Privacy Policy

WildCoders is an online coding game for children. Because our Service is directed to kids, we take particular care with how information is handled. This Privacy Policy explains what we collect (and don't), how we use it, and the choices parents and guardians have. The policy is written to comply with the Children's Online Privacy Protection Act ("COPPA") and the FTC's COPPA Rule (16 C.F.R. Part 312).

Your use of the Service is also governed by our Terms of Service, available at https://www.wildcoders.org/terms.

WildCoders LLC ("WildCoders," "we," "us," or "our") operates the WildCoders website and online services, including www.wildcoders.org and any associated applications (collectively, the "Service").

If you have questions about this policy or want to exercise any of the parental rights described below, you can reach us at:

Email: hello@wildcoders.org

Mailing address: 6110 E. Colfax Ave., Ste. 4 #105, Denver, CO 80220

Phone: 720-389-7115

WildCoders has two phases:

Free play. Anyone can play WildCoders for free without signing up, creating an account, or providing a name, email, or any other contact information. Free gameplay is anonymous. Progress in the free phase is stored in the player's web browser on their own device. We do not ask the child for personal information, and we do not associate gameplay with an identified person.

Subscribed accounts. To unlock the full Service beyond the free phase, a parent or legal guardian who is at least 18 years old ("Parent") creates a WildCoders account by providing their name, email address, and payment information. The Parent owns the account. Children participate through "player profiles" that the Parent creates inside the account. Children do not create their own accounts and are not asked to provide personal information directly to us.

3.1 In the free phase

We do not collect names, email addresses, phone numbers, mailing addresses, photos, voice, video, biometrics, precise geolocation, or any other directly identifying information from free-phase players.

Our servers necessarily receive standard web traffic information when the Service is loaded — for example, IP address, browser type, device type, and basic request logs. We treat this information as a "persistent identifier" under COPPA and use it solely for the support of the internal operations of the Service, as described in Section 5 below. We do not use this information to contact a specific individual, to amass a profile, or for behavioral advertising.

3.2 From the Parent (at sign-up and for the subscribed account)

• Parent first and last name
• Parent email address
• Billing information, processed by our payment processor; we do not store full card numbers
• Records of consent — date, method, scope, and policy version

3.3 From or about the Child (inside a subscribed account)

We intentionally minimize what we collect from or about children. From a child's player profile we collect:

• A first name or nickname chosen by the Parent
• A grade or age band selected by the Parent
• Gameplay activity (lessons started/completed, puzzles solved, time spent, in-game choices)
• A persistent identifier (such as a session cookie, account-linked device identifier, or login token) used to keep the child signed in and to operate the Service

We do not ask children for last names, mailing addresses, phone numbers, government IDs, photos, video, voice recordings, precise geolocation, or biometric data. We do not enable children to make personal information publicly available through the Service.

• To operate the Service — authenticating the user, saving progress, personalizing in-game content, and remembering settings
• To communicate with the Parent about the account, billing, technical issues, parental consent, and material changes to this policy
• To maintain the security, integrity, and proper functioning of the Service
• To comply with legal obligations and protect the safety of our users

We do not use information collected from children to send them marketing, to build profiles about them, to serve behavioral advertising, or for any purpose unrelated to operating the Service.

In both the free and subscribed phases, we use persistent identifiers (cookies, session tokens, device identifiers, IP addresses, and similar technologies) only for the "support for the internal operations" of the Service as defined by the COPPA Rule. Specifically, we use them to:

• Maintain and analyze the functioning of the Service
• Authenticate users and maintain logged-in sessions (subscribed phase)
• Personalize in-game content within the Service
• Protect the security and integrity of the Service and its users
• Comply with legal and regulatory obligations

We do not use persistent identifiers to contact a specific individual, to amass a profile, to serve behavioral advertising, or for any other purpose outside those listed above.

We do not sell, rent, or trade personal information collected from or about children. We share information only as follows:

• Service providers acting on our behalf — including Vercel (cloud hosting), Stripe (payment processing for Parent billing), Anthropic (AI services that power Koda), Resend (transactional email delivery), and Sentry (error monitoring). These vendors are contractually required to safeguard the information and use it only to provide services to us, in accordance with their own privacy commitments.
• Legal compliance and safety — when required by law, valid legal process, or to protect the safety of a child or the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy or notify the Parent.

A current list of categories of third parties is available on request at hello@wildcoders.org.

Because the free phase of WildCoders does not collect personal information from children, no parental consent is required to play in the free phase.

When a Parent creates a subscribed WildCoders account, we obtain verifiable parental consent before any personal information is collected from a child. We use the monetary-transaction method permitted by 16 C.F.R. § 312.5(b)(2)(ii): the Parent provides a payment method that generates a contemporaneous notification of the transaction to the primary account holder, and the initial subscription charge is processed as that transaction. We send the Parent a direct notice email at sign-up describing what we collect from the child, how we use it, and the Parent's rights, with a link to this policy.

A Parent may revoke consent at any time using the methods described in Section 8.

At any time, a Parent of a child whose information is in a subscribed account may:

• Review the personal information we have collected about the child
• Refuse to permit further collection or use of the child's information
• Request that we delete the child's information
• Revoke previously given consent

A Parent can exercise these rights from within the "Parent Settings" area of the Service or by emailing hello@wildcoders.org. We will verify that the requester is the child's Parent before acting on the request. If a Parent revokes consent, we may discontinue the affected portions of the Service for that child.

We retain personal information collected online from a child only for as long as is reasonably necessary to fulfill the purpose for which it was collected. We maintain a written Data Retention Policy that sets retention timeframes by data type, including:

• Child player-profile data and gameplay progress: retained while the account is active; auto-deleted after 24 months of inactivity
• Parent account data: retained while the account is active and for a reasonable period after closure for legal and tax purposes
• Free-phase server logs containing IP addresses or other persistent identifiers: rolling 90-day window
• Consent records: retained for the longer of three years or applicable legal requirements

When information is no longer reasonably necessary, we delete it using reasonable measures to protect against unauthorized access during deletion. We do not retain children's personal information indefinitely.

We maintain a written Information Security Program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information we collect and the size, complexity, and scope of our business. Safeguards include encryption in transit, encryption at rest for stored personal information, access controls based on least privilege, regular risk assessments, and written assurances from service providers who handle children's information.

If we experience a security incident that involves the unauthorized acquisition or disclosure of personal information we have collected from or about a child, we will notify the affected Parents by email without unreasonable delay and, where required by law, will also notify the Federal Trade Commission and any other applicable regulatory authority. The notice will describe (a) what happened, (b) the types of information involved, (c) the steps we are taking to address the incident, and (d) what affected Parents can do to protect themselves.

We do not condition a child's participation in a game, activity, or prize on the child disclosing more personal information than is reasonably necessary to participate.

WildCoders is operated from the United States, and our servers and the servers of our service providers are located in the United States. If you access the Service from outside the United States, you understand and agree that information we collect about you and your child will be transferred to, stored in, and processed in the United States, which may have data-protection and privacy laws that differ from (and may be less protective than) those in your country.

Some web browsers offer a "Do Not Track" (DNT) signal. There is no universal standard for how operators must respond to DNT signals, and at present we do not respond to them. We do not track users across third-party websites or services for behavioral advertising purposes in the first place, so the practical effect of a DNT signal on our handling of your information is minimal. If a universal standard is established, we will reassess this position.

Koda uses artificial-intelligence models, provided by Anthropic, to generate responses to your child during play and to draft the weekly Koda parent note. These features assist human-designed prompts and templates; they do not make automated decisions that produce legal effects concerning your child or that significantly affect your child in a comparable way. We do not use automated profiling to evaluate your child's character, performance, behavior, or interests for any consequential decision about them.

If you are located in the European Economic Area, the United Kingdom, or Switzerland (an "EEA Individual"), the EU General Data Protection Regulation ("GDPR") or comparable law may apply to our processing of your personal information. For the purposes of the GDPR, WildCoders LLC is the data controller.

We rely on the following legal bases to process personal information:

• Performance of a contract — to provide the Service to you and your child under these Terms.
• Legitimate interests — to operate, secure, analyze, and improve the Service, provided that those interests are not overridden by the interests or fundamental rights and freedoms of users.
• Legal compliance — to comply with our obligations under European, Member State, UK, Swiss, or other applicable law.
• Consent — where you have given consent for a specific purpose, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

If you are an EEA Individual, you have the right to:

• Access and obtain a copy of the personal information we hold about you (including, where applicable, in a portable form).
• Correct personal information that is inaccurate or out of date.
• Request deletion of personal information we hold about you, subject to limited exceptions (for example, where we must retain it to comply with a legal obligation or defend a legal claim).
• Object to or restrict our processing of personal information.
• Withdraw any consent you previously gave us, without retroactive effect.
• Lodge a complaint with your local Data Protection Authority. We encourage you to contact us first at hello@wildcoders.org so we can try to resolve any concern directly.

To exercise any of these rights, please email hello@wildcoders.org. We may ask for additional information to verify your identity before responding.

If you are a California resident, California Civil Code § 1798.83 (the "Shine the Light" law) permits you to request information about our disclosure of personal information to third parties for those third parties' direct-marketing purposes. We do not share personal information with third parties for their direct-marketing purposes. To make a request, or to ask any other question about your California privacy rights, please email hello@wildcoders.org or write to us at the address in Section 20.

Our commitments in this Privacy Policy survive the termination of your account and our other agreements with you, to the extent we continue to hold any personal information about you or your child after termination.

If we make a material change to our information practices, we will notify Parents of subscribed accounts directly and obtain new consent before the change applies to previously collected information from a child. We will also update the "Effective" date at the top of this policy.

WildCoders LLC

6110 E. Colfax Ave., Ste. 4 #105, Denver, CO 80220

hello@wildcoders.org · 720-389-7115