Privacy Policy — Minors

Important: This policy supplements the main 4Craft Privacy Policy and addresses the specific protections for users under the age of 18, including compliance with the Children's Online Privacy Protection Act (COPPA) for users under 13.

1. Information We Collect From Minors

For users under 18, we collect only the minimum information necessary to operate the account:

• Account information: First name, last initial (displayed publicly), email address (used for login only, never displayed), date of birth (used for age verification, never displayed)
• Learning activity: Lesson completion, quiz scores, practice sessions, streaks, and Craft Points
• Youth organization affiliation: Which youth organization the minor is associated with (DeMolay, Rainbow, Job's Daughters, etc.)

We do NOT collect from minors: physical address, phone number, photos, social media accounts, location data, financial information, or any biometric data.

2. COPPA Compliance (Users Under 13)

For users under the age of 13, the following additional protections apply:

• No account may be created without verifiable parental consent
• A parent or legal guardian must create the account on behalf of the child
• The parent must agree to the consent terms before the account is activated
• No personal information is collected from the child directly — all information is provided by the parent
• The parent may review, modify, or delete their child's information at any time
• The parent may revoke consent at any time, which immediately deactivates the account

3. Parental Rights

Parents and legal guardians have the right to:

• Review their child's account information and activity at any time by logging into their own account
• Modify their child's information by contacting us at the address below
• Delete their child's account and all associated data by revoking consent or by contacting us
• Refuse further collection or use of their child's information
• Receive notification before any material changes to how their child's data is used

4. How Minor Data Is Used

Information collected from minor users is used solely for:

• Operating the user's learning account (progress tracking, streaks, achievements)
• Displaying the user's first name and last initial in leaderboards and practice logs
• Sending account-related notifications to the parent's email (not the minor's)
• Safety and audit logging (all actions involving minor accounts are logged)

We do NOT use minor data for advertising, marketing, profiling, or sale to third parties. Ever.

5. How Minor Data Is Protected

• Minor profiles are never publicly visible or searchable
• Only the minor's first name and last initial are shown to other users
• Minors cannot send or receive direct messages from adults who are not designated youth advisors
• All actions involving minor accounts are recorded in a youth protection audit log (timestamp, action, actor, IP address)
• Data is stored on secured servers with encryption in transit (TLS 1.3)
• Access to minor data is restricted to platform administrators and the minor's parent/guardian

6. Communication Restrictions

Minor users are subject to the following communication restrictions:

• Minors cannot initiate or receive direct messages from non-advisor adult users
• Only adults designated as youth advisors by a platform administrator may communicate with minors in a supervised mentoring context
• All mentor/coach communications involving minors are logged
• Minor users cannot use the donation system
• Minor users cannot upload photos or share location information

7. Data Retention and Deletion

• Minor account data is retained only as long as consent is active
• When consent is revoked by the parent, the account is immediately deactivated. Account data and activity history are retained for 30 days to allow for re-activation, then permanently deleted
• When a minor ages out (turns 18), their account is automatically transitioned to a standard adult account. The minor protections are removed, and the user may manage their own account going forward
• The youth protection audit log is retained for a minimum of 3 years for legal compliance purposes, even after account deletion
• Parents may request immediate permanent deletion of all their child's data by contacting us. Audit log entries are anonymized but retained

8. Consent Renewal

Parental consent must be renewed annually. Parents will receive email reminders at 30 days and 7 days before expiration. If consent expires without renewal, the minor's account is suspended until consent is renewed.

9. Third-Party Services

Minor data is never shared with third parties except:

• Email delivery: SendGrid (for sending notifications to the parent's email only)
• Hosting: Our server infrastructure provider

We do not use analytics tracking, advertising networks, or social media widgets on pages accessible to minor users.

10. Changes to This Policy

If we make material changes to how we handle minor data, we will notify all parents with active consent at least 30 days before the changes take effect. Continued use after notification constitutes acceptance; parents may revoke consent if they disagree with the changes.

11. Contact

For questions about minor data, to exercise parental rights, or to request data deletion:

• Email: admin@4craft.org
• Subject line: "Youth Privacy Request"