COPPA Notice — Gardenia

The short version. Children under 13 cannot create a Gardenia account. Parents enter information about their child in the course of using the Service — Gardenia never collects information directly from a child. Parents can review, correct, or delete their child's data at any time.

1. What COPPA is

The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., regulates online services that knowingly collect personal information from children under the age of 13. COPPA requires clear notice to parents, verifiable parental consent for most collections, parental access and deletion rights, limits on data retention, and restrictions on data sharing.

2. Gardenia does not knowingly collect data from children

Gardenia does not:

Allow children under 13 to create their own accounts.
Market the Service to children under 13.
Collect information directly from a child — through forms, quizzes, interactive features, logins, or any other mechanism in the Service.
Use persistent identifiers (cookies, device IDs) to track children across the web.
Run targeted advertising to anyone, including children.

3. How children's information reaches Gardenia

Your Gardenia account will contain information about one or more children — this is inherent to the service. The information comes from you, the parent or legal guardian who holds the account. You enter:

Your child's first name (last name optional), date of birth, grade, school, and district.
Disability category, service history, and any context you choose to add.
Evaluations, IEPs, 504 plans, progress reports, work samples, and other documents you upload for your use and the Service's use in generating letters, running analyses, and organizing your records.
Reflections and notes you write about your child during the Guided Paths course or the Book workbook.

The legal framing: Gardenia is a service you (the parent) use. Information about your child arrives because you input it, not because Gardenia collects it from the child.

4. Parental consent

By creating a Gardenia account, entering information about your child, and agreeing to our Terms of Service and Privacy Policy, you are providing consent — as the parent or legal guardian — to Gardenia's processing of information about your child as described in this notice and in our Privacy Policy.

If a non-parent adult (teacher, advocate, attorney, grandparent) is using Gardenia on behalf of a child, that adult represents and warrants to Gardenia that they have the parent's or legal guardian's explicit authorization to do so, and that they will make Gardenia's privacy practices known to the parent.

5. Parental rights

You can, at any time:

Review all information in your account about your child, through Settings → Children and Settings → Data Export.
Correct any information about your child, directly through the child-profile editor or by deleting the relevant document and re-uploading a corrected version.
Delete any individual piece of information (a document, a reflection, a letter draft) from your child's data.
Delete your entire child profile — which removes all associated documents, letters, reflections, and notes.
Delete your entire account — which removes everything. See Privacy Policy § 7.2 for details on retention timelines.

6. What we do with information about your child

Information about your child is used only to provide the Service to you. Specifically:

Generating personalized letters that reference your child's name, school, and context.
Running AI analyses of documents you upload (with the output returned to you, not shared with any third party beyond the AI processor).
Organizing your records and surfacing deadlines.
If you book a consult or submit an Ask Nicole question, providing the assigned advocate with the specific documents and context you choose to attach.

Information about your child is never:

Sold.
Used for targeted advertising.
Used to train general-purpose AI models.
Shared with schools or districts without your explicit action.
Shared with other parents.
Used to build public-facing profiles, leaderboards, or competitive features.

7. Third-party processors

We use specific third-party processors (Supabase, Stripe, Resend, Anthropic, Zoom) to provide the Service. When information about your child is shared with these processors, it is only for the narrow purpose required to operate the Service, under contractual protections that restrict the processor's use of the data to our instructions. See Privacy Policy § 6 for the full list.

8. Data retention

We retain information about your child for as long as your account is active. On account deletion, we purge live-system records within 30 days and rotate backups out within 90 days. See Privacy Policy § 7.2 for details.

9. Security

All document and reflection content about your child is encrypted at rest using AES-256. All network traffic uses TLS 1.2 or higher. Database access is governed by Row-Level Security policies that prevent cross-account reads at the database engine level. See Privacy Policy § 5 for the full security posture.

10. Contact us about children's data

Questions, concerns, or requests regarding your child's data: privacy@gardenia.joy

For concerns about COPPA compliance more broadly, the Federal Trade Commission's Children's Online Privacy resource is a good starting point: ftc.gov/childrens-privacy.

This COPPA notice is a draft prepared for Gardenia's internal review. Whether COPPA's verifiable-parental-consent regime applies to Gardenia in its current design depends on how the FTC and Gardenia's counsel characterize the data flow (parent-entered-about- child vs. collected-from-child). This draft takes the more conservative view — that Gardenia is NOT directly subject to COPPA's verifiable-consent requirement because the service is not directed at children and does not knowingly collect information from children, but that we will honor parental rights as if COPPA applied. Counsel should confirm this framing before launch. The "DRAFT" marker stays until that review is complete.