Effective Date: April 28, 2026
Mind Match Education is a child-directed educational service. We comply with the Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and applicable state student-privacy statutes.
1. Children's Privacy (COPPA)
Mind Match Education is intended for use in classrooms and at home with parental supervision, including by children under 13. Before we create an account for a user under 13, we obtain consent through one of the following routes:
- School class code — when a teacher creates a class, the school is treated as the consenting party under COPPA's "school official exception" and FERPA's school-official designation. Students enrolled by class code provide only a username and password (no email, no date of birth).
- Verifiable Parental Consent (VPC) — when a parent registers a child directly:
- Two-email method — we send the parent two confirmation emails at least 24 hours apart, both of which must be confirmed before the account becomes active. (FTC-approved "Email-Plus" method, 16 CFR § 312.5(b)(2)(iv).)
- Card verification — we charge the parent a non-refundable $1 verification fee through Stripe to confirm an adult cardholder is consenting. (FTC-approved monetary-transaction method, 16 CFR § 312.5(b)(2)(iii).)
Once consent is recorded, the child's account stores no third-party advertising identifiers, no behavioral profile, and no advertising telemetry. The entitlements.noAds flag is automatically set on every student account, paid or free.
2. Parental Rights
Parents and guardians of children under 13 have the right to:
- Review the child's personal information we have collected;
- Request that we delete the child's information and account;
- Refuse to permit further collection or use of the child's information;
- Withdraw consent at any time. Withdrawal terminates the account and triggers data deletion within 45 days.
Submit requests to help@appgeniusstudios.com from the parent email used during sign-up. We will respond within 30 days.
3. Information We Collect
A. Adults (13+) — direct sign-up
- Username, email, password, date of birth (to confirm 13+);
- Quiz / game performance, in-app preferences;
- IP address (hashed) and user-agent (hashed) at the moment of consent — kept on the consent receipt only.
B. Students (any age) — class-code sign-up
- Username, password (only). No email, no real name, no date of birth.
- Optional adult recovery email — used only for password reset, never for marketing.
- Class roster membership and quiz / game performance shared with the enrolling teacher.
C. Children under 13 — parent-VPC sign-up
- Child's username, password (only).
- Parent's email and the consent record (method, timestamps, hashed IP/UA, optional payment-intent ID).
- Quiz / game performance.
D. Automatically Collected (all users)
- Device type, app version, error / crash logs;
- Quiz performance and learning progress.
Children's accounts: no advertising identifiers, no behavioral profile, no third-party tracking.
3. How We Use Information
We use data to:
- Operate and improve the Service
- Provide competitive features
- Maintain security
- Deliver advertisements
- Comply with legal obligations
4. Student Data Protections (FERPA + State Student Privacy Laws)
When used by schools:
- We act as a school official under FERPA.
- Student data is processed only for educational purposes.
- We do not sell student personal information.
- We do not use student data for targeted advertising.
- We do not build non-educational student profiles.
- We delete student data upon verified school request.
5. SOPIPA Compliance (California)
For California K-12 users:
- No targeted advertising using student data.
- No sale of student information.
- No non-educational profiling.
- Data deletion upon school request.
6. Multi-State Student Privacy Compliance
Mind-Match complies with applicable student data privacy statutes in states including but not limited to:
- California
- Colorado
- Connecticut
- Virginia
- Utah
- Texas
- Illinois
- New York
Where required by state law, we:
- Limit data use to educational purposes
- Prohibit sale of student data
- Implement reasonable security safeguards
- Honor deletion requests
7. U.S. State Consumer Privacy Rights
Residents of certain states (including California, Virginia, Colorado, Connecticut, and Utah) may have rights to:
- Access personal data
- Request deletion
- Request correction
- Opt out of targeted advertising
Submit requests to: help@appgeniusstudios.com
We do not sell personal information.
8. GDPR (EEA & UK Users)
If you are located in the EEA or UK, our legal bases for processing are:
- Contractual necessity
- Legitimate interest
- Consent (where required)
You may:
- Access your data
- Request deletion
- Object to processing
- Request portability
9. Advertising & Third Parties
We use:
- Google AdMob
- Google AdSense
- Hosting providers
- Analytics services
We do not control third-party privacy practices.
Users may manage ad preferences through device settings or Google Ad Settings.
10. Data Security
We implement reasonable administrative, technical, and physical safeguards including:
- Encrypted transmission (HTTPS/TLS)
- Secure authentication
- Role-based access controls
- Restricted database permissions
11. Data Retention
We retain data only as long as necessary for:
- Account functionality
- Legal compliance
- Security and dispute resolution
Users may request deletion.
12. Data Breach Notification
In the event of a data breach involving personal data or student information, we will notify affected schools and users as required by applicable law.
13. Changes to This Policy
We may update this Privacy Policy periodically.
Continued use constitutes acceptance.
14. Contact Information
App Genius Studios
help@appgeniusstudios.com
