch automatically for families in California.
Is it in the code?
Yes, at two different places where an account can be created.
What we do
Hide the school name for a child under 13.
Is it in the code?
No. We say this publicly and the form does not actually do it. Described below.

Data minimization, and whether it is really in the code
What we do	Is it in the code?
Turn an under-13 child's exact birthday into an age range and throw the exact date away.	Yes, but it only runs when a child completes their own sign-up. No child ever completes one, so it never runs. This is a real gap and it is described below.
Store a scrambled fingerprint of AI text in our records, never the words.	Yes.
Turn on the do-not-share switch automatically for families in California.	Yes, at two different places where an account can be created.
Hide the school name for a child under 13.	No. We say this publicly and the form does not actually do it. Described below.

Tracking, counted exactly

Two different tools count visits, and mixing them up is how our own earlier description went wrong. So here is each one separately.

Our own visit tracker

It is loaded on nine public pages or page groups: our home page, our marketing pages, our blog, our legal pages, our brand page, three team pages including the Stars Basketball page, and the general team page. Every one of those is a public page with no sign-in.

It is not loaded on any signed-in screen. It is also not loaded on these State of the App pages.

The piece that loads it runs on our server, looks at your setting first, and simply does not render at all if you have turned data sharing off. There is a second check on the receiving end that throws away an event from someone who has opted out, so both doors are closed.

We previously said ten. It is nine.

An earlier version of our own write-up said ten public layouts. We counted them in the code. There are nine. Small, and exactly the kind of number a reviewer checks.

The general analytics tool

A second tool, PostHog, is switched on once at the very top of the site rather than page by page. Left alone, that would mean it records a page view on every screen in the app, including the signed-in dashboard, where the web address by itself can carry a child's identifiers.

It is not left alone. There is a written list of signed-in areas where it must not record anything: the dashboard, setup, the agreement builder, the locked-parent screen, and the staff area. Recording is switched off there for everyone, whatever their own settings say. It is also not loaded on these State of the App pages.

Your own do-not-share setting is a second, independent reason it stops. When that switch is on, recording is off everywhere on the site and you are not identified. Either reason on its own is enough.

We used to describe this wrongly, in our own favour's opposite

An earlier version of this page said the second tool recorded page views across the whole site including the dashboard, with only your own switch to stop it. That was true on the day we wrote it, and a fix landed the same evening.

We are pointing at our own correction rather than quietly enjoying the better answer. A public page is worth as much as its worst sentence, so a claim that drifts either way gets written down. This one is on the compliance page with the rest.

One thing that has not changed: a team page for a club is a public marketing page, so a family arriving from a club's link is counted on that page, the same as any other visitor.

State laws we track

Some states have their own rules for children online. We watch four in particular, because we are taking this to districts and leagues across several states.

State
California
Law
The Age-Appropriate Design Code
What it is mostly about
Designing for children by default, and privacy settings that start switched on.
State
Florida
Law
House Bill 3
What it is mostly about
Accounts held by minors on social platforms.
State
Texas
Law
The SCOPE Act
What it is mostly about
What a service may do with a known minor's data.
State
New York
Law
SAFE for Kids
What it is mostly about
Feeds and notifications aimed at minors.

State laws tracked
State	Law	What it is mostly about
California	The Age-Appropriate Design Code	Designing for children by default, and privacy settings that start switched on.
Florida	House Bill 3	Accounts held by minors on social platforms.
Texas	The SCOPE Act	What a service may do with a known minor's data.
New York	SAFE for Kids	Feeds and notifications aimed at minors.

Every one of these is mostly about minors' accounts, minors' data, and features designed to pull minors in. A product with no child account, no feed, and no notifications to a child sits far outside the center of all four. We are not claiming that finishes the work. The full state-by-state comparison is written down and not yet complete.

Where our words do not match our code

We went through our own public claims one at a time and checked each one against the running code. Four did not match. Publishing them is the point of this page.

What we said
We do not collect a school name for a child under 13.
What the code does
The form asks for a school or team for every child and saves it. There is no age check on that field. This one is on a public legal page, so it matters most.
What we said
We never store a child's exact date of birth.
What the code does
Still true as a gap, and now measured. Setup asks a parent for the exact birthday and saves it. The tool that converts it to an age range only runs at the end of a sign-up a child completes, and under-13 children never complete one — their parent does the setup. As of 2026-08-09 that leaves 10 under-13 children with an exact birthday on file. We did not erase them straight away, because nothing in our system moved a child out of the under-13 bracket when they turned 13, and erasing the birthday would have locked those children under a younger child's restrictions for life. We built that transition first, on 2026-08-10: we record the month a child turns 13 before the birthday goes, round forward so the change is never early, and move them automatically. Erasing the birthdays is safe now.
What we said
Our vendor list covers every company we name.
What the code does
Closed 2026-08-09, form caught up 2026-08-26. Voyage is named here. Plaid and Ayrshare are not connected. The permission form no longer names them.
What we said
We use Plaid for bank connections.
What the code does
We do not. Bank linking runs through Stripe. Plaid has received no data.

Claims that did not survive the check
What we said	What the code does
We do not collect a school name for a child under 13.	The form asks for a school or team for every child and saves it. There is no age check on that field. This one is on a public legal page, so it matters most.
We never store a child's exact date of birth.	Still true as a gap, and now measured. Setup asks a parent for the exact birthday and saves it. The tool that converts it to an age range only runs at the end of a sign-up a child completes, and under-13 children never complete one — their parent does the setup. As of 2026-08-09 that leaves 10 under-13 children with an exact birthday on file. We did not erase them straight away, because nothing in our system moved a child out of the under-13 bracket when they turned 13, and erasing the birthday would have locked those children under a younger child's restrictions for life. We built that transition first, on 2026-08-10: we record the month a child turns 13 before the birthday goes, round forward so the change is never early, and move them automatically. Erasing the birthdays is safe now.
Our vendor list covers every company we name.	Closed 2026-08-09, form caught up 2026-08-26. Voyage is named here. Plaid and Ayrshare are not connected. The permission form no longer names them.
We use Plaid for bank connections.	We do not. Bank linking runs through Stripe. Plaid has received no data.

One more, and it is a bug not a wording problem

When you agree to each company one at a time, the code that is meant to notice a failed save does not actually work. Because of how the database library reports problems, a save that failed still looks successful to that check.

So in theory every permission line could fail to save and you would be told it worked. We already knew a partial failure could be quiet. It is worse than that, and we would rather say so.

Outside review

What
Review by an outside lawyer
Where it stands
Not done. Our founder signed off on the current pages. An engagement is planned.
What
A children's privacy certification
Where it stands
The application is written and ready. It has not been submitted.
What
A security certification
Where it stands
Not started. The companies that run our machines hold their own.
What
Break-in testing by an outside firm
Where it stands
Not done. This is one of the things we are asking a reviewer to help us scope.
What
Cyber insurance
Where it stands
Under review, not yet in place.

Independent review status
What	Where it stands
Review by an outside lawyer	Not done. Our founder signed off on the current pages. An engagement is planned.
A children's privacy certification	The application is written and ready. It has not been submitted.
A security certification	Not started. The companies that run our machines hold their own.
Break-in testing by an outside firm	Not done. This is one of the things we are asking a reviewer to help us scope.
Cyber insurance	Under review, not yet in place.

If you are reviewing us, these five rows are probably the most useful part of this page. We would rather you start from an accurate picture than a flattering one.