Privacy Policy

DRAFT — pending legal review. This Privacy Policy is a working draft published to satisfy the basic disclosure floor for the site. It is not legal advice and will be reviewed by counsel before paid launch. If you have questions, email hello@wibbit.ai.

Last reviewed: May 4, 2026 — DRAFT v2

Who we are

Wibbit is operated by Wibbit Labs Corporation, a C-Corporation incorporated in Wyoming, USA. Wibbit is a Duolingo-style AI literacy platform built for kids ages 10 and up. Kids use the product directly to learn how AI works; parents create the billing account and pay for the subscription.

Questions about this policy, your account, or your child's data can be sent to hello@wibbit.ai.

What we collect from kids

When a child uses Wibbit, we collect what we need to run the lessons and remember where the child left off:

• Account info: email, age (or birthdate), and display name.
• Learning data: lesson progress, module completion, quiz answers, experiment and challenge responses, time spent on each task, attempt counts, and hint usage.
• Technical info: IP address, device and browser type, and session timestamps (the standard signals any website receives).

We use this information to operate the service, improve the user experience, and personalize course work in the future.

What we do not collect from kids today:

• We do not collect voice recordings.
• We do not accept photo or video uploads.
• We do not track precise geolocation (we may infer country from an IP address, but nothing finer).
• We do not collect biometric data.

If we ever add a feature that would change the list above, we will update this Privacy Policy and notify parents before turning it on.

What we collect from parents

When a parent creates a billing account, we collect:

• Account info: email and name.
• Billing info: payment method, handled by Stripe. Card numbers are stored by Stripe as a PCI-compliant payment processor — Wibbit does not store card numbers on its own servers.
• Billing address as provided to Stripe.

We do not collect additional personal information from parents beyond what is needed to operate the account and process payments.

How we use information

We use the information above to:

• Run the service: keep accounts working, save progress, deliver lessons.
• Improve the user experience: understand where lessons are working and where they aren't.
• Personalize course work in the future, so each child gets the right next lesson.
• Process subscriptions and billing.

We do not use kids' learning data to build advertising profiles. We do not run third-party advertising on Wibbit.

Who we share it with

Today, the only third parties that handle Wibbit personal information are operational service providers we rely on to run the platform:

• Supabase — database, authentication, and row-level security. Account data and learning progress are stored here.
• Stripe — subscription payments and billing.
• Vercel — website and application hosting, including standard server logs.

As Wibbit adds operational tooling (analytics, email delivery, error monitoring, AI services that power features), this Privacy Policy will be updated to disclose those processors before they begin handling personal information.

We do not sell personal information. We do not share kids' personal information with third parties for their own marketing or advertising.

Children's privacy & COPPA

Wibbit is intended for kids and operates as a service covered by the U.S. Children's Online Privacy Protection Act (COPPA).

Because some of our users are under 13, COPPA requires us to obtain verifiable parental consent before collecting personal information from a child under 13. Wibbit obtains this consent before any child account is activated using the following mechanism.

Verifiable parental consent — Signed digital consent form + authenticated parent account (FTC §312.5(b)(2)(i))

Wibbit obtains verifiable parental consent through an electronically signed consent form combined with an authenticated, email-verified parent account, per FTC §312.5(b)(2)(i). Specifically:

1. Notice is given at signup: the parent attestation checkbox on the account-creation screen describes what information Wibbit collects and how it is used.
2. The parent signs in to a Wibbit account using a sign-in method that has already verified control of the parent's email address (Google, Apple, Microsoft, Clever, or a magic link).
3. The parent completes a digital consent form that includes their name, attestation, and digital signature (typing their full name to sign).
4. The parent's IP address and user agent are captured server-side at form submission for the consent audit record.
5. A timestamp of consent is recorded at the moment the form is submitted.

Upon successful submission, Wibbit writes a parental_consents record with status = verified, method = signed_form, and the audit metadata (signed name, consent text version, authenticated provider, email-verification timestamp, session-issued timestamp).

Parents can view their consent record in their account at Account → Consent record.

Parents have the right to:

• Review the personal information we have collected from their child.
• Request deletion of their child's personal information.
• Refuse further collection of their child's personal information.

To exercise any of these rights, or to revoke consent, email hello@wibbit.ai from the address associated with the parent account. We may need to verify that you are the parent before acting on the request. Consent can be revoked at any time; upon revocation, we will delete your child's personal information within 30 days.

We do not share personal information collected from kids with third parties beyond the operational processors named above (Supabase, Stripe, Vercel).

California residents (CCPA)

If you live in California, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what categories of personal information we have collected about you and how we use them.
• The right to delete personal information we have collected, subject to limited legal exceptions (for example, records we must keep for tax purposes).
• The right to opt out of "sale" of personal information.

Wibbit does not sell personal information. There is nothing to opt out of, but we want to be explicit about it.

To exercise any of these rights, email hello@wibbit.ai.

International users

Wibbit is launching in the United States. Users outside the U.S. may have additional rights under their local laws — including GDPR-K (EU and UK), PIPEDA (Canada), and similar laws in Australia, New Zealand, Germany, and Japan.

This Privacy Policy will be expanded with jurisdiction-specific notices before Wibbit launches in those regions.

Data retention

We keep account information and learning data for as long as the account is active. When a parent deletes an account, we delete the personal information associated with that account, allowing up to 30 days for the deletion to propagate across our processors and backups. Some billing records are retained longer where required by tax and accounting law.

Security

We follow standard web security practices to protect your information:

• Data is transmitted over TLS (encrypted in transit).
• The database is protected by Supabase row-level security, so accounts are isolated from one another.
• Payment information is handled by Stripe; Wibbit servers never see card numbers.

No method of transmitting or storing data on the internet is 100% secure. We work to protect your information, but we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy as the product evolves or as the law requires. When we make material changes, we will post the updated policy here and notify subscribers by email. Continued use of Wibbit after we post a change means you accept the updated policy.

Contact

Questions, requests, or concerns about this Privacy Policy or your data:

Email: hello@wibbit.ai