COPPA Disclosure

1. What information we collect from children

The only information that touches a child’s profile is:

• A wizard name — typically a first name or nickname the parent types in during sorting. We don’t require a real name.
• A chosen house (Emberwing, Tidecaller, Thornroot, or Starforge), picked by a six-question quiz.
• Reading progress — which sight words have been practiced, how many times, and the resulting mastery level.
• Session timestamps — when the child practiced, used to draw the parent dashboard’s weekly chart and award streaks.
• Wizard level & collected creatures — game progression markers tied to the profile.

That’s everything. We do not collect:

• Real name, date of birth, or address.
• Photographs, videos, or voice recordings.
• Geolocation of any precision.
• Persistent identifiers like advertising IDs (IDFA, AAID).
• Contact information, friends lists, or social-network handles.
• Microphone or camera input.

2. How we get parental consent

Account creation requires an adult email and password and a checkbox confirming the adult has read this disclosure. The child cannot create an account on their own. Inside the app, anything that touches account-level controls — viewing the parent dashboard, opening the upgrade flow, changing settings — is gated behind a math check (e.g., 9 × 7) that an early reader can’t reasonably solve, satisfying COPPA’s “parental gate” requirement.

3. How we use the information

Information about a child is used only to:

• Run the lesson loop — pick the next word, save mastered words, draw the parent dashboard.
• Award creatures and level-ups based on what’s been mastered.
• Respond to parent requests (review, edit, delete).

We do not use a child’s information for advertising, profiling, or behavioral targeting of any kind. We do not show third-party ads inside the app. We do not embed third-party analytics SDKs or trackers.

4. Who else sees the information

The only third parties that handle child profile data are:

• Supabase (our database and auth provider) — stores the profile rows in a Postgres database with row-level security so only the parent’s own account can read or write them.

Apple and Google handle subscription billing, but they receive only the parent’s purchase event and an anonymous user id. They do not receive a child’s name, house, or reading progress. RevenueCat (our subscription event router) similarly receives only anonymous purchase events.

We do not share, sell, rent, or trade child information for any purpose.

5. Your rights as a parent

You have the right at any time to:

• Review what we’ve collected about your child. The Parent Dashboard inside the app shows it; for a complete export, email us at hello@wizardingquizbook.com from the email on file.
• Edit or delete a child’s wizard name, house, or progress at any time.
• Delete the entire account — parent record, all child profiles, all progress, all sessions. Email us; we confirm and act within 30 days. Backups roll over within 30 days after that, after which the data is permanently gone.
• Refuse further collection. The simplest way is to delete the account. You can also cancel the subscription and stop using the app — we won’t collect anything new without active use.

6. Notice of changes

If we change how we handle children’s information in any material way, we will email every parent on file at the address tied to their account, before the change takes effect. We will also update the “Last updated” date on this page.