Our Commitment to Your Privacy
MindBright is built for children. Privacy and security are not features we added — they are foundational to every architectural and design decision we make.
Last updated: February 24, 2026
Information We Collect
Parent Account
- Email address (stored in AWS Cognito, not in our application database)
- Display name
- Account creation and last-updated timestamps
Storage: AWS Cognito (email) / DynamoDB (display name, timestamps)
Child Profile
- First name only (no last name, no full name required)
- Grade tier selection (Pre-K/K, 1st–2nd, or 3rd–5th)
- Gamification state (XP, level, streak — generated by the platform, not collected from the child)
Storage: DynamoDB (tied to anonymous profile ID, not to any external identifier)
Learning Activity
- Activity completion records (module, score, attempts, time spent)
- Achievement badges earned
Storage: DynamoDB (tied to anonymous profile ID)
What We Do Not Collect
Children's Privacy (COPPA)
MindBright is designed for use by children under 13 under the supervision of a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA) and apply its principles as the baseline for all data handling decisions, regardless of jurisdiction.
Children never create accounts directly. All accounts are created and managed by a parent or legal guardian.
We collect only the minimum data necessary to provide the educational service: a first name and grade tier.
We do not serve behavioral advertising or targeted advertising of any kind.
We do not use third-party analytics, tracking pixels, or ad network scripts in the child-facing portions of the platform (/play routes).
We do not sell, rent, license, or otherwise disclose children’s personal information to third parties.
Parents may review their child’s data, request corrections, or delete profiles entirely at any time through the parent dashboard.
Upon profile deletion, all associated activity data (progress, achievements, portfolio) is permanently removed.
How We Use Data
Providing the service
Displaying progress, and achievements to the child during learning activities and to the parent on the dashboard.
Progress reporting
Generating per-subject breakdowns, accuracy metrics, and activity history for the parent dashboard.
Platform improvement
Aggregated, de-identified usage patterns to improve content quality and difficulty calibration. No individual child data is used for this purpose.
We Never Use Data For
- ×Advertising or marketing to children
- ×Selling or sharing with third parties
- ×Building behavioral profiles of children
- ×Training machine learning models on individual child data
- ×Any purpose unrelated to providing the educational service
Data Security
We implement security controls at every layer of the platform. Security is not a feature — it is an architectural requirement applied to every component, endpoint, and deployment.
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS). Enforced by AWS CloudFront and ACM certificate management.
Encryption at Rest
All data stored in DynamoDB and S3 is encrypted at rest using AWS-managed encryption keys (AES-256).
Authentication
Parent accounts are authenticated through AWS Cognito using Secure Remote Password (SRP) protocol. Passwords are never transmitted in plaintext and are not stored by MindBright.
Access Control
Every API request verifies that the authenticated parent owns the requested resource. A parent can only access their own children’s data. Backend services use least-privilege IAM roles with per-table, per-action permissions.
Infrastructure
MindBright runs entirely on AWS infrastructure, which maintains SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1 certifications. We do not operate our own servers.
No Third-Party Scripts in Kid Zone
The child-facing portion of the platform (/play) loads zero third-party JavaScript. No analytics, no chat widgets, no tracking pixels, no ad scripts. Every script that runs in the kid zone is our own.
Dependency Management
We regularly audit our dependencies (npm audit, pip audit) and minimize third-party packages to reduce attack surface.
Data Retention & Deletion
Active Accounts
Data is retained for as long as your account is active. We do not archive or retain data beyond what is necessary to provide the service.
Profile Deletion
When a child profile is deleted through the parent dashboard, all associated data is permanently removed from our database: progress records, achievements, and the profile itself. This action is immediate and irreversible.
Account Deletion
When a parent account is deleted, all child profiles and their associated data are permanently removed. The Cognito authentication record is also deleted. No data is retained after account deletion.
Third-Party Services
MindBright uses a minimal set of third-party services. We do not use ad networks, data brokers, analytics platforms, or social media integrations.
Amazon Web Services (AWS)
Purpose: Cloud infrastructure (compute, database, storage, CDN, authentication, DNS)
Data exposure: All application data is processed and stored within AWS. AWS does not access or use this data for its own purposes.
GitHub
Purpose: Source code hosting and CI/CD deployment
Data exposure: Source code only. No user data is stored in or transmitted to GitHub.
Your Rights
As a parent or legal guardian, you have full control over your children's data on MindBright.
Right to Access
You may view all data associated with your child’s profile at any time through the parent dashboard, including activity history, scores, and achievements.
Right to Correction
You may update your child’s name and grade tier at any time through the profile settings.
Right to Deletion
You may delete any child profile at any time. Deletion is immediate and permanent — all associated progress, and achievements data is removed from our database.
You may delete your entire parent account, which will remove all child profiles and all associated data.
Right to Refuse
You may refuse further data collection by deleting your child’s profile or your account. Because we collect only what is necessary to provide the service, refusing data collection means discontinuing use of the platform.
Contact
If you have questions about this privacy policy, want to exercise your rights regarding your child's data, or have concerns about our data practices, contact us at:
privacy@mindbright.io
We will respond to all privacy-related inquiries within 30 days.
Built for kids. Protected like it matters.
Get Started