This Children's Privacy Policy describes how Spencer's Website handles personal information from users under the age of 18, in compliance with the U.S. Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation for Kids (GDPR-K).
1. Age Requirements
Our Service has the following minimum-age requirements:
| Age | Access | Requirements |
|---|---|---|
| Under 13 | Not permitted | We do not knowingly collect data from children under 13 |
| 13–17 | Permitted with parental consent | Verifiable Parental Consent (VPC) required for paid accounts & full features |
| 18+ | Permitted | Standard Terms of Service apply |
2. Users Under 13
We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13 without verified parental consent, we will promptly:
- Delete all personal information from our systems
- Terminate the account
- Notify the parent/guardian if contact info is available
If you believe we have inadvertently collected data from a child under 13, please contact us immediately at spencerbuisness101@gmail.com.
3. Users 13–17 (Verifiable Parental Consent)
Users between 13 and 17 may use our free Community features, but the following activities require Verifiable Parental Consent (VPC):
- Making any purchase (monthly, yearly, or lifetime membership)
- Accessing paid features (AI Assistant, custom backgrounds, full game library)
- Providing additional personal information beyond username and email
3.1 VPC Process
When a minor attempts a restricted action, they are directed to the Parent Consent Portal (auth/parent_consent_portal.php). Our VPC process is:
- Minor provides parent's email address
- System generates unique consent token and emails parent
- Parent reviews data-collection practices and our policies
- Parent verifies identity via Stripe PaymentIntent of $1.00 (industry-standard VPC method) — this is refunded after verification
- Consent is recorded with verification code hash, payment intent ID, and timestamp
- Minor's account is unlocked for the approved activities
3.2 VPC Records
We retain consent records (verification hash, payment intent ID, timestamp) for 3 years after the minor reaches age 18, as required by COPPA Safe Harbor provisions.
4. Parent/Guardian Rights
Parents and legal guardians have the right to:
- Review their child's personal information collected by us
- Refuse further collection of their child's data
- Delete their child's personal information
- Revoke previously granted consent at any time (see
auth/revoke_consent.php) - Request an accounting of data shared with third parties (Stripe, Groq, Google)
4.1 How to Exercise These Rights
- Email us at spencerbuisness101@gmail.com with subject "Parent/Guardian Data Request"
- Include your child's username and a copy of the consent confirmation email
- We will verify your identity (e.g., matching email that granted consent) before taking action
- We respond within 10 business days
4.2 Revoking Consent
When consent is revoked, the minor's account is reverted to the free Community tier. Any active subscriptions are cancelled and prorated refunds may be issued at admin discretion. Account deletion can also be requested as part of revocation.
5. Data We Collect From Minors (13–17)
For users aged 13–17 who use free Community features, we collect:
- Username (chosen by the user)
- Email address (required for password recovery & security alerts)
- Hashed password (Argon2id; we cannot read it)
- Login timestamps, IP address, and device fingerprint (for security)
- Chat messages and AI conversations (if used)
For users 13–17 with parental consent and a paid plan, we additionally collect:
- Payment records via Stripe (card data never touches our servers)
- Parental consent records (verification hash, payment intent ID)
- Subscription tier and billing history
6. Safety Features for Minors
- No direct messaging from strangers: Smail requires both parties to have a paid account
- Automatic content filters: NSFW, hate speech, and violent content trigger immediate lockdown
- Admin oversight of AI chat: AI conversations involving minors receive enhanced monitoring
- No location sharing: We do not collect or display precise geolocation
- Report button: Minors (and all users) can report inappropriate content for 72-hour admin review
- Bulk delete on request: Parents can request full deletion of their child's data
7. Contact
For any questions or concerns about your child's privacy:
Email: spencerbuisness101@gmail.com
Subject line: "Children's Privacy Inquiry"