🛡️ Your family's privacy

Privacy Policy & Children's Privacy (COPPA) Notice

Last updated: 15 July 2026 · Applies to numbercadets.com and readingcadets.com (together, the "Cadets Academy")

⚠️ Before you publish: this is a working draft prepared from how the site actually handles data. Replace the three placeholders — [LEGAL ENTITY], [CONTACT EMAIL] and [GOVERNING JURISDICTION] — and have it reviewed by a qualified privacy lawyer before you rely on it. COPPA has specific verifiable-consent rules and real penalties; this draft is a strong starting point, not legal advice.

The short version. Number Cadets is built for children, so we collect as little as possible. The only personal information we hold is a grown-up's email address, used to run the account. A child never gives us their real name, photo, location, or contact details — just a made-up codename and an emoji avatar they pick. We show no ads, we never sell anyone's data, and there is no open chat or way for children to message strangers.

1. Who we are

The Cadets Academy — Number Cadets (math) and Reading Cadets (reading) — is a subscription learning service operated by [LEGAL ENTITY] ("we", "us", "our"). This notice explains what we collect, why, who we share it with, and the choices you have. It covers both sites, because one account works across both.

2. Our approach to children's privacy (COPPA)

The U.S. Children's Online Privacy Protection Act (COPPA) governs the online collection of personal information from children under 13. We have designed the product so that children do not provide personal information to us at all:

A parent, guardian or teacher creates the account. They are the only person who gives us any personal detail — an email address for login and account recovery.
A child plays as an "agent" identified only by a codename they choose and an emoji avatar. We ask children for no real name, age, birthday, photo, voice, address, phone number, email, or location.
We store a child's learning progress — which cases they've solved, badges, XP, and which Common Core standards they've practised — linked to that codename, not to any identity.
There is no chat, no user-to-user messaging, no public profile, and no way for a child to publish anything that another user could see.

Because the account holder is a consenting adult and children supply no personal information, we do not seek separate verifiable consent from the child. If you believe a child has somehow provided us personal information, contact us at [CONTACT EMAIL] and we will delete it promptly.

3. What we collect

Information	From whom	Why
Email address	The grown-up (parent or teacher)	To create and secure the account, sign you in, verify your address, and send account emails (e.g. email verification, password reset).
Password (stored only as a secure hash)	The grown-up	To protect the account. We never store your password in readable form.
Billing details	The grown-up, via Stripe	To take subscription payments. Card numbers are handled by Stripe and never touch our servers — we keep only a Stripe customer/subscription reference and your plan status.
Class code (teachers only)	Generated for the teacher	So students can join a class by entering a code and their codename.
Agent codename & emoji avatar	Chosen by the child in-app	To personalise play and save progress. Not real-world identifiers.
Learning progress	Generated as the child plays	Cases solved, badges, XP, and per-standard mastery, so progress is saved and a parent/teacher can see how a child is doing.
Limited technical data	Your browser/device	Standard security and delivery data (e.g. IP address seen transiently for abuse/rate-limiting and by our hosting provider). See §6.

4. What we do not do

We do not show advertising, and we do not allow third-party ad networks or behavioural ad tracking on the site.
We do not sell, rent, or trade personal information to anyone.
We do not build advertising profiles of children or adults.
We do not ask children for any personal information.

5. How we use what we collect

To provide the service: run accounts, save progress, and show parents/teachers a child's mastery.
To take payment and manage subscriptions (through Stripe).
To send necessary account emails — verification and password reset (through Resend). We do not send marketing email to the account address unless you opt in.
To keep the service secure and prevent abuse (e.g. rate-limiting sign-in attempts, bot protection).
To understand, in aggregate, how the site is used so we can improve it (see §6).

6. Cookies, analytics & security tools

We keep this deliberately light:

Essential cookies / storage. We use a small amount of browser storage to keep you signed in and remember the active agent. The service cannot function without it.
Analytics. We use Google Analytics 4 to measure site usage in aggregate. We have configured it in privacy-protective mode for a children's service: Google Signals and advertising features are turned off, ad-personalisation is disabled, and IP addresses are anonymised. We use it to count visits and understand which pages help, not to identify or track individuals.
Bot protection. We use Cloudflare Turnstile to tell humans from bots on sign-up and sign-in, which helps protect accounts.
Hosting. The site runs on Cloudflare, which processes limited technical data (such as IP address) to deliver and secure the pages, as any web host does.

7. Who we share information with

We share the minimum necessary with a small set of service providers ("sub-processors") who act on our instructions and are contractually bound to protect it. We do not otherwise disclose personal information, except where required by law.

Provider	Purpose	What they handle
Stripe	Payments & subscriptions	The grown-up's billing details and card data.
Resend	Transactional email	The grown-up's email address, to send verification and password-reset messages.
Cloudflare	Hosting, database, bot protection	Account data, agent progress, and limited technical data.
Google Analytics	Aggregate usage measurement	De-identified, IP-anonymised usage data (no advertising signals).

8. Schools, teachers & classrooms

When a teacher creates a Classroom account and adds students, the teacher (and their school) is responsible for having the appropriate authority to do so under school policy and applicable law. Under COPPA, a school may provide consent for the collection of students' personal information for use in an educational context. Because our students supply no personal information beyond a codename, the data involved is minimal. We use student progress data only to provide the educational service to that class — never for advertising, and never for any commercial purpose unrelated to the service.

9. Your rights & choices

As the account holder you can, at any time:

See the progress recorded for each agent on your account, from your dashboard.
Correct your email or an agent's codename.
Delete an individual agent, or your whole account. Deleting an account removes its agents and their progress (cascading deletion), subject to any records we must keep for legal or accounting reasons (e.g. proof of a transaction).
Refuse or withdraw — you can stop using the service and ask us to delete your data by contacting [CONTACT EMAIL].

A parent whose child uses a school-created classroom account can direct these requests to the child's school, or to us, and we will assist.

10. How long we keep information

We keep account and progress data for as long as the account is active, so progress is not lost. If you delete your account, we delete the associated agents and progress. We may retain limited records (such as billing history) where the law requires it, and de-identified, aggregate analytics that cannot be tied back to an individual.

11. Security

Passwords are stored only as secure hashes; card data is handled by Stripe and never reaches our servers; sign-in is rate-limited and bot-protected; and access to systems is restricted. No online service can promise perfect security, but we work to protect your information and to hold as little of it as possible in the first place.

12. Where your information is processed

Our providers (Cloudflare, Stripe, Resend, Google) operate globally and may process data in countries other than yours, including the United States. Where we transfer information internationally, we rely on our providers' safeguards for such transfers.

13. Changes to this notice

If we make a material change to how we handle personal information — especially children's — we will update this page and, where appropriate, notify account holders by email before the change takes effect. The "last updated" date above always reflects the current version.

14. Contact us

Questions, requests, or concerns about privacy — including anything involving a child's information — go to [CONTACT EMAIL]. This service is operated by [LEGAL ENTITY] and this notice is governed by the laws of [GOVERNING JURISDICTION].