Our Commitment to Your Privacy
MindBright is built for children. Privacy and security are not features we added — they are foundational to every architectural and design decision we make.
Last updated: October 6, 2026
Information We Collect
Parent Account
- Email address (stored in AWS Cognito and our application database)
- Display name
- Account creation and last-updated timestamps
- Subscription status and billing customer identifiers
Storage: AWS Cognito and DynamoDB; Stripe processes billing information
Child Profile
- First name only (no last name, no full name required)
- Grade tier selection (Pre-K/K, 1st–2nd, or 3rd–5th)
- Gamification state (XP, level, streak — generated by the platform, not collected from the child)
Storage: DynamoDB (profile ID linked to the parent account)
Learning Activity
- Activity completion records (module, score, attempts, time spent)
- Achievement badges earned
- Saved writing, coding projects, and generated activities
- Activity events, timestamps, and session duration
Storage: DynamoDB (profile ID linked to the parent account)
Free-text work and support messages may contain information you choose to include. Support requests include contact details and message content. Hosting services may process request metadata such as IP addresses for delivery and security.
What We Do Not Collect
Children's Privacy
MindBright is designed for use by children under 13 under the supervision of a parent or legal guardian. Parents manage profiles and learning records. The following describes our current data practices.
Children never create accounts directly. All accounts are created and managed by a parent or legal guardian.
Profiles use a name or nickname and grade tier. Learning records and saved work support the educational service.
We do not serve behavioral advertising or targeted advertising of any kind.
We do not use third-party analytics, tracking pixels, or ad network scripts in the child-facing portions of the platform (/play routes).
We do not sell children’s personal information. Service providers process data to operate the features described below.
Parents may review their child’s data, request corrections, or delete profiles entirely at any time through the parent dashboard.
Profile deletion removes linked records from active application tables. Backup and other retention limits are described below.
How We Use Data
Providing the service
Displaying progress, and achievements to the child during learning activities and to the parent on the dashboard.
Progress reporting
Generating per-subject breakdowns, accuracy metrics, and activity history for the parent dashboard.
Platform improvement
Profile-linked activity events support usage summaries and content improvement. Stored rollups contain module/activity counts and durations rather than profile identifiers.
We Never Use Data For
- ×Advertising or marketing to children
- ×Selling personal information or sharing it for advertising
- ×Building behavioral profiles of children
- ×Training our own machine learning models on individual child data
- ×Any purpose unrelated to providing the educational service
Data Security
We implement security controls at every layer of the platform. Security is not a feature — it is an architectural requirement applied to every component, endpoint, and deployment.
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS). Enforced by AWS CloudFront and ACM certificate management.
Encryption at Rest
All data stored in DynamoDB and S3 is encrypted at rest using AWS-managed encryption keys (AES-256).
Authentication
Parent accounts are authenticated through AWS Cognito using Secure Remote Password (SRP) protocol. Passwords are never transmitted in plaintext and are not stored by MindBright.
Access Control
Parent-facing child-data endpoints use authentication and ownership checks. Backend services use IAM permissions; some services share a broader application role.
Infrastructure
Our application hosting, databases, authentication, and asset delivery use AWS. Billing and enabled AI features also use the providers listed below.
No Third-Party Scripts in Kid Zone
The child-facing portion of the platform (/play) loads zero third-party JavaScript. No analytics, no chat widgets, no tracking pixels, no ad scripts. Every script that runs in the kid zone is our own.
Dependency Management
We regularly audit our dependencies (npm audit, pip audit) and minimize third-party packages to reduce attack surface.
Data Retention & Deletion
Active Accounts
Account records and saved learning work remain in the application until removed. Raw activity logs are scheduled to expire after seven days; generated activity caches after 90 days. Expiration cleanup is asynchronous. Operational logs and backups have separate retention settings.
Profile Deletion
Completed deletion removes the profile, progress, achievements, writing, coding projects, activity logs, and profile-linked generated activities from active application tables. Cleanup may require a retry; the dashboard reports when deletion is incomplete. New saves are blocked after deletion starts.
Account Deletion
Contact privacy@mindbright.io to request parent-account closure. Deleting a child profile does not close the parent account or cancel its subscription. Billing records, support correspondence, logs, and backups are handled separately; we do not promise immediate removal from every system.
Backups and retained summaries
Profile deletion does not immediately erase backup recovery copies or operational logs. These remain subject to their retention settings. Module and activity totals that do not contain profile identifiers may remain. Contact us for help with retention questions or child information included in support correspondence.
Third-Party Services
MindBright uses a minimal set of third-party services. We do not use ad networks, data brokers, analytics platforms, or social media integrations.
Amazon Web Services (AWS)
Purpose: Cloud infrastructure (compute, database, storage, CDN, authentication, DNS)
Data exposure: AWS processes account records, child profiles, saved work, learning events, and operational logs for application hosting and storage.
Stripe
Purpose: Subscription billing and payment processing
Data exposure: Parent email, billing customer identifiers, subscription details, and payment information entered into Stripe checkout. MindBright stores billing identifiers and subscription status, not full card details.
Anthropic or OpenAI (when AI features are enabled)
Purpose: Learning hints and activity generation
Data exposure: Activity context and submitted learning inputs may be sent to the configured AI provider. Avoid including names, contact details, or other personal information in free-text work. Provider processing and retention are separate from profile deletion.
GitHub
Purpose: Source code hosting and CI/CD deployment
Data exposure: Source code only. No user data is stored in or transmitted to GitHub.
Your Rights
As a parent or legal guardian, you can manage profiles and contact us about the data associated with your account.
Right to Access
You may view learning progress, activity history, scores, and achievements through the parent dashboard. Contact us about records not shown there.
Right to Correction
You may update your child’s name and grade tier at any time through the profile settings.
Right to Deletion
You may start child-profile deletion in the parent dashboard. Completion removes the profile and linked learning records from active application tables. If interrupted, use Continue deletion to retry.
Parent-account deletion is not currently self-service. Contact privacy@mindbright.io to request account closure and discuss billing and retained records.
Right to Refuse
You may stop further learning-data collection by discontinuing use and requesting deletion of existing records.
Contact
If you have questions about this privacy policy, want to exercise your rights regarding your child's data, or have concerns about our data practices, contact us at:
privacy@mindbright.io
We will respond to all privacy-related inquiries within 30 days.
Built for kids. Protected like it matters.
Get Started