Verifiable parental consent method
Koydo uses the credit-card $0.01 authorization method approved by the FTC. The parent's credit card is charged $0.01 (refunded immediately), the parent signs a digital acknowledgment, and the consent record is stored with a timestamp + IP + browser fingerprint.
What we collect from under-13s
Display name, age band (not exact birthdate), preferred name + pronouns (optional), target language, learning goals (free-text, parent-reviewed), lesson recordings (only when both parent and tutor opt-in).
What we never collect
Exact birthdate, home address, phone number, photo, geolocation, social media handles, real-name school identifier. The minimum-necessary principle binds.
Parent visibility
Parents see every lesson, every homework, every gradebook entry, every parent-tutor message thread. The parent portal (/parent) is multi-child — one login covers all kids.
Annual re-consent
Consent re-affirmed annually via the same credit-card authorization + acknowledgment flow. Reminders sent 30 days, 14 days, and same-day before lessons pause. If consent lapses, lessons auto-pause until re-consent.
Data access rights
Parents can request data export at /parent/data-export at any time. Right-to-be-forgotten requests completed inside 30 days. Parents can revoke consent at any time; lessons pause within 24 hours of revocation.
Direct notice flow
On first sign-up, parents receive: (1) what data we collect, (2) why we collect it, (3) who sees it, (4) how to delete it, (5) the FTC complaint URL. Direct notice is a separate page from the privacy policy — parents who skim the policy still see the direct notice.