Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) describes how Kidstock Investing LLC (“Kidstock,” “we,” “us,” or “our”) collects, uses, discloses, and protects the personal information of users of the Kidstock website located at kidstock.app, our mobile applications, and all related services (collectively, the “Platform”).

This Policy applies to all users of the Platform, including parents and guardians (“Mission Control”), children and minors whose profiles are managed by parents or guardians (“Astronauts”), adults who use an Astronaut profile for their own portfolio, and gift-giving family members and friends (“Boosters”). Collectively, these may be referred to as “Users,” “you,” or “your.”

By accessing or using the Platform, you acknowledge that you have read this Policy. Parental consent is requested and recorded through the designated consent process in Section 5.2; visiting or using the Platform alone does not provide consent for a child.

This Policy is incorporated into and subject to the Kidstock Terms of Service at https://www.kidstock.app/terms. Capitalized terms not defined in this Policy have the meanings given to them in the Terms of Service.

2. Information We Collect

We collect different types of information depending on your account type and how you interact with the Platform.

2.1 Information You Provide Directly

Mission Control Account Registration (Parents/Guardians)

• Full name
• Email address
• Password (stored as a one-way hash, not in plain text)
• Phone number (optional)
• Mailing address (optional)
• Subscription and billing information for paid plans (Stripe for web purchases, Apple for App Store purchases and Google for Google Play purchases; Kidstock does not receive or store full payment card numbers)

Astronaut Profiles (Children/Minors)

Child Astronaut profiles are created and managed by adults through Mission Control, with parental or guardian consent where required as described in Section 5.2. Information provided for a child may include:

• Child’s first name (or nickname)
• Date of birth or age
• Built-in avatar selection (children cannot upload photos, and adults cannot upload photos for child avatars)
• Astronaut login credentials, if the parent or guardian enables a login for the child (passwords are stored as one-way hashes)

A parent or guardian may choose to enable a login for their child. An Astronaut login is a sub-account within the parent’s Mission Control Account. When an Astronaut is signed in, we collect information about their activity on the Platform, such as the lessons and Missions they view or complete and their learning progress, along with the automatically collected information described in Section 2.2.

Booster Account Registration (Gift Givers)

• Full name
• Email address
• Password (stored as a one-way hash, not in plain text)
• Relationship to the child (e.g., grandparent, aunt, family friend)

Gift Registry Information

• Registry name and occasion type (birthday, holiday, graduation, etc.)
• Wishlist items (stocks, ETFs, or cryptocurrency selected by the parent/guardian)
• Messages or notes associated with gift cards

Payment and Transfer Information Shared Between Users

The Platform may allow Mission Control users to share their preferred payment or transfer methods (such as a Venmo handle) with Boosters to facilitate gift contributions outside the Platform. You provide this information voluntarily, and you are solely responsible for its accuracy and security. Kidstock does not process, verify, or store this information beyond what is necessary to display it to authorized recipients.

Investment Tracking Data

If you use the Platform’s investment tracking features, you may manually enter information about investments held in your own external brokerage accounts, including ticker symbols, share quantities, and purchase dates. Manually entered information is provided by you for your own organizational purposes and does not give Kidstock access to your brokerage accounts. You may instead choose to connect a brokerage account, as described in Section 2.3.

Adult avatars: adults can optionally create a small cropped avatar from a photo. We store only the resulting static 256-pixel PNG avatar with image metadata removed, not the original photo. Children use built-in avatar choices only.

Family content and support: we collect names, gift messages, thank-you messages, support requests and safety reports that you submit, along with the account or content references needed to review them. A child's parent reviews the child's proposed name and thank-you messages, and Boosters' gift messages, before those changes or messages are shown or sent. Kidstock staff can review reports and remove content. See https://my.kidstock.app/community-guidelines.

2.2 Information Collected Automatically

When you access or use the Platform, we may automatically collect certain information, including:

• Device information (device type, operating system, unique device identifiers)
• Browser type and version
• IP address
• Pages viewed and features used within the Platform
• Date and time of access
• Referring URL or source
• General geographic location (derived from IP address, not precise GPS)
• Crash reports and diagnostics, including device and operating-system information, app version, stack traces and installation identifiers

2.3 Information from Third-Party Services

Mobile diagnostics and notifications: our release apps use Google Firebase Crashlytics to collect crash diagnostics automatically, including before sign-in. Crashlytics uses an installation identifier; Kidstock does not set your name, email address or Kidstock user ID in crash reports. If you enable notifications, we use Apple Push Notification service and Google Firebase Cloud Messaging; notification tokens are associated with your account to deliver the notifications you request.

Store subscriptions: Apple and Google provide purchase and subscription records, such as product identifiers, transaction or order identifiers, purchase tokens, renewal and expiry dates, and cancellation or refund events. We associate these records with your Kidstock account to provide paid features, restore purchases and prevent duplicate billing. The stores handle payment details under their own policies.

Signup age screening: where available, the iOS app uses Apple's Declared Age Range API and the Android app uses Google Play Age Signals. If a platform signal is unavailable, we ask for a self-declared age band. For a completed signup, we store the under-13 or 13-and-over result, its source and the time checked with the account. We do not receive an exact birthdate from these APIs. An under-13 result directs a new user to ask Mission Control for an invitation. These signals do not verify adult identity or parental authority and do not replace parental consent. A child's birthdate is collected separately for age-appropriate features and birthday reminders.

Financial Account Information (via Plaid)

If you choose to connect an external brokerage account, we use Plaid Inc. (“Plaid”) to establish a read-only connection. No data is accessed until you give your explicit consent in the connection flow. Through Plaid we receive information about the accounts you connect, such as the institution name, account name and type, masked account number, balances, holdings (securities, quantities, and values), and investment transactions. We do not receive or store your brokerage login credentials, and the connection does not allow Kidstock to place trades or move money.

For each account you choose to share, Plaid provides us with:

• the institution’s name and the account’s name, type and last digits (mask)
• current holdings: each security, the number of shares, and its value
• investment transactions (buys, sells, dividends, fees and similar) for up to the previous 24 months, refreshed about once a day thereafter

We do not receive account or routing numbers, and we do not request balances for accounts you did not select.

We use connected account information only to provide the Platform’s investment tracking features. You can disconnect a brokerage account at any time in your account settings, after which we stop receiving new information from that account. You can also ask us to delete information previously received by contacting us as described in Section 12.

Plaid’s own collection and use of your information is governed by the Plaid End User Privacy Policy, available at https://plaid.com/legal. By connecting an account, you grant Kidstock and Plaid the right, power, and authority to act on your behalf to access and transmit your information from the relevant financial institution, and you agree to your information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

You can read Plaid’s End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy and review and manage every connection Plaid holds for you at Plaid Portal (https://my.plaid.com).

The credential Plaid issues us for the connection is stored encrypted, is never written to logs, and is accessible only to the process that refreshes the portfolio. Connected account information is never sold or shared with advertisers. Connecting an account for a child under 13 requires verified parental consent as described in Section 5.2.

If we add other third-party data sources in the future, we will update this Policy before they become available and will ask for your consent before any data is accessed.

Disconnecting Plaid

You can disconnect a brokerage account at any time from Mission Control (Brokerage → Disconnect) or in the mobile app. We immediately request removal of the connection from Plaid and stop using it for new imports. If Plaid cannot complete removal, we retry and retain the encrypted connection credential only until removal succeeds. The holdings and transactions already imported remain in the child’s portfolio as a read-only record, in the same way a manually entered purchase would; to have them deleted, contact privacy@kidstock.app. Deleting your Kidstock account requests removal of every linked Plaid connection as part of deletion.

2.4 Cookies and Similar Technologies

We use cookies and similar technologies that are necessary to operate the Platform, such as keeping you signed in and remembering your preferences. We do not currently use third-party web analytics or advertising cookies. Mobile crash diagnostics and notification identifiers are described separately in Section 2.3. If we add web analytics tools, we will update this Policy to identify them before use and will not use them for behavioral advertising directed to children. You can manage cookies through your browser settings; disabling necessary cookies may affect the Platform.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

Between Users (as directed by you):

When you create a gift registry, limited information about your child (first name, age or occasion, wishlist items) is shared with individuals who have access to the registry. When you share payment or transfer information through the Platform, that information is displayed to authorized Boosters. You control what information is shared and with whom.

Service Providers:

We share information with providers as needed to operate Kidstock: Amazon Web Services (hosting), Cloudflare (network security), Stripe (web subscription payments and card verification), Mailgun (transactional email), Kit (marketing email to adults who opt in), Plaid (brokerage connections you choose), and Google Firebase (Crashlytics diagnostics and Cloud Messaging). Providers processing data on our behalf must use it for those services and maintain appropriate safeguards.

Apple and Google also provide app distribution, native subscription billing, optional sign-in, available age-range signals and push-notification services. Their handling of store accounts and payments is governed by their own privacy policies. We use only the account, purchase, age-screening and notification information needed for the features described in this Policy. We update this list when our providers change.

Legal Requirements:

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers:

If Kidstock is involved in a merger, acquisition, bankruptcy, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform of any change in ownership or uses of your personal information.

With Your Consent:

We may share your information in other circumstances with your explicit consent.

Aggregated or De-Identified Data:

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, analytics, or other purposes.

5. Children’s Privacy (COPPA Compliance)

Kidstock takes the privacy and safety of children very seriously. This section describes our practices with respect to the personal information of children under 13 years of age, in compliance with the Children’s Online Privacy Protection Act (“COPPA”).

5.1 How Children’s Information Is Collected

Most information about children on the Platform is provided by a parent or legal guardian through their Mission Control Account, where Astronaut profiles are created and managed. A parent or guardian may also choose to enable a login for their child. An Astronaut login is a sub-account within the parent’s Mission Control Account; a child cannot create an account on their own. When a child is signed in to an Astronaut sub-account, we collect information from the child’s use of the Platform, as described in Section 5.3. We do not require a child to provide more information than is reasonably necessary to use the Platform.

5.2 Verifiable Parental Consent

A child under 13 cannot sign in to or use the Platform until the child's parent or legal guardian has given consent. Until consent is recorded, the child's Astronaut login stays disabled, we do not keep an email address for the child, and we do not send email to the child.

While consent is missing, the child’s portfolio can still be managed and viewed through the parent’s or guardian’s Mission Control Account.

Who may consent. Only a child's parent or legal guardian may give consent. When an adult creates an Astronaut profile for a child under 13, we ask whether that adult is the child's parent, the child's legal guardian, or neither.

• A parent or legal guardian may give consent within their Mission Control Account by confirming their relationship to the child and confirming that they consent to the collection and use of the child's information as described in this Policy.
• Any other adult, such as a grandparent, aunt, or uncle, cannot give consent. That adult provides the email address of the child's parent or legal guardian. We send the parent or guardian a notice that describes what we collect and how we use it, with a private link that is valid for seven days. The parent or guardian reviews the notice, confirms their relationship to the child, and accepts or declines. When consent is given, we send a confirmation email that includes a link to review or withdraw it. If the request is declined or expires, the Astronaut login stays disabled.

Additional verification before disclosure to third parties - The consent described above covers our use of a child's information to operate the Platform. Before a child's personal information is disclosed to a third party, for example when a parent connects a brokerage account so that the child's holdings can be tracked, we require two further steps from the consenting parent or guardian:

• Verification with a payment card. We confirm the card with its issuer through Stripe, and no charge is made. An active paid Stripe subscription purchased by the same consenting parent or guardian also satisfies this payment-verification step. An App Store or Google Play subscription does not provide parental consent or satisfy this step.
• Separate consent to that disclosure.

A parent or guardian may decline this disclosure and continue to use the rest of the Platform.

Withdrawing consent - A parent or legal guardian may withdraw consent at any time from the Astronaut's profile in Mission Control or through the private link in our consent emails. Withdrawal immediately disables the child's login and begins erasure of the child's personal information, with no undo window. Erasure in active systems is completed within 30 days; the limited retained records and separate backup schedule are explained in Section 7. To review or request deletion of a child's information, contact privacy@kidstock.app.

We disclose children's personal information to the providers described in Section 4 only as needed for the stated service, safety and internal-operations purposes, and to people a parent or guardian chooses to share family content or a gift registry with. We do not disclose it for targeted advertising. The separate consent required for connected brokerage features is described above.

5.3 What Children’s Information We Collect

We limit the information collected about children to what is reasonably necessary to provide our services:

• First name or nickname
• Date of birth or age
• Built-in avatar selection (children cannot upload photos, and adults cannot upload photos for child avatars)
• Astronaut login credentials, if the parent or guardian enables a login
• Names and thank-you messages submitted for parental review, and support or safety reports the child sends to Kidstock
• Learning activity when the child is signed in, such as lessons and Missions viewed or completed and progress through the curriculum
• Investment tracking information the parent or guardian associates with the child’s profile
• Device and usage information collected automatically when the child is signed in, as described in Section 2.2 (such as IP address and device identifiers), which we use only to operate, secure, and improve the Platform

5.4 How Children’s Information Is Used

Children’s information is used solely to:

• Create and display Astronaut profiles within the parent’s Mission Control Account
• Populate gift registries with registry details limited child information (first name, age, occasion)
• Personalize educational content and gamified learning features
• Provide the Astronaut sub-account, including saving and displaying the child’s progress through lessons and Missions
• Enable investment tracking on behalf of the child
• Operate, secure, and troubleshoot the Platform

We do not use children’s personal information for behavioral advertising, targeted marketing, or any purpose unrelated to the services described above.

5.5 Parental Rights

Parents and legal guardians have the following rights with respect to their child’s personal information:

• Review the personal information collected about their child
• Request correction of inaccurate information
• Request deletion of their child’s personal information
• Refuse to permit further collection or use of their child’s information
• Revoke consent at any time

To exercise any of these rights, please contact us at the email address provided in Section 12. We will respond to verified requests within a reasonable timeframe. Deleting a child’s information may result in the removal of associated Astronaut profiles, gift registries, and investment tracking data.

5.6 Minors Aged 13–17

Minors aged 13 to 17 may access limited features of the Platform with the consent and ongoing supervision of a parent or legal guardian who holds a Mission Control Account. The parent or guardian is responsible for the minor’s use of the Platform and for any information the minor provides.

6. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your personal information from unauthorized access, use, alteration, and disclosure. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure password hashing (passwords are never stored in plain text)
• Access controls limiting employee access to personal information on a need-to-know basis
• Regular security assessments and monitoring
• Secure hosting infrastructure with industry-standard protections

While we strive to protect your personal information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information. If we become aware of a security breach that affects your personal information, we will notify you in accordance with applicable law.

7. Data Retention

We retain personal information while it is needed to provide the requested service. After closure or a deletion request, the periods below apply. Limited records may be kept when necessary:

• To comply with legal obligations (such as tax or financial record-keeping requirements)
• To resolve disputes and enforce our agreements
• To maintain security and prevent fraud
• Any legal or safety preservation hold is limited to the records needed, has a documented basis and review date, and is reviewed rather than continued indefinitely

Self-deletion: you can ask support to restore your own account within 7 days of the request. Erasure then begins and is completed in active systems within 30 days of the request. A verified parent's or guardian's explicit deletion of a child's profile, and withdrawal of consent, begin erasure immediately with no undo window. Section 8.6 explains how to request deletion and how other family members' records are handled.

Children's data: profile details, login credentials, learning activity and investment tracking data are kept to provide the child's active profile and related features. When the child profile is deleted, its personal data is erased in active systems within 30 days, subject only to the limited records and backup schedule below.

Inactive or paused child profiles: if no parent on the child's Mission Control team has signed in for 24 months, we notify the parents and allow 30 days to respond, with a reminder 7 days before deletion. A parent's sign-in cancels the inactivity notice. A child profile paused for 12 months receives the same notice. A parent may reactivate it or ask Kidstock to keep it paused; any approved extension has a fixed review date and lasts no more than 12 months at a time.

Support requests: device diagnostic context is removed when a support ticket closes. The ticket and associated copies are deleted 12 months after closure; reopening it stops that clock.

Consent records and avatars: a minimal record of parental consent, containing dates, policy versions and record locators rather than names or message content, is kept for up to 3 years after closure and reviewed yearly. Replaced avatars are scheduled for cleanup after 7 days.

Backups: backup copies are isolated from ordinary use and expire separately from active-system data. The current backup lifecycle schedules final expiration after up to 180 days, including prior versions; storage-provider deletion runs asynchronously after expiration. We verify expiry before recording the backup-deletion step as complete. If a backup is restored, recorded deletions are applied again before the service reopens. The operational retention schedule is available at https://my.kidstock.app/retention.

8. Your Rights and Choices

8.1 All Users

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to certain exceptions
• Portability: Request a copy of your data in a structured, commonly used, machine-readable format
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the link in any marketing email or by contacting us
• Withdraw Consent: Where we rely on consent, you may withdraw it at any time

8.2 Colorado Privacy Act (CPA)

We comply with the Colorado Privacy Act. Colorado residents have the right to:

• Opt out of the processing of personal data for targeted advertising
• Opt out of the sale of personal data (note: Kidstock does not sell personal data)
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise these rights, please contact us using the information in Section 12. We will respond to verified requests within 45 days. If we decline a request, you may appeal by contacting us within the timeframe specified in our response.

8.3 California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information is collected about you, the right to delete your personal information, and the right to opt out of the sale of your personal information. Kidstock does not sell personal information as defined by the CCPA.

8.4 Other State Privacy Laws

We are committed to complying with all applicable state privacy laws. If you are a resident of a state with privacy legislation (such as Virginia, Connecticut, Utah, or others), you may have additional rights. Please contact us to exercise any rights available to you under your state’s law.

8.5 Account Settings

You can update your account information, manage notification preferences, and control certain privacy settings directly through the Platform. If you need assistance, contact us at the email address in Section 12.

Email preferences: you can control gift card email delivery (to you, to the Astronaut, both, or none) in your Astronaut settings.

8.6 Deleting Your Account

Delete your Kidstock account or data: on the web, open Settings → Security → Delete account. In the mobile app, open Settings and choose Delete account. You can also email support@kidstock.app with the subject “Delete my Kidstock account” or describe the specific data you want deleted. You do not need to sign in to make an email request. Use your registered email address where possible; we verify account ownership or parental authority before acting and will never ask for your password.

You are signed out everywhere immediately after account deletion is accepted. You can ask support to restore your own account within 7 days. After that, erasure begins and is completed in active systems within 30 days of the request. Plaid connections are submitted for removal immediately; failed removals are retried as described in Section 2.3. Limited retained records and backup expiry are described in Section 7.

At account deletion, we request cancellation of Stripe and Google Play subscription renewals. If you bought a subscription through the App Store, you must cancel it in your Apple account subscription settings. Removing the app does not cancel a subscription.

Records belonging to other people's gift history are kept with your name, address and message content removed and links revoked. A child profile without its own login that exists only under your Mission Control is deleted with your account. A child's account managed by another adult is not automatically deleted. Closing a child's account with its own login may require support to verify authority and resolve any other guardians' access.

An Astronaut under 13 cannot delete their own account; a parent or guardian does this through Mission Control or a verified request to support. An explicit parental deletion of a child's profile or withdrawal of consent begins erasure immediately with no undo window, rather than the 7-day self-deletion window.

9. Third-Party Services

The Platform may contain links to or integrate with third-party websites, services, or applications, including brokerage platforms, payment services, analytics providers, and educational content sources. This Privacy Policy does not apply to third-party services, and we are not responsible for the privacy practices of any third party.

We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform. Your use of third-party services is governed entirely by those services’ own terms and privacy policies.

Brokerage account connections are provided through Plaid, as described in Section 2.3. If we integrate with additional third-party financial data providers in the future, we will clearly disclose what data is accessed, obtain your explicit consent, and provide you with the ability to revoke access at any time. We will update this Policy accordingly before any such integration is made available.

10. International Users

The Platform is operated in the United States and is intended for users who are legal residents of the United States. If you are accessing the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers are located and our central database is operated. By using the Platform, you consent to the transfer of your information to the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes to this Policy, we will notify you by posting the updated Policy on the Platform with a revised “Last Updated” date and, where appropriate, by sending you an email notification.

For changes that materially affect how we collect, use, or share children’s personal information, we will obtain new verifiable parental consent where required by COPPA.

We encourage you to review this Policy periodically. Continued use does not replace any separate consent required by law, including parental consent for material changes to children's data practices.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or our data practices, please contact us at:

Kidstock Investing LLC
Mailing address: 2607 Canterbury St, Austin, TX 78702
Phone: 415-728-4995
Email: support@kidstock.app
Website: kidstock.app

For requests related to children’s privacy or COPPA, please include “Children’s Privacy Request” in the subject line of your email so we can prioritize your inquiry.

We will respond to all verified privacy requests within the timeframes required by applicable law (generally within 30–45 days).