Cubit Kids' Privacy Notice for Parents

Effective date: November 2, 2026
Last updated: November 2, 2026

This notice is for parents and guardians. It explains how Cubit handles information about your child, as required by the Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule (16 CFR Part 312). We send it to you by email before your child's profile is created, and it is always posted at cubitlearning.com/kids-privacy, with a link on our home page, in the app, and on every screen where a child profile is set up.

Your permission comes first. We need your consent before we collect, use, or share any information from your child. If you do not give consent, we collect nothing from your child and no profile is created.

1. Who we are

• Operator: CubitUSA LLC
• Mailing address: 10015 Metromont Industrial Blvd, Suite A, Charlotte, NC 28269
• Email: [email protected]
• Website: cubitlearning.com

We are the only operator that collects or keeps children's information through Cubit. Our general privacy policy is at cubitlearning.com/privacy.

2. Why we have your email

You gave us your name and email address when you started signing up. We use them only to send you this notice, ask for your consent, and run your parent account. If you do not give consent within 14 days of when we send this notice, we delete your name and email from our records.

3. What we collect from your child

Only a parent can create a child's profile. Once you give consent, Cubit collects:

• First name or nickname. A nickname is fine.
• Grade level.
• Placement test answers and results, so we can start each subject at the right level.
• Lesson progress: answers, scores, finished lessons, two week check results, and learning time logs (including how fast questions are answered, to spot guessing).
• Technical information needed to run the app: device type, IP address, and an app identifier that keeps your child signed in.

We do not ask for or collect your child's last name, email, phone number, home address, school, location, photo, video, or voice recording. Please do not have your child type any of those into Cubit.

Children cannot make any information public in Cubit. Children have no chat, no messaging, no public profile, and no posting.

4. How we use it

Only inside Cubit, and only to:

• Run your child's lessons at the right level and save their work
• Sync progress so it follows your child from device to device
• Show you, the parent, your child's progress, time, attendance, and reports
• Keep the app working and secure

We use the technical information (device type, IP address, app identifier) only to keep Cubit running, keep your child signed in, and protect against attacks. We do not use it, or anything else, to contact your child, to build a profile of your child for marketing, or for advertising.

What we never do:

• We never sell your child's information.
• We never share your child's information with third parties.
• There are no ads in Cubit, ever.
• There is no behavioral advertising or ad tracking.
• We never use your child's information to train outside AI models.
• We never profile your child for marketing or to make decisions about them. The only profile is their learning progress, used to pick the next lesson.

5. Sharing

We do not share your child's information with third parties. You do not need to agree to any sharing for your child to use Cubit.

A few service providers help us run the app, such as our hosting and data storage company, email delivery company, and error monitoring tool. They may handle information only to run Cubit for us, may not use it for anything else, and must give us written promises to keep it secure. Under the COPPA Rule, these providers are not "third parties." Our current providers are: Cloudflare (hosting, data storage, error and security logs, and Workers AI for the Parent's Assistant) and Resend (email delivery to parents).

Parent's Assistant. Cubit has an AI assistant for parents only, called the Parent's Assistant. It is locked behind the parent PIN, and children cannot open or chat with it. When you ask it about your child's progress, or for help planning the week or for teaching suggestions, it reads only a short summary of your own family's progress (scores, how many questions were missed, and in which skills) through Cloudflare Workers AI to answer you. Your questions and its answers are not saved; we keep only a count of how many were asked, for 90 days. Cloudflare may not use it to train AI or for anything else.

The only other time we would release information is if the law requires it (such as a court order) or to protect a child's safety.

If we ever want to share children's information with a third party, we would ask you first, separately, and your child could keep using Cubit even if you say no.

6. How you give consent: the "email plus" method

The COPPA Rule allows a company that does not share children's information to get consent by email plus an extra step. Cubit qualifies, and here is how it works:

1. You enter your name and email to start signing up. We send you this notice by email.
2. You read this notice and give consent from that email by tapping I give consent and confirming that you are the child's parent or legal guardian and 18 or older.
3. We then send you a second email confirming your consent.
4. You can then add your children's profiles in the Parent area. You confirm your consent for each child as you add their profile.

You can take back your consent at any time, including consent you gave by email. If you did not sign up, or you change your mind, reply to the confirmation email or write to [email protected] and we will stop collecting and delete your child's information.

If we ever change what we collect from children or how we use it in an important way, we will send you a new notice and ask for your consent again first.

7. Your rights as a parent

At any time, you can:

• Review the information we have about your child
• Download a copy of it
• Delete it
• Refuse further collection, by pausing the profile or taking back your consent

How to do it:

• In the app: open the Parent area (locked by the PIN you choose), pick your child, then tap View data, Download data, Pause profile, or Delete profile. You must be signed in to your parent account, so only you can do this.
• By email: write to [email protected] from your account email. We will confirm you are the parent before we share or delete anything. We reply within 5 business days and finish your request within 30 days.

You can also have an authorized agent make a request for you, with your signed permission. If we ever say no to a request, you can appeal by replying with the word "Appeal." We will answer in writing within 45 days, and if you are still not satisfied you can contact your state's Attorney General.

If you delete your child's information or take back consent, your child will no longer be able to use Cubit, because the app cannot save lessons or progress without it. We will never ask your child for more information than a lesson needs.

8. How long we keep it

We keep your child's information only as long as we need it to run Cubit for your family. We never keep it forever. Our written data retention policy:

• You delete a profile or close your account: removed from the app right away, deleted from our systems within 30 days, and cleared from backups within 35 days after that.
• You take back consent: collection stops right away, then deletion follows the same schedule.
• Inactive accounts: if there are no sign ins and no active subscription for 12 months, we email you. If you do not ask us to keep the information within 30 days, we delete it.
• We keep a record that you gave consent for the life of your account plus 3 years. It contains no lesson data.

When we delete information, we use secure deletion methods so it cannot be recovered or misused.

Tip: download attendance and progress records you need for your homeschool files before you delete a profile.

9. How we protect it

We keep a written information security program, as the COPPA Rule requires. A named person is in charge of it. We review risks at least once a year, encrypt data in transit and in storage, limit access to the few people who need it, test before every release that one family can never see another family's data, and require written security promises from our service providers. If your child's information is ever exposed, we will tell you promptly, and we will notify regulators as the laws of your state require.

10. Same protections in every state

Cubit serves families in all 50 states and Washington, DC, and every family gets the same protections. We built them to meet the strictest state laws for children's and teens' information, not just COPPA:

• We get your consent for each child profile, whatever the child's age, including teens 13 to 17.
• We never sell your child's information, including sensitive information, and there are no ads, so there are no targeted ads.
• We collect only what lessons and progress records need. No precise location, no health or disability information, and no voice or face data.
• Your child's profile is private by default: no public profile, no chat, no messaging, no posting.
• Every parent, in every state, has the same rights in section 7.

State-specific rights. Some state laws ask us to say a few extra things. We follow all of them for every family:

• California: we treat the state's student privacy law (SOPIPA) as applying to Cubit, so we never use student information for targeted ads, never sell it, never build profiles except to support learning, and delete it when you ask. We do not sell or share personal information, and we do not share it with anyone for their own marketing.
• Connecticut, Colorado, and Montana: no targeted ads, sale, or profiling of minors, consent before any sensitive information about a minor, and reasonable care to avoid harm to minors.
• New York: for teens 13 to 17, we handle only what is strictly needed to run Cubit, or what you agree to and can take back at any time without losing access. We respect device signals that a user is a minor.
• Vermont (starting January 1, 2027): high privacy settings by default, only the information we need, and a duty of care toward children who use Cubit.
• Nevada: we do not sell information, but you can still send a request not to sell to [email protected].
• Delaware: we never market or advertise products to children.
• Texas, Nebraska, Minnesota, and New Jersey: we never sell sensitive information, including children's information.
• Rhode Island: what we collect is listed in section 3, and the only companies that receive any of it are the service providers in section 5.

Our general privacy policy at cubitlearning.com/privacy has the full list.

11. Questions

Write to us at [email protected], or mail CubitUSA LLC, 10015 Metromont Industrial Blvd, Suite A, Charlotte, NC 28269.

You can learn more about COPPA from the Federal Trade Commission at ftc.gov.

Consent form

• ☐ I am the parent or legal guardian of the child or children I will add to Cubit, and I am 18 or older.
• ☐ I have read this notice. I give Cubit permission to collect and use my child's information as described above, only to run Cubit for my family.

I give consent I do not consent. Delete my information.

After you tap I give consent, we will send a second email to confirm. You can take back your consent at any time.