🔒 Privacy Policy

Who We Are

Finley Reading Quest ("Finley," "we," "us") is an AI-powered adaptive reading app for children ages 4–12, available at finleyreads.com. We are committed to protecting the privacy of children and their families in accordance with the Children's Online Privacy Protection Act (COPPA) and applicable privacy laws.

This Privacy Policy explains what information we collect, how we use it, and your rights as a parent or guardian.

Parental Consent COPPA

Finley is directed to children under 13. Before a child uses the app, we require a parent or legal guardian to:

• Confirm they are the parent or guardian of the child
• Review and consent to our data collection practices
• Provide verifiable parental consent as required by COPPA

Information We Collect

We collect (with parental consent):

• Child's first name — to personalize the experience
• Child's age — to set the appropriate learning level
• Child's reading activity — responses, accuracy, session duration, reading level progress
• Parent's email address — only when provided voluntarily for progress reports or account creation

We do NOT collect:

• Last names, addresses, phone numbers, or photos
• Audio recordings or voice data
• Location data or device identifiers
• Social media profiles or contacts
• Any sensitive personal information beyond what is listed above

How We Use This Information

• Personalize learning: Adapt reading content, difficulty, and pacing to your child's exact skill level using our AI engine
• Track progress: Show parents meaningful data about reading growth, strengths, and areas to work on
• Generate AI content: Create reading passages, phonics exercises, and sight word practice tailored to your child's level
• Parent reports: Deliver weekly progress summaries to parents who have provided an email address
• Improve the app: Aggregate, anonymized data may be used to improve our adaptive engine and content quality

We do not use your child's data for advertising, profiling for commercial purposes, or any purpose beyond delivering and improving the reading experience.

Data Storage & Security

Your child's learning data is stored in two places:

• Your device: Reading progress, activity history, and settings are stored locally in your browser's storage for offline access
• Our servers: Account data and subscription information are stored on Supabase-hosted servers with encryption in transit (HTTPS/TLS) and at rest

We use industry-standard security practices to protect your data. No system is 100% secure, and we encourage parents to use strong, unique passwords for their accounts.

Third-Party Services

We share data with the following trusted third parties, solely to operate the app:

• Anthropic — AI content generation. Reading passages and exercises are generated using Claude AI. We send only the child's current reading level and activity context — no names or identifying information. Anthropic's privacy policy applies to API usage.
• Stripe — Payment processing. Subscription billing is handled by Stripe. Stripe receives the parent's payment information only. No child data is shared with Stripe.
• Cloudflare — Website hosting and content delivery. Cloudflare processes web traffic to deliver the app. Standard access logs apply.
• Supabase — Database and authentication. User accounts and subscription records are stored on Supabase-hosted PostgreSQL servers.

We do not sell, rent, or share your child's personal information with advertisers, data brokers, or any third party for commercial purposes.

Your Rights as a Parent

Under COPPA and applicable privacy laws, you have the right to:

• Access the personal information we have collected about your child
• Correct inaccurate information
• Delete your child's data — you can do this from Parent Settings in the app, or by emailing us
• Withdraw consent at any time — this will result in deletion of your child's data and termination of their account
• Refuse further collection while still using the core features of the app

To exercise any of these rights, email us at [email protected] with the subject line "Privacy Request." We will respond within 30 days.

Data Retention

We retain your child's reading data for as long as your account is active. If you delete a child's profile in the app, their data is removed immediately from your device and queued for deletion from our servers within 30 days.

If you cancel your subscription, your data is retained for 90 days to allow for reactivation, then permanently deleted.

Cookies & Tracking

Finley does not use tracking cookies, advertising pixels, or cross-site tracking. We use only essential browser storage (localStorage) to save your child's progress and app preferences locally on your device.

Cloudflare, our hosting provider, may set security cookies as part of their DDoS protection. These do not track users across sites.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify parents via email (if provided) and display a notice in the app. Continued use of Finley after such notice constitutes acceptance of the updated policy.

We will never materially change how we use children's data without re-obtaining parental consent.

Contact Us

If you have questions, concerns, or requests about this Privacy Policy or your child's data:

• Email: [email protected]
• Subject line for privacy requests: "Privacy Request"
• Response time: Within 30 days

We take privacy seriously and are committed to responding promptly to all parent inquiries.