Privacy Policy

Plain-English summary: the parent is the only account holder. We store the parent's email, each child's first name and age, and the points ledger. No photos, no last names, no location, no ads, no selling data. Replace the bracketed items and have a lawyer review before launch.

1. Who we are

RankPop is operated by [Legal entity name], [address], New York, USA ("we"). Contact: hello@rankpop.app.

2. What we collect

Parent account: email address, password (hashed by our authentication provider, Supabase), family name, time zone.
Children: first name (or nickname) and age, entered only by the parent. We never ask children for information and children do not create accounts.
Activity: the points ledger (behaviors logged, rewards requested, contracts generated) and settings you choose.
Trusted Adult Pass: the verifier's role, optional name and team as typed by the parent; the verifier sees only the child's first name and never provides personal data.
Payments: handled by Stripe. We receive your Stripe customer and subscription identifiers and payment status, never your card number.
Technical: standard server logs (IP address, browser type) kept by our hosting providers for security.

3. Children's privacy (COPPA)

RankPop is designed for use by parents. We do not knowingly collect personal information from children under 13. The only child data stored is a first name and age, provided by the parent, used solely to display the child's profile to that family. Parents can delete a child's profile and all associated history at any time in the app, or by emailing us.

4. How we use data

To run the service (accounts, points, contracts, adult passes), to bill you, to send the weekly Parent Decoder Digest (you can unsubscribe in any email), and to improve the product using aggregated, de-identified statistics. We do not sell personal data and we show no advertising.

5. AI features

Optional AI wording uses Anthropic's Claude API. Requests sent to the AI never include your child's name; they contain the age band, the selected rule identifiers and the family's settings. Responses are cached and shared across families in a name-free form.

6. Service providers

Supabase (database, authentication, hosting of functions), Netlify (website hosting), Stripe (payments), Anthropic (AI), Resend (email). Each processes data only to provide its service to us.

7. Retention and deletion

Data is kept while your account is active. Delete your family in the app or email us; all family data is deleted within 30 days, except records we must keep for tax or fraud prevention.

8. Security

Encryption in transit (HTTPS), row-level security in the database so only your family can read your data, hashed passwords, single-use coach links, and secrets held only on servers.

9. Your rights

You can access, correct, export or delete your data by using the app or emailing hello@rankpop.app. California and other state residents have additional rights under applicable law; we honor them for everyone.

10. Changes

We will post changes here and email account holders about material changes.

Last updated: September 2026 · hello@rankpop.app