Privacy Policy

Plain-English summary: the parent is the only account holder. We store the parent's email, each child's first name and age, the points ledger, and what your family creates in the app. No last names, no location, no ads, no selling data. Grown-ups who give your child a digital sticker see counts only, never a child's name.

1. Who we are

RankPop is operated by ZAKAZIKY LLC, doing business as "RankPop", New York, USA ("we"). Contact us: rankpop.app/contact (choose Privacy request).

2. What we collect

Parent account: email address, password (stored hashed by our authentication provider — see Service providers), display name, family name, time zone, language, and the settings you choose (including the name your family gives its points).
Children: first name (or nickname), age and avatar choices, entered by the parent. Children do not create accounts.
What your family creates in the app: the points ledger (behaviors logged, rewards requested and approved, savings-vault moves, sibling gifts), family pacts including their signature drawings, and messages between your child and you. In Kid mode a child can request a reward, send a short message to their parent and attach a photo taken on that device; these are stored for your family only.
Trusted Adult Pass (one-time sticker pass): the verifier's role, optional name and team as typed by the parent, and an optional note the verifier types; the verifier sees only the child's first name and never provides personal data.
Stickers from grown-ups (Sticker Stations): when your child claims a digital sticker from any trusted grown-up (a Sticker Station) — a coach, teacher, dentist, pediatrician, grandparent, babysitter, tutor, camp counselor, librarian or similar — we store which station gave it, its points and the date, for your family only. The station itself receives counts only (how many stickers it gave, how many families joined its code) and never a child's name. The grown-up who runs a station gives us their station name, town and a contact email; those belong to the grown-up, not to any child.
Sharing you choose: a co-parent you invite joins your family and sees the same data. If you join a Squad, the other families in that squad see your children's first names, your family name, lifetime XP and this week's points, and parents in the squad can exchange short messages (never children).
Referrals and campaigns: your family's invite code, which family invited which (to award free months), and the campaign or link a sign-up came from.
Notifications: if you turn on push notifications, the browser's push address and keys for that device, its browser type, time zone and language.
Payments: handled by Stripe. We receive your Stripe customer, subscription and payment identifiers and payment status, never your card number.
Support and safety: feedback you send, an account activity log (which parent did what, when), and error reports (the error message and screen) when something breaks.
Technical: standard server logs (IP address, browser type) kept by our hosting providers for security.

3. Children's privacy (COPPA)

RankPop is designed for use by parents. Only a parent or legal guardian can create an account, and every account holder must affirmatively confirm — by checking a box when creating the account — that they are the parent or legal guardian of any child they add and that they agree to these terms; we keep a timestamped record of that confirmation as our record of verifiable parental consent. A child may use "Kid mode" on a device the parent controls, signed in under the parent's account: there a child can see their own points, request a reward, send a short message to their parent (optionally with a photo), and sign the family pact. Everything a child enters is stored for that family only and shown only to that family's parents, except the first name, family name and point totals shown to squad members if the parent chose to join a Squad. We never show advertising to children, never contact children, never let anyone outside the family message a child, and never share a child's information with third parties except the service providers in section 8, who process it only for us. Parents can review, correct, export or delete a child's profile and all associated history at any time in the app, or through the contact form (choose Privacy request).

4. Children

What we collect about a child: first name (or nickname), age band, the avatar they chose, their points and ranks (the ledger of what a parent logged) and the digital stickers they received (which station gave it, the points and the date). What we never collect about a child: no email address, no phone number, no location, no last name, and no account of their own. Photos: we never ask a child for a photo. The only photos are the ones a child chooses to attach to a reward request or message in Kid mode; those are stored for your family only, shown only to that family's parents, and deleted with the family. Parents create accounts and consent: only a parent or legal guardian creates the account, adds a child and confirms consent (section 3). Sticker Stations: any trusted grown-up (a Sticker Station) who gives digital stickers — a coach, teacher, dentist, grandparent, babysitter, camp counselor or anyone else in your child's life — receives counts only — how many stickers they gave and how many families joined their code — and never a child's name, age, points or anything else. Retention: family data is deleted 12 months after a subscription ends, or immediately when a parent asks (Settings → "Delete this family", or use the contact form and choose Privacy request); station data is counts only and holds nothing about a child. Questions or requests: use the contact form at rankpop.app/contact and choose Privacy request.

5. Niños (versión en español)

Lo que guardamos de un niño: su nombre (o apodo), su rango de edad, el avatar que eligió, sus puntos y rangos (el registro de lo que un padre o madre anotó) y los stickers digitales que recibió (qué estación se lo dio, los puntos y la fecha). Lo que nunca recopilamos de un niño: ni correo electrónico, ni teléfono, ni ubicación, ni apellido, ni una cuenta propia. Fotos: nunca le pedimos una foto a un niño. Las únicas fotos son las que tu hijo decide adjuntar a un pedido de premio o a un mensaje en el modo Niño; esas se guardan solo para tu familia, solo las ven los padres de esa familia y se borran junto con la familia. Los padres crean la cuenta y dan su consentimiento: solo un padre, madre o tutor legal crea la cuenta, agrega a un niño y confirma su consentimiento (sección 3). Estaciones de stickers: cualquier adulto de confianza (una Estación de stickers) que da stickers digitales — un coach, una maestra, un dentista, un abuelo, una niñera, un consejero de campamento o cualquier otra persona en la vida de tu hijo — recibe solo números — cuántos stickers dio y cuántas familias se unieron con su código — y nunca el nombre, la edad, los puntos ni ningún otro dato de un niño. Conservación: los datos de la familia se borran 12 meses después de que termina la suscripción, o de inmediato si lo pides (Ajustes → "Borrar esta familia", o usa el formulario de contacto y elige Solicitud de privacidad); los datos de una estación son solo números y no contienen nada de un niño. Preguntas o solicitudes: Contáctanos: rankpop.app/contact (elige Solicitud de privacidad).

6. How we use data

To run the service (accounts, points, contracts, adult passes, notifications you turned on), to bill you, to send a short series of tips and check-in emails after sign-up — turn these off in the app (Settings → "Email me tips and check-ins") — and to improve the product using aggregated, de-identified statistics. We do not sell personal data and we show no advertising.

7. AI features

Optional AI wording is generated by a third-party AI service (listed under Service providers). Requests sent to the AI never include your child's name; they contain the age band, the selected rule identifiers, the family's settings and, for the fairness check, the behavior description and context you type. Responses are cached and shared across families in a name-free form.

8. Service providers

Supabase (database, authentication, hosting of functions), Netlify (website hosting), Stripe (payments), Anthropic (AI), Resend (email), and — if you turn on notifications — the push service built into your device's browser (Apple, Google or Mozilla), which relays the notification text to that device. Each processes data only to provide its service to us.

9. Retention and deletion

Data is kept while your account is active. "Delete this family" in Settings (type DELETE to confirm) immediately deletes your children's profiles, all activity, contracts, messages and photos, adult passes, stickers, referral records, notification registrations and the parents' logins; copies in our backups are removed within 30 days. If your subscription or trial ends and you do not delete the family yourself, we delete the family's data 12 months after it ended. Sticker Stations hold counts only (stickers given, families joined) and nothing about any child. Records we must keep for tax or fraud prevention (Stripe payment records) are kept as the law requires.

10. Security

Encryption in transit (HTTPS), database access rules so only your family can read your data, hashed passwords, single-use one-time pass links for trusted grown-ups, and secrets held only on servers.

11. Your rights

You can access, correct, export or delete your data by using the app or the contact form (rankpop.app/contact → Privacy request). California and other state residents have additional rights under applicable law; we honor them for everyone.

12. Changes

We will post changes here and email account holders about material changes.

Last updated: September 2026 · Contact us