Privacy Policy

Last Updated: May 2026

Marketing-consent policy version: 1.0.0 — every time the marketing-email consent wording changes, this version is bumped and recorded on the audit row of every future consent change. Existing audit rows are unaffected. See Section 6.2 for the current opt-in / opt-out paths and Section 7.6 for the retention of the consent audit log.

Raindrops Kids, operated by HighWaters Labs LLC ("we," "our," or "us") is committed to protecting your privacy and the privacy of your children. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform.

COPPA Compliance Update (April 2026): This Privacy Policy has been updated to comply with the FTC's 2025 amendments to the Children's Online Privacy Protection Act (COPPA) Rule, which require full compliance by April 22, 2026. Key updates include enhanced data retention disclosures, expanded parental consent requirements, and a written information security program.

Table of Contents

• Age Requirements
• 1. Information We Collect
• 2. How We Use Your Information
• 3. Information Sharing and Disclosure
• 4. Data Security
• 5. Children's Privacy (COPPA Compliance)
• 6. Your Rights and Choices
• 7. Data Retention
• 8. International Data Transfers
• 9. California Privacy Rights (CCPA/CPRA)
• 10. Third-Party Services
• 11. Changes to This Privacy Policy
• 12. Contact Us
• 13. Complaints
• Cookies and Tracking Technologies
• California Resident Notice
• Security Practices
• Data Retention and Deletion

---

Age Requirements

18+ Only: Raindrops Kids is intended for use by adults (age 18 and older). If you are under 18, please ask a parent or guardian to create an account.

Child Profiles: Adult account holders can create profiles for their children under their supervision. By creating a child profile, you confirm that:

• You are the child's parent or legal guardian
• You consent to the collection and use of your child's information as described in this policy
• You understand your rights and responsibilities regarding your child's data

No Direct Child Access: Children do not have their own login credentials. All account access and data management is controlled by the adult account holder (parent/guardian).

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, password
• Parent Information: Contact details, payment information
• Child Information: Name, learning preferences, progress data
• Profile Information: Child profiles, learning goals, preferences

1.2 Automatically Collected Information

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, time spent, interactions with content
• Technical Data: Cookies, session data, performance metrics
• Location Data: General location (country/region level only)

1.3 In-Product Bug Reports

When you use the in-product "Report a problem" button, we store the message you write along with technical context (the page URL, your browser, your viewport size, the app build, and approximate country) and your account ID for up to 12 months so we can investigate and fix the issue. We do not share bug reports with third parties. You can request deletion of your reports at any time by contacting support@raindrops.kids.

1.4 Children's Information (COPPA Compliance)

What We Collect from Children:

• Name (first name only, can be a nickname)
• Learning progress and achievements
• Content preferences (favorite topics, subjects)
• Usage data (videos watched, quizzes completed, time spent learning)

What We Do NOT Collect from Children:

• Email addresses
• Phone numbers
• Physical home addresses
• Social security numbers
• Precise geolocation data
• Photos or videos of children
• Biometric identifiers (fingerprints, facial recognition, voiceprints, etc.)
• Information from children under 13 without parental control

How We Comply:

• Only adults (18+) can create accounts
• Parents create and manage their children's profiles
• Parental consent is provided when the parent creates a child profile
• Children cannot create accounts or profiles themselves
• We collect only information necessary for educational purposes

2. How We Use Your Information

2.1 Service Provision

• Provide educational content and personalized learning experiences
• Track learning progress and achievements
• Enable parent monitoring and management features
• Process payments and manage subscriptions

2.2 Communication

• Send important service updates and notifications
• Provide customer support and respond to inquiries
• Send educational tips and progress reports (with consent)

2.3 Improvement and Analytics

• Analyze usage patterns to improve our service
• Develop new educational content and features
• Ensure platform security and prevent fraud

2.4 Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and protect our rights
• Enforce our Terms of Service

3. Information Sharing and Disclosure

3.1 We Do Not Sell Personal Information {#we-do-not-sell}

🔒 Your Privacy Guarantee

We do NOT sell your personal information. Period.

• ❌ We don't sell to data brokers
• ❌ We don't sell to advertisers
• ❌ We don't build advertising profiles
• ❌ We don't share data for cross-context behavioral advertising

Our business model is 100% subscription-based. Your trust is our product, not your data.

3.2 Service Providers (Sub-processors)

We share limited personal information with the trusted sub-processors listed below, each under a written data-processing agreement that constrains them to processing data solely on our instructions (GDPR Art. 28). Sub-processors do not own your data and may not use it for their own purposes.

We do not share children's personal information with sub-processors for marketing or advertising purposes (see Section 5.5).

3.3 Legal Requirements

We may disclose information when required by law or to:

• Protect our rights and safety
• Prevent fraud or security threats
• Comply with legal processes

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

4. Data Security

4.1 Security Measures

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication
• Secure data centers and cloud infrastructure

4.2 Data Breach Response

In the event of a data breach, we will:

• Notify affected users within 72 hours
• Take immediate steps to contain and remediate the breach
• Cooperate with relevant authorities
• Provide guidance on protective measures

5. Children's Privacy (COPPA Compliance)

We comply with the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments.

5.1 How We Comply with COPPA

Adult Account Holders Only:

• Only adults (18+) can create accounts on Raindrops Kids
• Children do not have their own login credentials
• Parents create and manage all child profiles under their account
• By creating a child profile, parents provide consent for data collection

How We Obtain Verifiable Parental Consent: Our account model satisfies COPPA's verifiable parental consent (VPC) requirements through multiple mechanisms:

• Only adults (18+) can create accounts, verified through payment information (credit/debit card), which is an FTC-accepted VPC method
• Parents explicitly create child profiles, providing informed consent at the point of creation
• Children never interact with account creation or provide information directly

Minimal Data Collection: We collect only information necessary for providing educational services:

• Child's name (first name, can be a nickname)
• Learning progress and achievements
• Content preferences
• Usage analytics for improving educational content

5.2 Parental Rights and Controls

As the adult account holder, you have complete control over your children's profiles and data:

Right to Review:

• View all personal information we have collected about your child
• Access your child's learning progress and activity history
• Review which videos and content your child has accessed

Right to Delete:

• Delete your child's profile and all associated data at any time
• Request deletion of specific information
• Data is deleted immediately upon profile deletion or request

Right to Control:

• Modify your child's profile information
• Control what information is collected
• Manage privacy settings for each child profile
• Refuse further collection or use of information

Right to Contact Us:

• Email us at privacy@raindrops.kids for any child privacy questions
• Request information about our data practices
• File complaints or concerns about children's privacy

5.3 Data Retention for Children's Information (2025 COPPA Update)

Public Notice Required by COPPA (Effective April 22, 2026)

In compliance with the 2025 amendments to the FTC's COPPA Rule, we provide the following public notice regarding our data retention policies for children's personal information:

Purpose for Collection: We collect children's personal information solely to provide personalized educational services, including tracking learning progress, personalizing content recommendations, and enabling parental monitoring features.

Business Need: Children's data is necessary to deliver our core educational services—without this data, we cannot provide personalized learning paths, track progress, or recommend age-appropriate content.

Retention Timeframe: We retain children's personal information only as long as reasonably necessary to fulfill the specific purpose for which it was collected:

• Learning Progress Data: Retained while child profile is active; deleted immediately upon profile or account deletion
• Usage Analytics: Retained while child profile is active; deleted immediately upon profile or account deletion
• Profile Information: Retained while profile is active; deleted immediately upon profile or account deletion

We do not retain children's personal information indefinitely. Once the purpose for collection is fulfilled or the parent deletes the child's profile or account, data is deleted immediately.

Verification: Upon request, we will provide written confirmation that children's personal information has been deleted. Contact privacy@raindrops.kids.

5.4 Biometric Data (2025 COPPA Update)

We Do NOT Collect Biometric Identifiers:

Effective with the 2025 COPPA amendments, the FTC has expanded the definition of "personal information" to include biometric identifiers. We want to be absolutely clear:

We do not collect, use, or store:

• Fingerprints or handprints
• Retina or iris patterns
• Facial recognition data or faceprints
• Facial templates or biometric facial scans
• Voiceprints or voice recognition data
• Gait patterns (walking/movement patterns)
• Genetic data or DNA sequences
• Any other biometric identifiers for automated or semi-automated recognition

If we ever plan to collect biometric data in the future (for example, for accessibility features), we will:

• Update this privacy policy with clear disclosure
• Obtain explicit parental consent
• Comply with all COPPA requirements for biometric data

5.5 Third-Party Sharing (2025 COPPA Update)

Separate Consent for Third-Party Disclosure:

We provide parents the option to consent to collection and use of their child's information without consenting to disclosure to third parties.

Our Third-Party Sharing Practices:

• Necessary Service Providers Only: We share children's information only with service providers necessary to operate our platform (see Section 3.2)
• No Marketing or Advertising: We do not share children's information with third parties for marketing or advertising purposes
• Data Processing Agreements: All service providers are bound by strict data protection agreements

Third Parties We Work With:

1. Supabase (Authentication): Manages user authentication and sets authentication cookies
2. Paddle (Payment Processing): Processes parent subscription payments (does not access children's data)
3. Video Delivery Provider: Delivers educational video content securely
4. Email Service Provider: Sends account-related emails to parents only
5. Cloud Hosting Services: Hosts our platform and database infrastructure

Parent Control Over Sharing: While our business model does not require sharing children's information beyond necessary service providers, if we ever plan to share information with additional third parties, we will:

• Provide clear notice to parents
• Obtain explicit consent for such sharing
• Allow parents to consent to collection/use while refusing third-party sharing

5.6 Child-Directed Content and Safety

Age-Appropriate Content:

• All content is curated for children
• No inappropriate advertisements or external links
• Content focused on natural world education (animals, plants, science, weather, etc.)

Safety Measures:

• No social features or chat functionality
• No ability for children to share personal information
• No data collection beyond what's necessary for education
• Regular security audits and updates

No Targeted Advertising:

• We do not display targeted advertisements to children
• We do not use children's information for marketing purposes
• We do not build advertising profiles based on children's data

5.7 Compliance Certification

We maintain ongoing compliance with:

• Children's Online Privacy Protection Act (COPPA) - including 2025 amendments
• State-level children's privacy laws (SOPIPA in California, etc.)

Annual Review: We conduct annual reviews of our children's privacy practices and update this policy as needed to maintain compliance with evolving regulations.

6. Your Rights and Choices

6.1 Access and Control

You have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Export your data in a portable format

6.2 Communication Preferences

We send two distinct categories of email:

Transactional emails (account confirmations, receipts, password resets, subscription notices, data-export confirmations). These are required to operate your account and you cannot opt out of them while your account is active. If you delete your account, you will stop receiving them.

Marketing emails (episode release announcements and occasional product updates — "marketing communications" for the purposes of CAN-SPAM and GDPR). We send these only with your explicit, opt-in consent and at a low volume — typically weeks apart, never more than a few per month.

You can opt in to marketing emails at any of these points:

• The sign-up form — an unchecked checkbox under "Send me episode releases and occasional product updates"
• The Paddle checkout — an unchecked "Marketing Communications" checkbox
• Your account settings — /settings/email, a toggle you can flip on or off at any time

You can opt out of marketing emails at any of these points, at no cost and without justification:

• The one-click "Unsubscribe" link in the footer of every marketing email (CAN-SPAM § 7704(a)(5)). This removes you from our broadcast audience immediately.
• A direct List-Unsubscribe header that supports one-click opt-out in mail clients such as Gmail.
• Your account settings — /settings/email.
• Emailing us at privacy@raindrops.kids — we will process the request manually within 10 business days.

When you opt out, we send a single transactional confirmation email letting you know the change took effect, and you immediately stop being included in any future broadcast.

6.3 Cookie Management

• Control cookie settings through your browser
• Opt out of non-essential cookies
• Clear cookies and browsing data

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Privacy Policy, or as required by law.

7.1 Adult Account Data

• Account Information: Retained while your account is active
• Account Deletion: Personal data, child profiles, learning progress, watch history, and email logs are deleted immediately upon account deletion. Payment audit records are anonymized (personal identifiers removed) and retained for compliance purposes.
• Payment Data: Anonymized payment audit records retained as required by law and tax regulations (typically 7 years for financial records)
• Subscription Records: Canceled subscriptions marked as "canceled" for audit purposes; associated personal details are anonymized upon account deletion

7.2 Children's Data Retention (COPPA Compliance)

For our complete COPPA-compliant public notice on children's data retention, including purpose, business need, and deletion timeframes, please see Section 5.3.

In summary, we follow strict data retention policies for children's information in compliance with COPPA 2025 requirements:

Learning Progress Data:

• Retained while child profile is active
• Used to provide personalized educational experiences
• Deleted immediately when parent deletes child profile or account

Usage Analytics:

• Usage data (videos watched, time spent, quiz scores) retained while child profile is active
• Deleted immediately when parent deletes child profile or account

Profile Information:

• Child's name and preferences retained while profile is active
• Deleted immediately when parent deletes child profile or account
• Deleted upon parent's request at any time

7.3 Deletion Triggers

Children's data is permanently deleted when:

• Parent deletes a child's profile
• Parent deletes their entire account (all child profiles deleted)
• Parent requests data deletion via privacy@raindrops.kids
• Upon parent's request via privacy@raindrops.kids

7.4 Data Retention Exceptions

We may retain certain information longer when required by law:

• Legal hold for ongoing litigation or investigations
• Compliance with tax and financial regulations (payment records)
• Prevention of fraud and abuse (security logs, anonymized)
• Aggregate, anonymized data for research (not personally identifiable)

7.5 Verification of Deletion

Upon request, we will provide confirmation that your data or your child's data has been deleted from our systems. Contact privacy@raindrops.kids for deletion verification.

7.6 Marketing Consent Audit Log

Every change to your marketing-email preferences (opt in, opt out, source, IP, user agent, the exact consent wording and policy version you saw at the time) is written to an append-only audit log. This is how we demonstrate GDPR Art. 7(1) "demonstrable consent" — if regulators ever ask whether and how a given recipient consented, we can produce a complete history.

• The audit log is retained for the lifetime of your account.
• Audit rows are append-only while your account exists — we do not edit or delete them.
• When you delete your account, audit rows are anonymized: the link to your user ID is set to NULL (via the database's ON DELETE SET NULL cascade), so the row remains as an aggregate compliance record but cannot be tied back to you personally.
• The audit log is never used for marketing, segmentation, or any purpose other than compliance and incident investigation.

8. International Data Transfers

8.1 Data Location and International Transfers

• Our servers are located in the United States
• We may transfer data to other countries for service provision
• We ensure adequate protection for international transfers

For European Union Users: When we transfer personal data from the EU to countries outside the European Economic Area (EEA), we use Standard Contractual Clauses (SCCs) approved by the European Commission. These clauses provide appropriate safeguards for your personal data and are legally binding commitments between us and our service providers to protect your personal data. You may request a copy of the applicable Standard Contractual Clauses by contacting privacy@raindrops.kids.

8.2 GDPR Compliance (EU Users)

If you are in the European Union, you have additional rights under GDPR:

• Right to data portability
• Right to be forgotten
• Right to restrict processing
• Right to object to processing

9. California Privacy Rights (CCPA/CPRA)

California residents have enhanced privacy rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), which came into effect in 2023.

9.1 Your California Consumer Rights

As a California resident, you have the following rights:

Right to Know:

• What categories of personal information we collect
• What specific pieces of personal information we have about you
• The categories of sources from which we collect information
• The business purposes for collecting or selling personal information
• The categories of third parties with whom we share personal information

Right to Delete:

• Request deletion of your personal information
• Request deletion of your children's personal information
• We will delete and direct our service providers to delete your information (subject to legal exceptions)

Right to Correct:

• Request correction of inaccurate personal information
• We will use commercially reasonable efforts to correct inaccurate information

Right to Opt-Out:

• Opt-out of the "sale" or "sharing" of your personal information
• We do NOT sell personal information for monetary value
• We do NOT share personal information for cross-context behavioral advertising

Right to Limit Use of Sensitive Personal Information:

• Limit our use and disclosure of sensitive personal information
• Sensitive information includes: precise geolocation, racial/ethnic origin, religious beliefs, genetic data, biometric identifiers
• We do NOT collect sensitive personal information from children

Right to Non-Discrimination:

• Equal service and pricing even if you exercise your privacy rights
• We will not deny service, charge different prices, or provide different quality of service for exercising your rights

9.2 Children's Information Under CCPA/CPRA

Age 13-15 (Parental Consent Model):

• Our 18+ account model means children under 16 never directly interact with our platform
• Adult account holders provide all consents on behalf of their children
• This exceeds California's requirement for separate opt-in consent for children 13-15

Age Under 13 (COPPA Compliance):

• Full COPPA compliance as described in Section 5
• Parents have complete control over all data collection and use
• No sale or sharing of children's information under any circumstances

We Do Not Sell Children's Information:

• We do NOT sell personal information of consumers under age 16
• We do NOT share children's information for advertising purposes
• Service providers are bound by strict data protection agreements

9.3 How to Exercise Your California Rights

Submit a Request:

• Email: privacy@raindrops.kids
• Subject line: "California Privacy Rights Request"
• Include: Your name, email address, type of request (know/delete/correct)

Data Request Portal:

• Online portal for submitting requests: raindrops.kids/legal/data-request
• Secure verification process
• Track request status

Verification Process: We will verify your identity before processing your request:

• For "right to know" requests: We'll verify using your account email and password
• For "right to delete" requests: We require additional verification (see Section 9.5)
• Authorized agents may submit requests on your behalf with proper documentation

Response Timeline:

• We will respond to verifiable requests within 45 days
• If we need more time, we will notify you and may extend up to 90 days total
• No charge for up to 2 requests per 12-month period

9.4 Do Not Sell or Share My Personal Information {#california-do-not-sell}

🛡️ California Residents: We Do Not Sell Your Data

Under CCPA, California residents have the right to opt-out of the "sale" or "sharing" of personal information. However:

WE DO NOT SELL OR SHARE YOUR DATA.

This means you do not need to opt-out because there is nothing to opt out of. We never have and never will sell your personal information or your children's information.

What We Don't Do:

• ❌ We do not sell data to data brokers
• ❌ We do not sell data to advertisers
• ❌ We do not share data for targeted advertising
• ❌ We do not build advertising profiles
• ❌ We do not engage in cross-context behavioral advertising

Service Providers vs. "Selling": The third parties we work with are service providers, not buyers of your data. They:

• ✅ Process data only on our behalf and for our services
• ✅ Are contractually prohibited from selling your information
• ✅ Must comply with our strict privacy and security standards

Have Questions or Concerns?

• Visit our Data Request Portal to exercise your CCPA rights
• Email privacy@raindrops.kids with "California Privacy Rights" in the subject
• We're here to help and will respond within 10 business days

9.5 California Minors' Rights (Business & Professions Code §22581)

California minors under 18 have the right to request removal of content they posted. However:

• Our platform does not allow children to post content
• Children do not have direct login access
• Adult account holders control all data
• Parents can delete their children's profiles and data at any time (see Section 5.2)

9.6 California "Shine the Light" Law (Civil Code §1798.83)

California residents can request information about personal information disclosed to third parties for direct marketing purposes. However:

• We do NOT disclose personal information to third parties for direct marketing
• We do NOT sell mailing lists
• We do NOT share customer lists with marketing partners

If you still want to submit a Shine the Light request, email privacy@raindrops.kids.

9.7 Categories of Personal Information We Collect (CCPA Disclosure)

As required by CCPA, here are the categories of personal information we collect:

Adult Account Holders:

Children (Under Parent Account):

We Do NOT Collect from Anyone:

• Precise geolocation data
• Biometric identifiers (fingerprints, facial recognition, voiceprints)
• Genetic data
• Sensitive personal information (race, religion, health data, sexual orientation)

9.8 Contact for California Privacy Inquiries

For questions about California privacy rights:

• Email: privacy@raindrops.kids
• Subject: "California Privacy Rights"
• Response Time: Within 10 business days for acknowledgment, 45 days for full response

10. Third-Party Services

10.1 Payment Processing

• We use Paddle for payment processing
• Paddle's privacy policy applies to payment information
• We do not store complete payment card information

10.2 Analytics and Tools

• We may use analytics tools to improve our service
• These tools may collect usage data
• We ensure these tools comply with our privacy standards

11. Changes to This Privacy Policy

11.1 Updates

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending email notifications to registered users
• Displaying in-app notifications

11.2 Continued Use

Continued use of our service after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

12.1 Privacy Questions

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@raindrops.kids
• Mail: HighWaters Labs LLC, 30 N Gould St Ste 59786, Sheridan, WY 82801-6317 US

For specific privacy inquiries:

• Children's Privacy: privacy@raindrops.kids
• California Privacy Rights: privacy@raindrops.kids (subject: "California Privacy Rights")
• Data Deletion Requests: privacy@raindrops.kids (subject: "Data Deletion Request")
• COPPA Questions: privacy@raindrops.kids (subject: "COPPA Inquiry")

12.2 Data Protection Officer

For EU users or complex privacy inquiries, you may contact our privacy team at privacy@raindrops.kids.

For EU users: We are in the process of appointing an EU representative pursuant to Article 27 of the GDPR. Please contact privacy@raindrops.kids for EU-specific privacy inquiries.

12.3 Response Time

We aim to respond to all privacy inquiries within:

• General questions: 5 business days
• Data access/deletion requests: 30 days (45 days for California residents)
• COPPA-related concerns: 10 business days

13. Complaints

13.1 Filing Complaints

If you believe we have not addressed your privacy concerns, you may:

• Contact us directly to resolve the issue
• File a complaint with your local data protection authority
• Contact the Federal Trade Commission (for US residents)

13.2 Response Time

We will respond to privacy complaints within 30 days of receipt.

Cookies and Tracking Technologies {#cookies}

This section explains how Raindrops Kids uses cookies and similar tracking technologies when you visit our website at raindrops.kids.

By using our Site, you consent to the use of cookies as described in this section and the rest of this Privacy Policy.

What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, smartphone) when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners.

Types of Cookie Technologies

• Cookies: Small text files stored in your browser
• Local Storage: Browser storage that persists after you close your browser
• Session Storage: Temporary browser storage that clears when you close your tab
• Web Beacons: Tiny graphics (also called "pixels") used to track behavior
• Similar Technologies: Other tracking and identification methods

For simplicity, we refer to all these technologies as "cookies" in this section.

First-Party vs. Third-Party Cookies

• First-party cookies: Set by Raindrops Kids directly
• Third-party cookies: Set by our service providers (Supabase, BunnyCDN, etc.)

Session vs. Persistent Cookies

• Session cookies: Deleted when you close your browser
• Persistent cookies: Remain on your device for a set period (specified in our cookie list)

Why We Use Cookies

We use cookies for several important purposes:

1. Essential Functionality: To enable core features like authentication and session management
2. User Experience: To remember your preferences and settings
3. Performance: To understand how our Site is used and identify areas for improvement
4. Security: To detect and prevent fraud and abuse
5. Legal Compliance: To respect your cookie preferences as required by law

We do NOT use cookies for:

• Selling your personal information
• Cross-site behavioral advertising
• Building advertising profiles
• Tracking you across unrelated websites

Types of Cookies We Use

We categorize cookies into four types. You have control over which optional cookies we can use.

1. Strictly Necessary Cookies (Always Active)

These cookies are essential for our Site to function. They enable core features like:

• Logging in to your account
• Maintaining your session
• Remembering your cookie preferences
• Ensuring security

You cannot opt out of these cookies as they are strictly necessary for the Site to work. Without them, you would not be able to use our educational platform.

Legal Basis: Legitimate interest (essential for service provision)

2. Functional Cookies (Optional)

These cookies enable enhanced functionality and personalization:

• Remembering which child profile you selected
• Saving your UI preferences (theme, language)
• Storing video playback settings
• Maintaining your learning progress

You can opt out of these cookies, but some features may not work as smoothly.

Legal Basis: Your consent (opt-in required)

3. Analytics Cookies (Optional)

These cookies help us understand how visitors use our Site:

• Which pages are most popular
• How long visitors spend on each page
• Which educational content is most engaging
• Identifying technical issues

Analytics data is aggregated and anonymized. We use this information to improve our educational content and user experience.

You can opt out of these cookies. We respect your choice not to be tracked.

Anonymous measurement before you choose: Until you make a cookie choice, we may measure overall site usage in a fully anonymous, cookieless way. In this mode we do not store any cookies or other identifiers on your device, we do not create a persistent profile of you or your child, your IP address is used only momentarily to generate an anonymous hash and is not stored, and the resulting data is used only to produce anonymous, aggregated metrics that cannot be tied to you as an individual. We rely on our legitimate interest in understanding and improving our educational service for this limited, privacy-preserving measurement. Choosing "Reject" stops all analytics, including this cookieless measurement — we then collect no analytics from you at all. Choosing "Accept" enables fuller, cookie-based analytics. Simply closing the banner without choosing leaves you in this anonymous-only mode until you decide.

Legal Basis: Your consent (opt-in) for cookie-based analytics; our legitimate interest for anonymous, cookieless measurement that places nothing on your device (used only until you choose, and never after you decline).

4. Marketing Cookies (Not Currently Used)

We do not currently use marketing or advertising cookies. If we implement them in the future:

• We will update this policy
• We will request your explicit consent
• You will have full control to opt in or out

Complete Cookie List

Below is a complete list of all cookies we use or may use on our Site.

Strictly Necessary Cookies

Functional Cookies

Analytics Cookies

Marketing Cookies

We do not currently use any marketing or advertising cookies.

Third-Party Cookies

We work with the following trusted third-party service providers who may set cookies on our behalf:

1. Supabase (Database & Authentication)

• Purpose: User authentication and database services
• Cookies: sb-*-auth-token, sb-*-auth-token-code-verifier
• Privacy Policy: https://supabase.com/privacy
• Type: Strictly Necessary

2. Video Delivery Provider

• Purpose: Secure video streaming and content delivery
• Cookies: May set temporary cookies for video playback and token authentication
• Type: Strictly Necessary

3. PostHog (Analytics)

• Purpose: Privacy-friendly product analytics to understand how our platform is used and identify areas for improvement
• Cookies: ph_* (PostHog session and identity cookies) — set only if you accept analytics cookies
• Privacy Policy: https://posthog.com/privacy
• Type: Analytics. Cookie-based, identifiable analytics requires your consent (opt-in). Before you make a cookie choice, PostHog runs in cookieless mode — no cookies or identifiers are stored on your device, your IP is used only momentarily to generate an anonymous hash and is not stored, and only anonymous, aggregated counts are produced under our legitimate interest. If you decline analytics, PostHog is not loaded at all.
• Data Location: United States
• Children's Data: Analytics on child-directed pages are aggregated and anonymized; no advertising profiles are built

4. Paddle (Payment Processing)

• Purpose: Subscription payment processing
• Cookies: May set cookies during checkout process
• Privacy Policy: https://www.paddle.com/legal/privacy
• Type: Strictly Necessary (only during checkout)

Important: All our third-party providers are bound by strict data protection agreements. They are prohibited from using your data for their own purposes or selling your information.

How to Manage Cookies

You have several options to control or delete cookies:

Cookie Consent Banner

When you first visit our Site, you'll see a cookie consent banner with three options:

• Reject All: Only essential cookies will be used
• Manage Preferences: Choose which optional cookie categories to enable
• Accept All: Enable all cookie categories

You can change your preferences at any time by clicking the cookie icon in the footer or visiting our Cookie Preferences page.

Browser Settings

Most browsers allow you to:

• View and delete cookies
• Block all cookies
• Block third-party cookies
• Clear cookies when you close the browser

Warning: If you block or delete essential cookies, parts of our Site may not work properly. You may not be able to log in or use core features.

Cookies and Children's Data

We do NOT:

• Set cookies that track individual children across websites
• Use children's data for advertising purposes
• Share children's information with third parties for marketing
• Collect precise geolocation from children
• Collect biometric data from children

We DO:

• Use strictly necessary cookies to provide our educational service
• Track learning progress (only with parental consent via account creation)
• Use aggregated, anonymized data to improve our content
• Allow parents full control over their children's data

California Resident Notice {#california}

This notice is provided to California residents pursuant to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). It describes how Raindrops Kids collects, uses, and shares personal information about California residents.

Categories of Personal Information We Collect

Identifiers

• Examples: Name, email address, IP address, device identifiers
• Purposes: Account creation, authentication, service provision, security
• Sources: Directly from you, automatically from your device
• Sharing: Service providers, legal requirements

Personal Information Categories Listed in Cal. Civ. Code § 1798.80(e)

• Examples: Name, address, phone number, payment information
• Purposes: Account management, payment processing, customer support
• Sources: Directly from you
• Sharing: Payment processors, service providers

Characteristics of Protected Classifications

• Examples: Educational information
• Purposes: Educational content personalization
• Sources: Directly from you
• Sharing: Service providers (for educational purposes only)

Commercial Information

• Examples: Subscription history, payment records, usage patterns
• Purposes: Billing, service improvement, customer support
• Sources: Directly from you, automatically from service usage
• Sharing: Payment processors, service providers

Internet or Other Electronic Network Activity

• Examples: Browsing history, search history, interaction with content
• Purposes: Service provision, personalization, analytics
• Sources: Automatically from your use of our service
• Sharing: Analytics providers, service providers

Geolocation Data

• Examples: General location (country/region level)
• Purposes: Content localization, security, compliance
• Sources: Automatically from your device
• Sharing: Service providers

Education Information

• Examples: Learning progress, educational preferences, achievements
• Purposes: Educational content delivery, progress tracking
• Sources: Directly from you, automatically from service usage
• Sharing: Service providers (for educational purposes only)

Inferences Drawn from Personal Information

• Examples: Learning preferences, content recommendations
• Purposes: Personalization, service improvement
• Sources: Derived from other collected information
• Sharing: Service providers

How We Use and Share California Residents' Personal Information

We use the personal information we collect for: service provision, account management, payment processing, personalization, communication, analytics, security, and legal compliance.

We Do Not Sell Personal Information. We do not sell, rent, or trade your personal information to third parties.

We may share personal information with service providers who help us process payments (Paddle), provide authentication services (Supabase), host our platform, provide customer support, and analyze usage data.

Your California Privacy Rights

As a California resident, you have the right to:

• Right to Know: Request information about the categories of personal information we collect, the sources, the purposes, and the third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Portability: Request a copy of your personal information in a portable format
• Right to Opt-Out: Opt-out of the sale or sharing of personal information (though we do not sell personal information)
• Right to Limit: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

How to Exercise Your California Rights

Submitting Requests: You can exercise your rights by:

• Email: privacy@raindrops.kids
• Online Form: raindrops.kids/legal/data-request

Verification: We may need to verify your identity before processing your request. We may ask for information to verify your identity and additional documentation if necessary.

Response Time: We will respond to your request within 45 days. If we need more time, we will notify you and may extend the response period by an additional 45 days.

Children's Information (California)

• We comply with COPPA and do not knowingly collect personal information from children under 13 without parental consent
• Parents have the right to review, modify, or delete their child's information
• Children's information is used only for educational purposes

Security Practices {#security}

At Raindrops Kids, we take security seriously. This section outlines our security practices and measures to protect your data and ensure a safe learning environment for children.

Our Security Commitment

We are committed to protecting the privacy and security of all users, especially children. Our security measures are designed to:

• Protect personal information and learning data
• Ensure secure access to our platform
• Maintain the integrity of our educational content
• Comply with applicable security regulations

Data Protection

Encryption

• Data in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3
• Data at Rest: All stored data is encrypted using AES-256 encryption
• Database Encryption: Our database is encrypted at rest and in transit
• Backup Encryption: All backups are encrypted and stored securely

Access Controls

• Multi-Factor Authentication: Available for all user accounts
• Role-Based Access: Different access levels for parents, children, and administrators
• Session Management: Secure session handling with automatic timeouts
• IP Restrictions: Optional IP-based access controls for enhanced security

Platform Security

Infrastructure Security

• Cloud Security: Hosted on secure cloud infrastructure with regular security updates
• Network Security: Protected by firewalls and DDoS protection
• Vulnerability Management: Regular security assessments and penetration testing
• Incident Response: 24/7 monitoring and rapid response to security incidents

Application Security

• Secure Development: Code is developed following secure coding practices
• Input Validation: All user inputs are validated and sanitized
• SQL Injection Protection: Database queries are protected against injection attacks
• XSS Prevention: Cross-site scripting protection implemented
• CSRF Protection: Cross-site request forgery protection enabled

Payment Security

• PCI Compliance: We do not store complete payment card information
• Secure Payment Gateway: Payments processed through Paddle, a secure payment processor
• Tokenization: Payment information is tokenized for security
• Fraud Detection: Automated fraud detection and prevention systems

Compliance and Certifications

Current Regulatory Compliance

• COPPA: Full compliance with the Children's Online Privacy Protection Act, including 2025 amendments addressing biometric data, targeted advertising restrictions, and enhanced parental consent requirements
• GDPR: Compliance with General Data Protection Regulation for EU users, including data portability, right to erasure, and lawful processing bases
• CCPA/CPRA: Compliance with California Consumer Privacy Act and California Privacy Rights Act, supporting all nine consumer rights
• California Automatic Renewal Law: Full disclosure of subscription terms, renewal notices, and easy cancellation

Written Information Security Program (COPPA 2025 Requirement)

In compliance with the 2025 COPPA amendments, we maintain a written information security program that includes:

• Designated Coordinator: A designated employee responsible for coordinating the security program
• Annual Risk Assessments: We conduct annual assessments of reasonably foreseeable risks to the security, confidentiality, and integrity of children's personal information
• Corresponding Safeguards: We implement safeguards to address identified risks
• Testing and Monitoring: Ongoing testing and monitoring of our security measures
• Annual Evaluations: Yearly evaluations and modifications to address new or more efficient technical or operational risk controls
• Third-Party Oversight: We ensure that any third party receiving children's personal information maintains appropriate confidentiality, security, and integrity protections

Our security program is proportionate to the sensitivity of the personal information we collect and the size and complexity of our operations.

Security Standards

We implement security best practices inspired by industry-leading frameworks:

• OWASP: We follow OWASP security guidelines to protect against common web application vulnerabilities
• NIST: We use the NIST Cybersecurity Framework as a guide for our security practices
• Industry Best Practices: We continuously review and implement security best practices from SOC 2 and ISO 27001 frameworks to improve our security posture

Reporting Security Issues

We welcome security researchers and users to report security vulnerabilities:

• Email hello@raindrops.kids
• Provide detailed information about the vulnerability
• Allow us time to investigate and fix the issue
• Do not exploit vulnerabilities or access unauthorized data

Data Retention and Deletion {#data-retention}

This section explains our data retention and deletion policies, including what happens to your data when you stop using Raindrops Kids.

Data Retention Principles

We believe in responsible data management and user privacy. Our data retention policies are designed to:

• Protect your privacy and your children's privacy
• Comply with applicable laws and regulations
• Maintain service quality and security
• Provide transparency about data handling

We collect only the data necessary to provide our service, retain data only as long as needed, delete data when it's no longer required, and minimize data sharing with third parties.

How Long We Keep Your Data

Active Accounts

• Account Data: Retained while your account is active
• Usage Data: Retained while your account is active
• Payment Data: Anonymized payment audit records retained as required by law (typically 7 years)
• Children's Data: Retained only as long as necessary for educational purposes (see Section 5.3)

Deleted Accounts

• Account Data: Deleted immediately upon account deletion
• Usage Data: Deleted immediately upon account deletion
• Payment Data: Anonymized audit records retained as required by law
• Children's Data: Deleted immediately upon account or profile deletion (consistent with Section 5.3)

What Happens When You Leave

Account Deletion

When you delete your account:

• Your personal data, child profiles, learning progress, watch history, and email logs are deleted immediately
• Payment audit records are anonymized (personal identifiers removed) and retained for legal compliance
• Deletion is permanent and irreversible

Data Deletion Process

Our deletion process includes:

• Immediate removal of personal data from active databases
• Anonymization of payment audit records (personal identifiers removed, compliance data retained)

What We Keep

We may retain certain anonymized data for legal or security purposes:

• Anonymized payment audit records (required by law)
• Anonymized security logs (for fraud prevention)

Children's Data Protection

Children's data receives special protection:

• Parents control deletion and can request it at any time
• Deleted immediately upon parental request (consistent with Section 5.3)
• Not used for marketing purposes
• Not shared with third parties for commercial purposes

Data Anonymization

When data is anonymized:

• Personal identifiers are removed
• Data cannot be linked to individuals
• Data is used only for aggregate analysis
• Anonymized data is retained indefinitely

Data Backup and Recovery

• Backups are encrypted and stored securely by our database provider (Supabase)
• Backup retention and recovery are managed by our infrastructure provider's policies

Legal and Regulatory Requirements

We may retain data when required by tax laws and regulations, financial regulations, law enforcement requests, or court orders or subpoenas.

Contact for Data Retention Questions

For questions about data retention and deletion:

• Privacy Team: privacy@raindrops.kids
• Support: support@raindrops.kids

---

Regulatory References

This Privacy Policy is designed to comply with the following regulations:

• Children's Online Privacy Protection Act (COPPA), 16 U.S.C. § 6501 et seq., as amended by the 2025 FTC Rule (effective April 22, 2026)
• FTC COPPA Rule, 16 CFR Part 312
• California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq.
• California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq.
• General Data Protection Regulation (GDPR), Regulation (EU) 2016/679

Official Regulatory Sources:

• FTC COPPA Rule: ftc.gov/legal-library/browse-rule/childrens-online-privacy-protection-rule
• FTC COPPA Final Rule (2025): ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule
• COPPA Rule Text (PDF): ftc.gov/system/files/ftc_gov/pdf/coppa_sbp_1.16_0.pdf

---

Effective Date: March 2026

This Privacy Policy is effective as of the date listed above and applies to all users of the Raindrops Kids platform.