Children’s privacy notice

KidCards is built for children under 13, so the Children’s Online Privacy Protection Act applies to everything here. This page is the direct notice we give you before we collect anything from your child.

Who we are

KidCards LLC, Pittsburgh, Pennsylvania. Questions, requests, and deletions: privacy@mykidcard.com.

What we collect from a child

This is the complete list. There is nothing else.

• Nickname — 2 to 20 characters, chosen by you and your child. Please do not use their real name.
• Avatar — one of six preset characters. Not a photo.
• Birth year — the year only, so we can apply the right protections.
• Cards your child adds — a title, a category, an optional description and wish note, and optionally a photo of a trading card.

What we never collect from a child

• Full name, date of birth, home address, email address, or phone number
• A photograph or video of your child, or their voice
• Location of any kind, including approximate location from an IP address
• Contacts, friend lists imported from anywhere, or school information
• Persistent identifiers used to build an advertising profile

How we verify you are the parent

Before your child’s profile exists, you complete a government-ID check with a matching selfie, handled by Stripe Identity. We receive the yes-or-no outcome and a timestamp. We then ask Stripe to redact the ID images and the selfie. We do not store your ID, your selfie, or any biometric template.

What each permission means

• Creating a kid profile — required. Without it there is no account.
• Sharing a QR code — lets your child’s profile be found by another family scanning the code in person. Both parents must still approve.
• Listing cards — lets your child add cards for you to review.
• Trading — lets your child propose a swap with a connected friend. Both parents approve the swap, and the swap itself happens in person.
• Selling — lets a card carry an asking price. Any money moves between parents, never between children.

Who else sees your child’s information

Another family sees your child’s nickname, avatar, and approved cards only after both parents have approved a connection. Nobody else.

We do not run third-party advertising or analytics on any page your child uses. Our marketing pages use analytics; the signed-in app does not. Our service providers are Supabase (database and authentication), Stripe (identity verification and payments), and Vercel (hosting). They act on our instructions and do not use your child’s information for their own purposes.

Your rights as a parent

• Review everything we hold about your child
• Delete your child’s profile and everything attached to it
• Withdraw any permission at any time. Withdrawing the first one stops all further collection and removes the profile.
• Refuse to let us collect more without deleting what already exists

Email privacy@mykidcard.com and we will act within 30 days. Deletion is immediate on request.

If this notice changes materially

We version this notice. If we change it in a way that matters, your existing permissions stop counting and we ask you again before collecting anything further. You will see the request the next time you sign in.

If you cannot complete the ID check

Email support@mykidcard.com. We offer an alternative knowledge-based verification method.

See also our privacy policy and data retention policy.