Privacy Policy

1. Information We Collect

Information you provide

When you create a family account and enroll a child, you provide:

• Parent/guardian details — your name, email, phone, and (for billing) your billing address.
• Child details — your child's name and date of birth, and any medical, allergy, or emergency-contact information you choose to provide so we can keep your child safe in class.
• Enrollment and attendance — which classes your child is enrolled in and attendance records.
• Billing information — tuition and fee history. Payment card details are entered directly with our payment processor, Stripe; we do not store your full card number.
• Consents — the liability waiver you sign and your per-child photo/video consent choices.

Information collected automatically

When you use the website or app, we collect limited technical information — such as device and browser type, IP address, and how you interact with the Service — to keep it secure and working well.

Cookies and similar technologies

• Strictly necessary — required for sign-in, security, and core features (for example, authentication tokens). These cannot be turned off.
• Functional — remember preferences such as theme.
• Analytics (consent-gated) — product analytics that measure aggregated usage to improve the Service. Loaded only after you accept analytics cookies.
• Error monitoring (consent-gated) — captures application errors to keep the Service reliable; any optional session replay is loaded only after you accept analytics cookies and redacts personal information.

You can manage cookies through the consent banner on your first visit, the "Cookie Preferences" link in our footer, or your browser settings.

2. Sign-In

You sign in with an email and password, or optionally with Google. If you choose Google sign-in, we receive your name, email address, and profile picture solely to create and manage your account. We do not access your Google contacts, files, or calendar. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Information

We use the information above to:

• enroll your child, run classes, and take attendance;
• keep your child safe (for example, having allergy and emergency-contact information on hand);
• bill tuition and fees and provide receipts;
• communicate with you about your child's classes, schedule changes, and your account;
• secure the Service and prevent fraud or abuse;
• understand, in aggregate, how the Service is used so we can improve it.

We do not use children's information to advertise to children, and we do not sell personal information.

4. Service Providers (Subprocessors)

We use a small set of trusted service providers to operate the Service. Each processes only what is needed for its purpose:

• Supabase — database, authentication, and hosting for your account and family data.
• Stripe — payment processing for tuition and fees; card details go directly to Stripe. See the Stripe Privacy Policy.
• Resend — sends transactional email such as account and enrollment messages and password resets.
• Cloudflare — website hosting and content delivery.
• Sentry — application error monitoring to keep the Service reliable (consent-gated where it involves session replay).
• PostHog — product analytics on aggregated usage, gated on your cookie consent. Our analytics do not receive children's personal information.

We may also disclose information where required by law, to respond to a lawful request, or to protect the safety of children, families, staff, or the public.

5. Children's Privacy

Protecting children's information is central to how we built the Service. Children do not create accounts, do not log in, and cannot enter their own information. Every piece of information about a child is entered and managed by that child's parent or legal guardian.

We collect a child's name, date of birth, and any medical, allergy, or emergency information the parent provides, and we use it only to enroll the child and keep them safe in class. We do not knowingly collect personal information directly from a child. When you enter information about a child, you confirm that you are that child's parent or legal guardian (or are authorized by them) and that you consent to our storing and using that information as described here, including any consent required under the Children's Online Privacy Protection Act ("COPPA") for a child under 13.

You can review, export, and delete your family's information at any time (see Section 6). If you believe a child has provided us information without a parent's involvement, contact us at founder@playceacademy.com and we will delete it promptly.

6. Your Rights: Access, Export, and Deletion

You are in control of your family's data. From the "Your Data" page in the app (/parent/data) you can, at any time:

• See what we store about your family;
• Export your family's data as a downloadable file;
• Manage per-child photo/video consent;
• Request deletion of your account and your family's data.

When you request deletion, we disable your login and remove your family's data within 30 days, except records we must keep by law (for example, billing and tax records) or minimal security logs. You may also email founder@playceacademy.com from your account email to exercise any of these rights, including correction of inaccurate information. Depending on where you live, you may have additional rights under laws such as the CCPA/CPRA, VCDPA, CPA, or GDPR; we extend the core rights above to all families regardless of residency and respond within the timeframes those laws require.

We do not sell or share your personal information for money or other valuable consideration, and we do not use your information for targeted advertising or profiling.

7. Data Retention

• Account and child data — kept while your account is active; removed within 30 days of a deletion request.
• Billing records — retained as required for tax and accounting purposes, even after account deletion.
• Security and error logs — retained for a limited period, then deleted or de-identified.

8. How We Protect Information

We use reasonable administrative and technical safeguards to protect your family's information, including encryption of data in transit (TLS), access controls enforced through database row-level security so each family can reach only its own data, and error monitoring. No method of storage or transmission is completely secure, but we work to protect your information and will notify you of a security incident affecting your information as required by law.

9. Changes and Contact

We may update this Privacy Policy from time to time. When we make a material change, we update the version and effective date at the top of this page and, where appropriate, notify you in the app or by email. The Service is operated by Kinetic Codex LLC d/b/a Playce Academy (Tampa, Florida). For any privacy question or request, contact founder@playceacademy.com.