Collective Platform - Privacy Policy

Scope

Collective is offered to users in the United States and Canada. This policy is written to align with the U.S. Children's Online Privacy Protection Act (COPPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, and the California Consumer Privacy Act as amended (CCPA/CPRA) for California residents. The Service is not offered to users in the European Union, the United Kingdom, or the European Economic Area.

Information We Collect

Information you and your child provide

• Account and identity information: a display name or first name, an email address (of a parent or guardian for younger users), account credentials, and the participant's age or age band.
• Profile information: an optional profile photo, a short bio, and the traits, teams, crews, or organizations the participant is associated with.
• Proof-of-work submissions: text descriptions, photos, and videos a participant submits to demonstrate completion of a challenge or task. These may include images or recordings of a child.
• Messages and communications: messages exchanged within the Service (for example, between a participant and their crew or mentor) and communications you send to us directly.
• Journal and activity content: entries created within features such as the Collective Journal, and records of tasks a participant attempts or completes.

Information collected automatically

• Device and technical information: device type, operating system and version, app version, and basic diagnostic and crash information.
• Usage information: interactions within the app, features used, and task-completion records used to operate the Service and calculate progress.

We limit automatic collection from children to what is reasonably necessary to operate the Service. We do not use children's personal information for behavioral or targeted advertising, and we do not permit third parties to do so through the Service.

Information from parents, coaches, and organizations

Collective is often deployed through sports leagues, schools, and youth organizations, so we may receive information about a participant from a parent or guardian, or from a coach or administrator who enrolls participants.

How We Use Information

We use personal information to:

• Create and maintain accounts and operate the Service;
• Enable participation in challenges and tasks, and record and display completion;
• Calculate, display, and update a participant's CScore and trait balance;
• Enable review of proof-of-work submissions by mentors;
• Enable messaging within crews, teams, and organizations;
• Communicate with parents, participants, coaches, and organizations about accounts, activity, and support;
• Maintain the safety, security, and integrity of the Service, including content moderation;
• Comply with legal obligations and enforce our terms; and
• Understand how the Service is used so we can maintain and improve it.

We do not use children's personal information for any purpose that is not reasonably necessary to provide the Service unless we first obtain any consent the law requires.

Children's Privacy

Protecting children is the core of this policy, not an exception to it. The majority of Collective's participants are minors, and many are under 13.

Verifiable parental consent (under 13). For a participant under 13, we obtain verifiable parental consent from a parent or guardian before we collect personal information from the child, except for the limited information needed to obtain that consent. We do this by sending a consent request to the parent or guardian's email address and requiring the parent to confirm consent before the child's account becomes active. Where a school, league, or organization enrolls a participant, we coordinate the consent process with that organization.

What we collect, and data minimization. From a participant under 13 we collect only what is reasonably necessary to operate the Service: a first name or display name, age band, account credentials tied to a parent's email, profile information the family chooses to add, task and journal activity, proof-of-work submissions, and in-app messages. We do not require a child to disclose more personal information than is reasonably necessary to participate.

Parents' rights. At any time, a parent or guardian may review the personal information we have collected from their child, request that we correct or delete it, refuse to permit further collection or use, and revoke consent. To exercise these rights, contact us using the details below. We will verify that a request comes from the child's parent or guardian before acting on it. Deleting certain information may make it impossible for the child to continue using the Service.

Proof-of-Work Submissions (Photos and Videos of Minors)

Some tasks ask a participant to submit proof that they completed a challenge. Proof may be a written description, a photo, or a video, and it may show the participant. Because this can include images and recordings of children, we treat it as our most sensitive category of information.

How submissions are reviewed. Submissions are reviewed by people so a participant can receive credit. A participant who belongs to a crew with an assigned mentor has their submission reviewed by that crew's mentor. A participant without a crew, or whose season has ended, has their submission reviewed by a designated Collective Mentor. Reviewers can see the submission content, the associated task, and the participant's display name.

Keeping submissions private. Submitting proof for credit does not require posting it publicly. A participant may keep a submission private to the review process. Posting a submission to a public or shared feed is always optional and separate from earning credit.

Storage and retention. Photos and videos are stored with our hosting and storage provider (Supabase). We retain a submission only as long as reasonably necessary to verify completion and maintain the participant's record, and delete it on request or within 90 days of account closure. A parent may request deletion of their child's submissions at any time.

Messaging and Chat

The Service includes in-app messaging so participants can communicate with their crew, team, or mentor. This messaging is powered by a third-party chat provider (Stream Chat), which processes and stores messages on our behalf under contract. Messages may be subject to content moderation to protect participant safety.

The CScore

A central feature of the Service is the CScore, a score from 0 to 999 that reflects a participant's progress across six character traits. The CScore is generated automatically from a participant's completed tasks and the balance of their activity across traits. It is designed as a constructive, progress-based credential; it has no decay mechanic and is not used to penalize a child. Parents may review the information underlying their child's CScore. We do not sell the CScore or a participant's underlying data, and we do not use it for advertising.

Automated and AI-Assisted Systems

The Service does not currently use AI agents or AI-assisted systems to process participant content. We may introduce such tools in the future — for example, to help verify submissions, moderate content, support task progression, or assist mentors and coaches. If we do, we will update this policy before those tools go live and obtain any parental consent the law requires.

How We Share Information

We do not sell participants' personal information, and we do not share children's personal information for targeted advertising. We share information only as described below.

With coaches and organizations. Where a participant is enrolled through a league, school, team, or youth organization, we share relevant activity and progress information with the coaches, mentors, and administrators of that organization so they can support the participant. Parents choose whether to enroll their child with a given organization.

With service providers. We use trusted third-party providers to operate the Service. They may process personal information only on our instructions and under contract, and may not use it for their own purposes. By category, these include: hosting, database, and file storage (Supabase); messaging and chat (Stream Chat); email delivery (Resend); SMS and text delivery (Twilio); and application hosting for administrative tools (Vercel).

Legal, safety, and business transfers. We may disclose information when required by law, to respond to legal process, or to protect the rights, safety, and security of participants, the public, or Collective. If Collective is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to the commitments in this policy.

Data Location and Cross-Border Transfers

Some of our service providers store and process data in the United States. This means personal information of Canadian participants may be transferred to, stored in, and processed in the United States, where it may be accessible to U.S. courts, law enforcement, and government authorities under U.S. law. We use contractual and security measures to protect information handled by our providers.

Data Retention

We keep personal information only for as long as reasonably necessary to provide the Service and to meet legal, accounting, or reporting requirements. We do not retain children's personal information indefinitely. In general:

• Account information is kept while the account is active and deleted within 90 days of account closure;
• Proof-of-work submissions are kept while the account is active and deleted on request or within 90 days of account closure;
• Messages are retained while the account is active;
• Diagnostic and usage logs are retained for up to 12 months.

When a parent revokes consent or requests deletion, we delete the child's personal information within a reasonable period, except where we are legally required to retain it.

Your Rights and Choices

Depending on where you live and your relationship to a participant, you may have the right to access the personal information we hold, ask us to correct or delete it, withdraw consent to our collection or use of it, and request an export of certain information. To exercise any of these rights, contact us using the details below. We will verify your identity — and, for requests about a child, your status as parent or guardian — before responding.

Canadian residents may direct concerns to our privacy contact and, if unsatisfied, to the Office of the Privacy Commissioner of Canada. California residents may have additional rights under the CCPA/CPRA; Collective does not sell or "share" personal information as those terms are defined under California law.

Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. These include access controls, encryption in transit, and limiting access to submissions and messages to those who need it to operate the Service. No system can be guaranteed to be completely secure. If we become aware of a security breach affecting personal information, we will investigate and notify affected individuals and the appropriate authorities as required by law.

Cookies, Analytics, and SDKs

The Service is a mobile application and may use software development kits (SDKs) and limited analytics or diagnostic tools to operate, secure, and improve it. We do not use these tools to build advertising profiles of children or to serve targeted advertising.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date above and post the revised policy in the app and on our website. If we make a material change to how we handle a child's personal information, we will notify parents and, where required by law, obtain renewed verifiable parental consent before the change takes effect.

Contact Us

If you have questions about this policy, or want to review, correct, or delete your child's information, contact us at:

Canadian residents who are not satisfied with our response may contact the Office of the Privacy Commissioner of Canada. U.S. residents may contact the Federal Trade Commission regarding COPPA concerns.