Privacy Policy
KidsCode is a children's educational platform. We take the privacy of children and their families seriously. This policy explains what we collect, why, and how we protect it — in plain language.
1. Who We Are
KidsCode (kidscode.ca) is an educational platform that teaches children aged 8–14 Arduino programming through guided, project-based lessons. The platform is operated in Ontario, Canada.
For privacy requests, use the contact form at kidscode.ca/privacy/contact. We respond within 30 days.
2. What We Collect
Account information
- Email address (parent and direct accounts only — not collected for student accounts)
- Username
- Password, stored as a one-way bcrypt hash — your actual password is never stored or readable
- Account type (parent or student)
- Date the account was created
- Email verification status
Usage and progress data
- Which lessons you have unlocked and completed
- Time spent on each lesson (aggregated, used for platform analytics)
- Arduino code you write and save in the block builder
- Challenge submissions and associated admin feedback
- Feedback messages and support conversation threads
- Badges earned
Technical data
- Session cookie — keeps you logged in for up to 8 hours
kclink_installed— a browser localStorage flag that remembers whether the KidsCode Desktop companion app is installed on your computersidebar— a browser localStorage preference (open or closed)
3. Why We Collect It
| Data | Purpose |
|---|---|
| Email address | Account verification, password recovery, service notifications |
| Username | Display within the platform; link your progress to your account |
| Password hash | Authenticate you when you log in |
| Lesson progress | Unlock the next project in sequence; show your dashboard |
| Activity time | Internal admin analytics — never shared externally |
| Saved code | Let you return to a lesson and continue where you left off |
| Challenge submissions | Admin review and written feedback |
| Feedback messages | Respond to your support requests |
| Session cookie | Keep you logged in during your active session |
4. How Long We Keep Your Data
We retain your data for as long as your account is active. If you request account deletion, all personal data associated with your account — including progress, saved code, submissions, and messages — is removed from our systems within 30 days of your confirmed request.
Third-party services we use (see Section 5) operate their own retention timelines, which are described below.
5. Third-Party Services
We share data with the following providers only to the extent necessary to operate the platform.
Supabase (supabase.com) — Database Hosting
All user account data, lesson progress, saved code, and messages are stored on Supabase-hosted infrastructure. Supabase is SOC 2 Type II certified.
Resend (resend.com) — Email Delivery
We use Resend to send account verification emails and password reset links to parent and direct accounts. Your email address is transmitted to Resend only to deliver these messages.
OpenAI (openai.com) — AI Tutor
When you use the Get a Hint feature in a lesson, the following information is sent to OpenAI's API to generate a hint response:
- The Arduino code you have written on the current lesson step
- Your question or the symptom you selected
- Lesson step context (title, instruction text, guidance notes)
We have the following safeguards in place with OpenAI:
- OpenAI does not use our API submissions to train or fine-tune any model (training disabled on our account)
- We do not log API calls in our OpenAI organisation dashboard
- A Data Processing Addendum (DPA) is in place with OpenAI
- OpenAI retains API data for up to 30 days for abuse-prevention monitoring under their standard API policy, after which it is deleted from their systems
Discord (discord.com) — Internal Notifications Only
When a user submits a feedback message, an internal notification is sent to our private Discord server containing only the username, feedback category, and subject line. No message content is transmitted. Discord is not given any other user data and does not collect information about our users.
Google Fonts (fonts.googleapis.com)
Our pages load the Poppins typeface from Google Fonts. This request is made by your browser and results in your IP address being visible to Google. We do not control this. You can block Google Fonts requests using a browser extension if preferred.
6. Student Accounts and Children's Privacy
KidsCode serves children aged 8–14. Student accounts are always created and managed by a parent or guardian — never by the child directly.
We take the following measures for student accounts:
- Student accounts are not assigned a real email address. An internal non-routable address is used (e.g.
username.id@kidscode.internal) that cannot receive external email - Password resets for student accounts are handled only by the linked parent account
- A parent or guardian controls account creation and deletion
- When the Get a Hint feature is used, the student's code and question are sent to OpenAI as described in Section 5. By creating a student account, the parent consents to this processing
Parent and guardian rights
- Request to review the data we hold for your child's account
- Request correction of any inaccurate data
- Request deletion of your child's account and all associated data
- Withdraw consent for AI tutor use (the hint feature will not function if withdrawn)
Use the contact form at kidscode.ca/privacy/contact to exercise any of these rights.
7. Your Rights (PIPEDA)
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Withdraw consent to certain data processing — note that withdrawing consent may limit your ability to use parts of the platform
- Request deletion of your account and personal data
To exercise any of these rights, use the contact form below. We will respond within 30 days.
Submit a Privacy Request →8. Cookies and Local Storage
| Item | Type | Purpose | Expires |
|---|---|---|---|
| Session cookie | HTTP cookie | Keeps you logged in during your active session | 8 hours from last activity |
kclink_installed | localStorage | Remembers whether the KidsCode Desktop companion app is installed | Until browser storage is cleared |
sidebar | localStorage | Remembers your sidebar preference (open or closed) | Until browser storage is cleared |
We do not use advertising cookies, tracking pixels, or third-party analytics services.
9. Security
We use the following measures to protect your data:
- Passwords are stored as bcrypt hashes — we cannot recover your password
- All connections use HTTPS/TLS encryption in transit
- CSRF protection on all forms
- Session cookies expire after 8 hours of inactivity
- Rate limiting on authentication and contact endpoints
10. Complaints
If you have a complaint about our handling of your personal information and we have not resolved it to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada:
- Website: www.priv.gc.ca
- Toll-free: 1-800-282-1376
11. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the platform after a change constitutes acceptance of the updated policy.