COPPA Policy — Human Aspire

Human Aspire

Last Updated: August 12, 2026

1. Applicability

This policy applies to learners under 13 using Lumina, Mint, Anchor It, and PakoBots, in compliance with the Children's Online Privacy Protection Act (COPPA), 16 CFR Part 312.

Human Aspire is a nonprofit. We do not sell advertising, we do not sell data, and we have no business model that depends on knowing more about a child than teaching them requires.

2. Account Creation and Parental Consent

Children under 13 cannot create their own accounts. A parent or guardian creates and manages the account on the child's behalf.

Before a child's account becomes active, we verify that an adult is giving consent using a knowledge-based verification step: the parent answers a series of questions that a child would not be able to answer, and all must be answered correctly. This is a verification method permitted under COPPA. Answers are graded on our servers, so the questions cannot be bypassed by the app.

Consent covers the collection and use described in this policy. A parent may withdraw consent at any time by contacting us, which stops further collection and, on request, deletes the account.

3. Information Collected

We collect only what the educational service needs.

First name or alias — chosen by the parent, teacher, or child. A nickname is fine.
Learning activity — the work the child does on the platform: answers, progress, reading and writing activity, and the interests they tell us about so lessons can be themed around what they like.
Audio, processed and immediately discarded — see Section 4.
Sign-in and security records — the network address and browser or device description at sign-in, and whether the attempt succeeded. We keep these solely to protect the account: to detect someone trying to break into it, and to show a parent or school what happened if we are asked. They are never used to build a profile of the child, to follow them across other websites, or for advertising of any kind.

We do not collect a child's home address, phone number, government identifier, photograph, or precise location. We do not use tracking or advertising cookies. We do not permit third-party advertising anywhere on the platform.

4. Audio and Reading Aloud

Some activities ask a child to read or speak aloud. When they do, their device sends short segments of audio to our servers, which convert the speech to text so the activity can respond.

The audio is processed and discarded immediately. It is not stored, and no recording is kept. Only the resulting text is used, and only to run the activity the child is doing.

We do not use a child's voice to identify or recognize them. We do not create a voiceprint, we do not match a voice against any other voice, and we never use audio for advertising, profiling, or any purpose other than the activity in progress.

Speech is converted to text on our own servers. A child's voice is never sent to an outside speech or artificial intelligence service.

If we ever wish to keep a recording — for example, to help us improve how well our reading companion listens — we will ask the parent for separate, specific permission first, explain exactly what we want to keep and for how long, and let them withdraw that permission at any time. Using the platform will never by itself be treated as permission to record.

5. Who Else Sees a Child's Data

We do not sell, rent, or share children's personal information with anyone for their own use. No advertising networks, no data brokers, no profiling, ever.

Artificial intelligence runs on our own servers. The AI companions a child talks to, the speech-to-text that hears them read, and the voice they hear back all run on hardware we own and operate. A child's voice, writing, and conversations are never sent to an outside AI provider.

We rely on a small number of vendors purely to operate the service — infrastructure hosting and network security. They process data strictly on our instructions, may not use it for their own purposes, and receive only what their function requires. Payment processing never involves child data.

Because we do not share children's data with third parties for their own use, there is no separate third-party sharing for a parent to consent to. If that ever changes, we will ask for separate consent first — consenting to your child using the platform will never be treated as consenting to sharing their data.

6. Parental Rights

Parents and guardians may exercise the following rights at any time by contacting support@human-aspire.org. We will respond within 30 days.

Review — request a readable summary of the child's data
Correction — request correction of inaccurate information
Deletion — request deletion of the account and all associated data
Opt-out — request that new data collection cease

Exercising these rights is free, and we will never require a parent to create an account or provide additional personal information in order to use them.

7. School Deployments

Schools may provide parental consent under the COPPA school consent exception by signing a COPPA School & Tutor Agreement. Schools must inform parents that this policy applies. Where FERPA applies, the school acts as the data controller.

8. Data Retention

Why we keep what we keep. We keep a child's learning activity for one reason: so the platform remembers where they are and can pick up where they left off. A reading companion that forgets a child every session cannot help them. We keep sign-in and security records so we can detect and investigate attempts to access the account.

How long. Only as long as that purpose requires, and never indefinitely.

Learning activity — kept while the account is active. Purged after 6 months of inactivity, with notice to the parent or school beforehand.
Sign-in and security records — kept for 12 months, then deleted.
Audio — never retained. Discarded immediately after conversion to text.

A parent may request immediate deletion at any time; we complete it within 30 days.

9. Security

We maintain a written information security program covering children's data, described in our Information Security Program. It designates an individual accountable for the program, assesses risks at least annually, and tests the safeguards we rely on rather than assuming they work.

In the event of a breach affecting child accounts, affected parents will be notified within 72 hours of discovery.

10. Changes to This Policy

We will notify parents of material changes by email before they take effect. Where a change would materially expand what we collect or how we use it, we will seek fresh consent rather than rely on continued use.

11. Contact

Email: support@human-aspire.org

Security program coordinator: Mike Aumock, Founder