SHORESH Children's Privacy Notice — United States and Canada

Almost every child who uses SHORESH is under 13. The United States Children's Online Privacy Protection Act (COPPA) and its implementing Rule, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), both put specific obligations on a service in that position. This notice sets out what we do about them. It is part of our Privacy Policy and does not replace it.

Route A — a family subscribes. We collect personal information about a child, so under COPPA we must give the parent direct notice and obtain verifiable parental consent before collecting it. Sections 3 to 6 are that notice.

Route B — a school subscribes. The school enrols its own students. We rely on the Federal Trade Commission's long-standing guidance that a school may provide consent on behalf of parents for an online educational service used solely for a school-authorised educational purpose, where the operator does not use the information for any commercial purpose.

We state plainly what that guidance is. It is the FTC's published interpretation of COPPA, not a provision written into the COPPA Rule itself, and in its April 2025 amendments to the Rule the FTC chose not to codify it, pending an update to the United States Department of Education's FERPA regulations. We therefore do not rest on it alone. Our school agreement requires the school to warrant the authority it holds and to give parents notice; and, more to the point, the service is built so that we receive no identifying information about a school's students at all. Sections 7 to 9 cover this route.

In both routes the practical design is the same: we collect as little as the service can work with, we use it only to teach, and we never use it to advertise.

If you subscribe as a family, this is the complete list of what we collect about your child, and nothing is collected before you consent:

• your child's first name, so the child sees their own name in the app and you can tell your children's profiles apart;
• your child's learning level — beginner, standard or advanced — so that lessons and questions come at the right difficulty;
• a username and password we generate for the child's profile;
• the child's learning activity — which lessons were opened, which videos were watched, which quiz answers were given and the scores;
• technical records created automatically when any device uses a website: IP address, browser and device type, timestamps and error logs.

We have also collected your own name and email address. Your email address is how we reach you, how we obtain your consent, and how you exercise the rights below.

We use it only to run the service for your child: to serve the right lessons, to keep their place, to show you their progress, to keep the service secure, and to contact you about the account.

We do not condition your child's participation on disclosing more than is reasonably necessary for the activity.

We will not disclose your child's personal information to any third party for that third party's own purposes, and we will never sell it. The only parties that handle it are the suppliers that run our infrastructure. Each handles it solely in order to provide its service to us, under contract, and may not use it for any purpose of its own. By category and by name they are: our database, authentication and file-storage host (Supabase); our web host and content-delivery network (Vercel); the host of the lesson-presentation viewer that some lessons open (Netlify); our error-monitoring service, which records the technical details of a fault and to which we do not send information that identifies a child (Sentry); the service that sends our transactional and safety emails (Resend); our rate-limiting provider, which protects the service against automated abuse (Upstash); and the platforms that deliver some lesson videos, our web fonts and a small number of embedded lesson documents (Google/YouTube). For a family subscription our payment provider (Paddle) handles your own payment details — not your child's information. There is no advertising network, no data broker and no analytics provider in that list.

Because there is no disclosure to a third party for its own purposes, and no targeted advertising, we do not seek the separate parental consent that either of those activities would require. If that ever changes we will ask you before it does.

We do not use your child's information, or anything your child writes or draws, to train artificial-intelligence or machine-learning models.

We do not enable your child to make their information publicly available, and there is no feature in SHORESH that lets your child communicate with another user.

Before we collect anything about your child, we show you this notice and ask you to consent.

For a paid family subscription, your consent is verified through the checkout. Completing a payment using a credit card, a debit card or another online payment system that provides notification of each discrete transaction is one of the methods the COPPA Rule expressly recognises for verifying that the person giving consent is an adult (16 C.F.R. § 312.5(b)(2)(ii)). Our payment provider, Paddle, issues a receipt to the account holder for every charge, including every renewal. We record that transaction's identifier alongside your consent, so we can always show when consent was given and how it was verified.

We do not offer a free tier, and we collect nothing about a child before a payment has been completed. If we offer a trial, it is a paid trial, so that consent is verified the same way.

If we ever want to collect or use your child's information in a materially different way from what this notice describes, we will ask you again before doing it.

At any time, by emailing info@shorsh.org from the address on your account, you may:

• see what we hold about your child;
• get a copy of it in a portable form;
• correct anything that is wrong;
• have it deleted;
• refuse any further collection or use, and withdraw a consent you already gave;
• stop your child's creations being used in our response videos.

If you withdraw consent or ask us to stop collecting, we will delete your child's information and close the child's profile, because the service cannot run without it. We will tell you that this is the consequence before we act.

We will respond within 30 days. We will first confirm that you are the parent on the account, so that we never hand a child's information to the wrong person. There is no charge, and asking will never cause us to treat you or your child worse.

When a school subscribes, we hold no identifying information about the students at all. We do not receive names, email addresses, home addresses, telephone numbers, dates of birth, photographs or parents' details. We are not able to work out which child a username belongs to.

What exists is a username, a password hash, a classroom, learning activity, and — in schools running our international programme — short letters to our animated characters. The list that connects a username to a real child is created and kept by the school's teachers and never leaves the school.

Our school agreement requires the school to:

• have the authority, under its own policies and its own local law, to enrol its students in SHORESH and to consent on parents' behalf;
• give parents notice that SHORESH is in use and make this notice available to them;
• use SHORESH only for the school's own educational purposes;
• keep the username-to-child list secure, and not send it to us.

And it requires us to:

• use student information only to provide the service to that school, and for no commercial purpose of our own;
• not advertise to students, build advertising profiles, or sell or share student information;
• delete or export student data on the school's instruction;
• delete all of a school's student data within 90 days after the school's subscription ends;
• notify the school without undue delay of any breach affecting its students.

Where a school is subject to the Family Educational Rights and Privacy Act (FERPA), we act as a “school official” with a legitimate educational interest, under the school's direct control with respect to the use and maintenance of education records, and we do not re-disclose them. Many private schools are not subject to FERPA; where a school asks us to meet the FERPA standard by contract, we will.

Where a state student-privacy statute applies — for example California's SOPIPA, Illinois's SOPPA, or Connecticut's student-data law — we will enter into the data-protection rider that statute requires, and we accept the obligations those statutes place on a school service provider: no targeted advertising to students, no sale of student data, no amassing a profile except in furtherance of school purposes, deletion on request, and a published security programme.

New York State. New York Education Law § 2-d requires a school's contractor to supply a Parents' Bill of Rights for Data Privacy and Security, and a supplemental data-security plan, with every contract. We have not yet prepared those documents, and we therefore do not currently offer SHORESH to schools in New York State. We will prepare them before we do.

Under PIPEDA, consent to collect a child's personal information must be given by the child's parent or legal guardian. For a family subscription that is the consent described in section 5. For a school, it is the authority the school warrants in section 7.

We meet PIPEDA's other requirements as set out in the Privacy Policy: we identify the purposes, we limit collection to those purposes, we limit retention, we keep the information accurate, we safeguard it, we are open about our practices, we give access on request, and we have a named point of contact for complaints — info@shorsh.org.

Quebec. Law 25 imposes additional requirements, including that consent for a minor under 14 be given by the person holding parental authority, that we designate a person responsible for the protection of personal information, and that we assess privacy before transferring personal information outside Quebec. We have not yet completed that work, and we therefore do not currently offer SHORESH to families or schools in Quebec. Everywhere else in Canada, PIPEDA and the applicable provincial law apply as described above.

A parent or school in Canada may complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

Section 6 of the Privacy Policy describes the automatic scan that looks for signs that a child writing a letter may need help, and the notice it sends to us and to the child's principal.

To be explicit about the boundary: SHORESH is a software company in Israel. We are not the child's school, not a healthcare or social-service provider, and not a mandated reporter under United States or Canadian law. We hold no name and cannot identify a child. What we do is deliver the letter and its context to the adults at the school who can identify the child, as fast as we can. The duty to assess the child's situation and to report it to the authorities where the law requires rests with the school and its staff.

We will also disclose information, including to a law-enforcement or child-protection authority, where we reasonably believe it is necessary to protect a child from imminent harm, or where a valid legal process requires it.

Questions about children's privacy, or any request under this notice:

David Vaknin, trading as ABCschool
11 HaRav Mordechai Eliyahu Street, Kiryat Malakhi, Israel
info@shorsh.org

In the United States you may also contact the Federal Trade Commission at ftc.gov. In Canada, the Office of the Privacy Commissioner at priv.gc.ca.