COPPA Compliance

Last updated: May 17, 2026

What is COPPA?

The Children's Online Privacy Protection Act (COPPA) is a United States federal law that imposes requirements on websites and online services directed at children under 13 years of age. COPPA requires operators to obtain verifiable parental consent before collecting, using, or disclosing personal information from children.

How Verbalyft Complies with COPPA

Verbalyft is specifically designed for children and we take COPPA compliance seriously. Here is how we meet each requirement:

1. Verifiable Parental Consent

  • Children cannot create accounts independently. A parent or legal guardian must register and provide consent before any child data is collected.
  • When a therapist creates a child profile, the parent is invited via a secure link to create their own account and accept the terms, providing informed consent.
  • We do not collect personal information from a child before parental consent is obtained.

2. Minimal Data Collection

We collect only the information necessary to provide the speech therapy service:

  • Child's first name — for personalizing greetings and the learning experience.
  • Age group — to calibrate exercise difficulty and content appropriateness.
  • Avatar selection — a chosen character for the child's profile (no photos).
  • Learning activity data — stories read, quiz answers, vocabulary progress, and practice metrics.

We do not collect: full legal names, addresses, phone numbers, photos, audio recordings stored on our servers, geolocation, device IDs for tracking, or any biometric data.

3. No Advertising or Data Selling

  • We do not display advertisements of any kind to children.
  • We do not use children's data for behavioral advertising, profiling, or retargeting.
  • We do not sell, rent, or share children's personal information with third parties for commercial purposes.
  • Third-party services we use (AI providers, hosting) receive only the minimum data needed for operation and are bound by data processing agreements that prohibit use of data for training or advertising.

4. Parental Access and Control

Parents and legal guardians have the right to:

  • Review all personal information we have collected about their child through the Parent Dashboard.
  • Modify their child's profile information (name, age group, avatar) at any time.
  • Delete their child's account and all associated data. Deletion can be initiated from the Parent Dashboard or by emailing hello@verbalyft.com. All data is permanently removed within 30 days.
  • Refuse further collection of their child's data by deactivating the account.
  • Withdraw consent at any time. Upon withdrawal, the child's account will be deactivated and data deleted.

5. Data Retention

  • We retain child data only for as long as the account is active and needed to provide the Service.
  • Accounts inactive for 12 months may be flagged for deletion with 30 days' advance notice to the parent.
  • Upon account deletion, all child-related data (profiles, stories, progress, chat history) is permanently deleted within 30 days.
  • We may retain anonymized, aggregated statistics (e.g., total stories generated) that cannot be linked to any individual.

6. Data Security

  • All data is encrypted in transit using TLS/HTTPS.
  • Passwords are hashed using bcrypt.
  • Authentication uses JSON Web Tokens (JWT) with expiration.
  • Speech audio is processed client-side via the browser's Web Speech API — no audio recordings are transmitted to or stored on our servers.
  • Access to child data is restricted to the parent and (if applicable) the assigned therapist.

7. Therapist and Institutional Use

When a licensed speech-language pathologist uses Verbalyft on behalf of child clients:

  • The therapist may act as the authorized party providing consent under COPPA's school/institutional exception where applicable.
  • Parent invitation links are sent so parents can independently create accounts and provide their own consent.
  • Therapists can only access data for children assigned to them.
  • Institutional data is segregated and never shared across organizations.

8. Contact Us

If you have questions about our COPPA compliance, your child's data, or wish to exercise your parental rights, contact us:

See also our full Privacy Policy for comprehensive details on data handling practices.

← Back to Home