Privacy Policy
Effective November 2, 2026
Creative Sprout Learning collects as little as possible about children, never shows ads, and never sells or shares children's information for marketing or AI training.
Creative Sprout Learning ("we", "us") is an educational games website for children ages 4 to 8, run by Creative Sprout Designs, a brand of Stem Work Co. This policy explains what we collect, why, and how parents and teachers stay in control. It is written to meet the U.S. Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule, as amended in 2025.
The short version
- Children never create their own login, email or password. A parent or teacher sets up every child profile.
- A child profile holds a first name or nickname, an avatar and game progress. Nothing else.
- No ads, no tracking pixels, no selling or renting of data, and no use of children's data to train AI.
- Parents and teachers can see, download or delete a child's information at any time.
- Questions: hello@creativesproutdesigns.com · [mailing address]
What we collect
We collect contact and billing details from adults, and only play data from children.
| Who | What we collect | How we get it |
|---|---|---|
| Parent or teacher | Name, email address, password (stored encrypted by our login provider), role (parent or teacher) | You enter it when you sign up |
| Parent or teacher (free samples) | Email address, which free sample was requested, and whether you asked for our newsletter | You enter it to get a free printable sample |
| Parent or teacher (paid plans) | Plan, billing status and a Stripe customer ID. Card numbers go straight to Stripe; we never see or store them | Checkout through Stripe |
| Child (family plan) | First name or nickname (up to 20 characters), chosen avatar | The parent enters it |
| Child (classroom) | First name or nickname, avatar, class code and a 3-picture password | The teacher enters it |
| Child (while playing) | Which games were played, accuracy, stars, time spent, rewards earned, daily goal, placement quiz results | Recorded automatically as the child plays |
| Everyone | A sign-in cookie, plus basic technical data (IP address, browser type) kept briefly in server logs | Automatically, to keep the site running and secure |
What we do not collect from children: last names, email addresses, phone numbers, home addresses, photos, voice or video recordings, precise location, or free-typed messages. Children cannot chat with or contact anyone on the site.
Children can also play the free games as guests without any profile; guest play is not saved to our servers. The sign-in cookie and server logs are used only to run the site ("support for internal operations" under COPPA). We do not use them to build profiles or for advertising.
How we use information
We use children's information only to run the games and show progress to their parent or teacher.
- Save progress, stars, rewards and streaks so a child can pick up where they left off
- Suggest the next skill and place a child at the right level after the placement quiz
- Show parents and teachers progress reports and assignments
- Manage accounts, subscriptions and customer support for adults
- Keep the site secure and fix problems
We never:
- Show ads of any kind, including targeted or behavioral ads
- Sell, rent or trade anyone's personal information
- Share children's information with third parties for their own marketing
- Use children's information to train or improve artificial intelligence models
- Send marketing emails to children (children have no email on file)
We may send parents and teachers account emails, such as receipts and password resets. Product news emails go only to adults who opt in, and every one has an unsubscribe link. If you ask for a free printable sample, we use your email to send the download link; we add you to our newsletter only if you tick the box, and only after you open the link.
Parental consent and school authorization
No child profile can be created until a parent, or a teacher acting for a school, has consented.
Families. Before a parent adds a child profile, we email the parent a direct notice that explains what we collect and asks for consent. We verify consent with "email plus": the parent confirms with the button in that email while signed in, and at least a day later we send a second email so the parent can withdraw consent if someone else gave it. When a parent later makes a payment with their card through Stripe, that payment also verifies consent. We can use these methods because we never disclose children's information to third parties for their own purposes.
If a parent does not consent within 7 days, we delete the consent request.
Classrooms. Teachers may create student profiles for use in their class. Following the FTC's guidance on education technology, a teacher does this on behalf of their school, and only for educational purposes. When creating a class, the teacher names the school and confirms that the school allows them to authorize the service. We use student information only to provide the service to that school and for no other commercial purpose. Schools may ask us at any time to review or delete their students' information. Parents of students can contact their child's school or us directly.
Separate consent. If we ever want to disclose children's information to a third party for a purpose that is not needed to run the service, we will first ask for a separate, optional consent. Saying no will never limit a child's access to the games. We do not do this today.
Service providers
We share information only with the four providers that run the site, under written agreements that limit them to providing their service to us and require them to keep it secure.
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database and sign-in for parents and teachers | Account details, child profiles and progress |
| Stripe | Payments | Parent or teacher name, email and card details for paid plans; no child information |
| Vercel | Website hosting | Technical data such as IP address, in short-lived server logs |
| Resend | Sending account, consent and sample emails, and newsletters to adults who opt in | Parent or teacher name and email address; no child information |
We may also disclose information if required by law, or to protect the safety of a child or others. If Creative Sprout Learning is ever sold or merged, children's information stays protected by this policy, and we will notify parents before anything changes.
How long we keep information
We keep children's information only as long as an account is in use, then delete it on a fixed schedule.
| Information | Why we keep it | When we delete it |
|---|---|---|
| Child profile, progress, rewards | So the child can keep playing and adults can see progress | Right away when a parent or teacher deletes the child or the account, or withdraws consent |
| Classroom student data | So the teacher can run the class | Right away when the teacher deletes the class or student, or within 30 days of a school's request |
| Inactive accounts | None after long inactivity | After 24 months with no use, following an email warning 30 days before |
| Pending consent requests | To complete the consent process | After 7 days if consent is not given |
| Free-sample emails (no newsletter) | To send the sample and stop abuse | After 12 months, or right away on request |
| Newsletter sign-ups | To send the newsletter you asked for | When you unsubscribe or ask us to delete it |
| Server logs | Security and fixing errors | Within 30 days |
| Billing records (Stripe) | Tax and accounting law | As long as the law requires; these never include child information |
Deleted information is also removed from our database backups within 30 days.
How we protect information
We keep a written information security program, reviewed at least once a year, that covers children's information.
- All traffic is encrypted (HTTPS); passwords are stored as one-way hashes by our sign-in provider
- Database rules let each parent or teacher see only their own children's data
- Only the site owner has administrator access, protected by two-factor sign-in
- Service providers must give written assurance that they protect the data they handle
- If a breach ever affects children's information, we will notify affected parents and schools as the law requires
Your choices and rights
Parents can review, download or delete their child's information, or withdraw consent, at any time, and it never costs anything.
- Review or download: the dashboard shows every game result, and Download my data gives a full copy
- Correct: remove a child profile and add it again with the right name or avatar
- Delete: delete a child profile or the whole account from the dashboard, or email us
- Emails from us: use the unsubscribe link in any newsletter, or email us to delete your address from our sample and newsletter lists
- Withdraw consent: choose Withdraw consent on the dashboard, or email us, and we will stop collecting and delete the child's information
We will verify that requests come from the child's parent before acting on them. For classroom students, we may refer requests to the school, which controls that data.
Contact us: Creative Sprout Learning, Stem Work Co. · hello@creativesproutdesigns.com · [mailing address]
Changes to this policy
If we make a material change to how we collect or use children's information, we will email parents and teachers and ask for new consent before the change applies. The date at the top shows the latest version.