Privacy Policy

1. Who we are

Three Baby Birdies is an educational children's book and AI-powered learning platform operated by Iris Scarfone ("we," "us," or "our"). Our website is threebabybirdies.com and our AI chatbot product is Chirpy's Classroom.

For privacy questions, you can reach us at iris@threebabybirdies.com.

2. What we collect

When you create an account (parent or teacher):

• Email address
• Encrypted password (we never see your plain-text password)
• Account role (parent or teacher)
• Subscription status

When you use Chirpy's Classroom:

• Chat messages sent to Chirpy or Mama Bird (used only to generate AI responses)
• Session activity (subject chosen, number of messages, session duration)
• Child profile nicknames (set by the parent, not legal names, not dates of birth)
• Badges and learning milestones earned

Automatically collected:

• IP address (for security and fraud prevention)
• Browser type and device type
• Pages visited and time spent (anonymous analytics)

3. Children's data (COPPA)

Chirpy's Classroom is designed for children under 13. We comply fully with the Children's Online Privacy Protection Act (COPPA).

• Children do not create accounts. Only parents or teachers create accounts.
• Child profiles contain only a nickname chosen by the parent, no real names, no contact information, no date of birth.
• Chat messages are processed to generate AI responses and stored for session continuity. Parents may request deletion at any time.
• We never market to children or build advertising profiles.

For our full COPPA disclosure, see our COPPA Compliance page.

4. How we use your data

• To operate the service: logging in, generating AI responses, tracking progress
• To send transactional emails: receipt of purchase, subscription renewal reminders
• To improve the product: anonymous usage patterns help us improve Chirpy's responses and add new subjects
• To prevent fraud and abuse: IP logging and rate limiting protect both users and the service
• To comply with law: we retain minimal records as required by applicable law

We do not use your data for advertising, sell it to third parties, or use it for any purpose not listed above.

5. Who we share it with

We use a small number of trusted third-party services to operate:

• Supabase, database and authentication (servers in the USA; SOC 2 compliant)
• Anthropic (Claude API), powers Chirpy and Mama Bird's AI responses. Chat messages are sent to Anthropic's API but not stored by Anthropic for training without consent.
• Stripe, payment processing. We never see or store your full card number.
• Railway, backend hosting (USA)
• Netlify, website hosting (USA)

No other parties receive your data. We do not sell, rent, or trade personal information.

6. Storage & security

• All data is stored in encrypted databases (Supabase/PostgreSQL)
• Passwords are hashed with bcrypt, we cannot recover your password
• All communications use HTTPS/TLS encryption
• API access requires authentication tokens that expire automatically
• We do not store payment card data, Stripe handles all payment security

We retain account data for as long as your account is active. You may request full deletion at any time.

7. Your rights

You have the right to:

• Access, request a copy of all personal data we hold about you
• Correction, update inaccurate or incomplete information
• Deletion, request that we delete your account and all associated data
• Portability, receive your data in a machine-readable format
• Objection, object to any processing you did not consent to

To exercise any of these rights, email iris@threebabybirdies.com. We respond within 30 days.

8. Cookies

We use minimal cookies and browser storage:

• Authentication token, stored in localStorage to keep you logged in
• Session preferences, the subject you picked, kept only until you close the tab
• Your parent PIN, so Chirpy’s Classroom can be locked on this device
• Your best score in Chirpy’s First Flight, kept on this device only and never sent to us
• If a newsletter or quiz signup fails to reach us, your email address is held on this device so the attempt can be retried. It is cleared once it succeeds

We do not use third-party advertising cookies or tracking pixels. You can clear your browser's local storage at any time to log out and remove all locally stored data.

9. Policy changes

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top and, for material changes, send an email to all active account holders. Continued use of the service after changes constitutes acceptance of the revised policy.