COPPA Compliance

Children's privacy is the foundation of everything we do. Here's exactly how we protect kids in Chirpy's Classroom.

Last updated: June 22, 2026 Applies to: Chirpy’s Classroom (ages 2–8)

Contents

  1. How we approach children’s privacy
  2. What is COPPA?
  3. What information we collect from children
  4. Parental consent & control
  5. How AI is used safely with children
  6. Third-party services & children’s data
  7. Security measures
  8. Policy updates

How we approach children’s privacy

The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law that protects the personal information of children under 13. Chirpy's Classroom was built from day one with COPPA as a design requirement, not an afterthought.

What is COPPA?

COPPA (the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506) requires operators of websites and online services directed to children under 13, or who knowingly collect personal information from children under 13, to:

  • Post a clear and comprehensive privacy policy
  • Obtain verifiable parental consent before collecting personal information from children
  • Give parents the ability to review, correct, and delete their child's information
  • Never condition a child's participation on providing more personal information than necessary
  • Maintain reasonable data security

Official resource

For more about COPPA, visit the U.S. Federal Trade Commission: ftc.gov/coppa

What information we collect from children

Chirpy's Classroom is designed so that children never register or submit personal information directly. Only adults (parents or teachers) create accounts.

A child profile contains only:

  • A nickname, chosen by the parent. Not a real name required.
  • Chat messages, sent during learning sessions. Used solely to generate AI tutor responses and track session progress.
  • Learning activity, subject chosen, session duration, badges earned.

We never collect: a child's real full name, date of birth, physical address, phone number, photos, geolocation, or any government identifier.

Because children do not create their own accounts, parental consent is built into the account structure itself: a parent must register and create the child's profile. By creating a child profile, the parent consents to the collection and use of the limited data described above.

Parents have complete control at all times:

Right to Review

Email us to request a full copy of all data associated with your child's profile, including chat history.

Right to Correct

You can update your child's nickname and other profile details directly within the app at any time.

Right to Delete

Email us and we will permanently delete your child's profile and all associated data within 30 days.

Parent PIN Lock

Set a 4-digit PIN to lock the chat screen. Children cannot navigate out without it. Prevents unsupervised use.

How AI is used safely with children

Chirpy and Mama Bird are powered by the Claude API (Anthropic). Every AI response goes through multiple layers of safety:

  • System prompt guardrails, Chirpy and Mama Bird are instructed to stay strictly within age-appropriate educational topics. Any message outside this scope is declined politely.
  • Content safety layer, our backend applies a keyword and context filter before any prompt reaches the AI model, blocking attempts to elicit inappropriate content.
  • No AI training on children's data, we do not share chat messages with Anthropic for model training. Chat data is used only to generate in-session responses.
  • No advertising profiling, AI interactions are never used to build advertising profiles or sold to any third party.

Anthropic's commitment: Anthropic's API terms prohibit using Claude to target children with harmful content. Their safety policies apply in addition to our own.

Third-party services & children's data

We share minimal data with the following services, all of which are bound by appropriate data protection agreements:

  • Supabase, stores child profile nicknames and session activity (no personal contact info). SOC 2 compliant. USA-based.
  • Anthropic (Claude API), receives chat messages to generate responses. Does not retain data for training purposes under our API agreement.
  • Railway / Netlify, hosting infrastructure. Does not access application data.

Children's data is never shared with: advertising networks, data brokers, social media platforms, or any analytics service that tracks individual users.

Security measures

  • All data encrypted in transit (HTTPS/TLS) and at rest
  • Passwords hashed with bcrypt, never stored in plain text
  • Database access restricted to authenticated API server only
  • Regular security reviews of all endpoints
  • Rate limiting on all chat endpoints to prevent abuse

Policy updates

If we materially change how we handle children's data, we will notify all active account holders by email at least 30 days in advance and update this page. Continued use after notice constitutes acceptance of the revised practices.

We will never retroactively reduce privacy protections for children's data without explicit parental re-consent.

Parent privacy requests

To review, correct, or delete your child's data, or for any COPPA-related question, contact us directly. We respond within 2 business days.

iris@threebabybirdies.com