Privacy Policy

1. Introduction

Kidstock ("we", "us", or "our") operates the Kidstock web application and mobile app (the "Service"). This Privacy Policy describes what information we collect, how we use it, and your choices regarding that information.

2. Information We Collect

We collect different information depending on your role:

• Parents/Guardians (Mission Control): name, email address, and payment preferences (Venmo/Cash App/Zelle usernames, not card numbers).
• Gift Givers (Boosters): name and email address when giving a gift.
• Children (Astronauts): name, date of birth, and optionally an email address. See Section 6 for details about children's privacy.
• Linked brokerage accounts (optional): if a Mission Control user connects a child's brokerage account through Plaid, the account details, holdings and investment transactions described in Section 7.

3. How We Use Your Information

• To operate and maintain investment accounts and portfolios
• To send gift card emails and event invitations
• To provide account notifications (gift received, portfolio updates)
• To verify your identity for account access
• To improve our Service

We do not sell your personal information. We do not use children's data for advertising or behavioral targeting.

4. Information Sharing

We share personal information only in limited circumstances:

• Between account participants: mission control members can view their astronaut's portfolio; boosters see the astronaut's name when giving a gift.
• Service providers: we use Mailgun for email delivery, Amazon Web Services for hosting, Cloudflare for security, Stripe for subscription payments, and Plaid for optional brokerage account connections (Section 7). These providers process data on our behalf under contract.
• Legal requirements: we may disclose information if required by law.

5. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, and secure cloud infrastructure (AWS). We limit access to personal information to employees and contractors who need it to operate the Service.

6. Children's Privacy (COPPA Compliance)

Kidstock takes children's privacy seriously. We comply with the Children's Online Privacy Protection Act (COPPA) for users under 13 years of age.

What we collect from children

For astronauts under 13, we collect only: first name, last name, and date of birth. An email address is optional and only collected with parental consent.

Parental consent

Before a child under 13 can log in or receive emails from Kidstock, a parent or legal guardian must consent. Mission Control users attest whether they are the parent or legal guardian. If they are not, we send a private, time-limited direct notice and consent link to the parent or guardian's email address.

Consent for Kidstock's internal use does not authorize disclosure of the child's personal information for optional third-party-dependent features. Those features require a separate opt-in and card verification. We may verify an existing paid Kidstock subscriber from their payment relationship or validate a card through a Stripe-hosted check with the issuing bank. No charge is made. Kidstock does not receive or store card details.

Without parental consent

If a parent creates a child's account without providing consent, the child's portfolio is still managed by the parent, but the child:

• Cannot log in to the Service
• Will not receive any emails from Kidstock
• Can only view their portfolio through their parent's account

Parental rights

As a parent or guardian, you have the right to:

• Review the personal information we have collected about your child
• Request deletion of your child's personal information
• Withdraw your consent at any time, which will revoke your child's login access
• Refuse further collection of your child's information (the portfolio can still be managed through your Mission Control account)

An inline consenting parent can withdraw from the Astronaut's Mission Control profile. A parent who consented by email can use the private link in the confirmation email. To review information or request deletion, contact us at privacy@kidstock.app.

7. Financial Account Information (via Plaid)

A Mission Control user can optionally connect a child's existing brokerage account so that its holdings are tracked in Kidstock automatically. These connections are made through Plaid Inc., which connects to the financial institution on your behalf. You sign in to your brokerage inside Plaid's own interface; Kidstock never sees or stores your brokerage username or password.

What we receive from Plaid

For each account you choose to share, Plaid provides us with:

• the institution's name and the account's name, type and last digits (mask)
• current holdings: each security, the number of shares, and its value
• investment transactions (buys, sells, dividends, fees and similar) for up to the previous 24 months, refreshed about once a day thereafter

We do not receive account or routing numbers, and we do not request balances for accounts you did not select. Plaid's handling of your information is described in Plaid's End User Privacy Policy. You can review and manage every connection Plaid holds for you at Plaid Portal.

How we use and protect it

We use this information only to show and track the child's portfolio. It is never sold, shared with advertisers, or used for any purpose other than operating the Service. The credential Plaid issues us for the connection is stored encrypted, is never written to logs, and is accessible only to the process that refreshes the portfolio. Connecting an account for a child under 13 requires verified parental consent as described in Section 6.

Disconnecting Plaid

You can disconnect a brokerage account at any time from Mission Control (Brokerage → Disconnect) or in the mobile app. When you do, we instruct Plaid to remove the connection immediately, so no further information flows, and we delete the credential on our side. The holdings and transactions already imported remain in the child's portfolio as a read-only record, in the same way a manually entered purchase would; to have them deleted, contact us at privacy@kidstock.app. Deleting your Kidstock account removes every linked connection at Plaid as part of the deletion.

8. Your Choices

• Email preferences: you can control gift card email delivery (to you, to the astronaut, both, or none) in your astronaut settings.
• Account deletion: you can delete your account yourself at any time from Settings → Security on the web or in the mobile app. You are signed out everywhere immediately and any linked brokerage connection is removed at Plaid at once, and your personal information is permanently erased after a 30-day grace period during which support can restore the account if you change your mind. If we bill your subscription directly, it is cancelled at the same time; a subscription you bought through the App Store or Google Play belongs to that store, so deleting your Kidstock account does not stop it and you cancel it there. Records that belong to other people's gift history are kept with your name removed. A child's profile that exists only under your Mission Control account is deleted with it. You can also write to support@kidstock.app and we will do it for you.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use of the Service after changes constitutes acceptance.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

support@kidstock.app