COPPA Compliance Disclosure

Version 2.0 · Last updated 2026-05-15

Cubs operates an online service directed in part at children under 13. The Children's Online Privacy Protection Act of 1998 (15 U.S.C. §6501) and the FTC's implementing Rule (16 CFR §312, as amended April 22, 2025 with full compliance required April 22, 2026) impose specific obligations on us. This page maps each obligation to the control we use to meet it, the test or audit that proves the control is working, and the in-product surface a parent or auditor can use to verify it.

This is a layperson-readable companion to our authoritative engineering document docs/compliance/COMPLIANCE_VERIFICATION_MATRIX.md.

§312.4 — Direct notice to the parent

Before any child profile is created, the parent sees a direct, plain-language notice listing (i) the categories of information collected, (ii) how it will be used, (iii) any third-party disclosure, and (iv) the parent's right to review, correct, or delete. The notice is reinforced by an in-app banner and an in-line consent indicator next to every kid input. Our full notice is the Privacy Policy; the parental consent capture flow is described on the Parental Consent page.

§312.5 — Verifiable parental consent

Today, during beta, Cubs uses an affirmative checkbox attestation tied to an email-verified parent account and recorded in an immutable audit log. The schema also accepts a signed paper consent form on request. Card-charge verification, government-ID upload, "text plus", and knowledge-based authentication are on the pre-general-availability roadmap and will be live before the FTC's amended Rule full-compliance date of April 22, 2026.

Baseline consent today covers profile creation and AI personalization in one versioned record. Before the April 2026 deadline we split the baseline into three distinct, independently revocable records — profile creation, AI personalization, school-record import — so the amended Rule's "separate consent for material categories of disclosure" standard is respected as a code-level invariant rather than a policy statement. See Parental Consent for the current methods, the roadmap methods, and the re-consent triggers.

§312.5 amended — Separate consent for third-party disclosure

Under the amended Rule, Cubs must obtain a separate parental consent before disclosing child personal information to any third party for any purpose that is not integral to the service. Our practice goes further:

The harness refuses to dispatch any child-context AI call to a provider that has not confirmed zero-data-retention (no training, no logging, no retention).
School-imported records (FERPA-tagged) cannot be forwarded to any non-ZDR provider — a code-level invariant tested by ferpa-tag-zdr.test.ts.
We do not sell or share personal information for cross-context behavioral advertising; the question of separate consent does not arise.
We give 30 days advance notice before adding any subprocessor that processes child data, with re-consent prompted before processing begins.

§312.6 — Parent's right to review and delete

You can download a CSV of every AI call made on behalf of your family from the Family AI hub's Activity tab (AI activity (CSV)), and you can permanently delete your family's account and all of its data in-app from Settings → Privacy & data. For any other records, email us at support@cubsfamily.app and we will provide them.

§312.7 — No conditioning

Cubs does not condition a child's participation in any feature on disclosure of more personal information than is reasonably necessary to deliver that feature. AI personalization is a separately-consented optional layer; refusing it leaves the core family-coordination and chore features fully available.

§312.8 — Confidentiality, security, and integrity

Cubs maintains a written information-security program appropriate to the sensitivity of the data, in line with the amended Rule's explicit requirement. The program covers TLS 1.3 in transit, AES-256 at rest, row-level security policies on every kid-touching table, break-glass-only production access logged immutably, two-layer AI moderation, redaction at ingress and egress, and a documented incident-response playbook. The program is reviewed annually and after every material change.

§312.10 — Retention

Cubs does not retain child personal information indefinitely. The default retention windows are 13 months (parent AI logs) and 18 months (kid AI logs — a FERPA floor, i.e. the shortest a kid row is ever kept, not a ceiling), enforced by a daily retention cron that hard-deletes rows whose audit_retention_until has passed. There is currently no parent-facing control to shorten either window — Settings → Privacy & data does not offer a retention setting today, and the 18-month kid floor cannot be configured below FERPA's minimum in any case. The cron writes a compliance.retention_swept summary row to the audit log on each run.

§312.11 — Safe-harbor program

Cubs is not currently a participant in an FTC-approved §312.11 self-regulatory safe-harbor program. We comply directly with the Rule and welcome FTC engagement. We will evaluate joining a program (e.g., kidSAFE, ESRB Privacy Certified, BBB National Programs) post-GA.

Audit cadence

Per pull-request: brand audit + ZDR-registry CI gate + cascade-coverage schema walk run automatically.
Quarterly: red-team adversarial eval against the safety harness using SORRY-Bench prompts and our custom kid-jailbreak set; results posted to the security audit log and summarized in docs/red-team/.
Annually: full Compliance Verification Matrix review with external counsel; subprocessor DPAs re-confirmed; DPIA refreshed; this disclosure re-published.
On material change: any new AI feature, new model, new subprocessor, or new regulation triggers a matrix review before code lands.

Contact

Privacy or COPPA questions, parent-access requests, complaints, or to request the machine-readable export of your family's data: support@cubsfamily.app.

You also have the right to contact the US Federal Trade Commission directly. The FTC's consumer complaint portal is at reportfraud.ftc.gov. Cubs will not retaliate against any parent for filing a complaint.