Legal
Privacy Policy
Effective May 1, 2026
The Short Version
We collect the minimum data needed to help you understand your child's development. We never sell your data. We never let your child's information reach AI systems in identifiable form. We treat your family's privacy as a structural requirement, not a feature.
Who We Are
Puddle is operated by SayMake, Inc., a Delaware C-Corp. Our website is askpuddle.com. For privacy questions, contact privacy@askpuddle.com.
Children's Privacy (COPPA)
Important: Puddle is designed for parents, not children. Children do not create their own accounts. Any optional student-facing experience (for example, Kid Mode) is parent-gated and does not replace your visibility or control.
Parents enter information about their children (age ranges, interests, activities). Here's how we protect that data:
- Verifiable, scoped consent. We record separate parental choices for storing a child profile, AI-powered processing, product analytics tied to child-linked features, email digests, and disclosure to subprocessors (for example, the AI provider) as required for each feature. You can revoke a scope or request deletion without waiting for email in many cases via the in-product tools we expose alongside this policy.
- No child accounts. Only parents authenticate. Children are referenced by parent-created profiles, never by direct accounts.
- Data minimization. We collect the minimum needed: life stage, grade range, interests, and activities. We do not collect child photos, precise birthdates, social security numbers, or biometric data.
- AI tokenization. When we send data to AI systems (for example, Google Gemini), child names are replaced with anonymous tokens where applicable. Processing still requires your explicit consent for the AI scope.
- Deletion and export. You can request complete deletion of your child's data by emailing privacy@askpuddle.com. Where available, you can also export or delete a child profile through authenticated in-product actions backed by the same ownership checks. We complete verified requests within a reasonable time, typically within 30 days.
- Cascade deletion. If you delete your account, all child profile data is automatically and permanently deleted.
What We Collect
From you directly
- Account info: Email address and name (via Google OAuth). We never see your Google password.
- Child profiles: Life stage, grade, interests, activities, school name (parent-entered).
- Wizard answers: Decision fork questions, relational style, zip code.
- Reviews: School reviews you choose to submit.
Automatically
- Usage analytics: We use PostHog for product analytics. We design events to avoid identifiable child fields. Where an event is tied to a child-linked feature, we only do so when you have granted the separate analytics consent scope for that child.
- Device info: Browser type, screen size, operating system — for making Puddle work well on your device.
We do NOT collect
- Child photos or videos
- No voiceprints or biometric templates for children
- Precise child birthdates (we use grade/age ranges)
- Social security numbers
- Location tracking (zip code is entered, not tracked)
- Contacts, messages, or browsing history
How We Use Your Data
- Generate insights: Growth Snapshots, Monthly Briefs, and recommendations — using AI with tokenized (anonymous) child data
- Improve Puddle: Aggregate, de-identified usage patterns to make the product better
- Communicate with you: Account-related emails, monthly briefs, product updates (you can unsubscribe anytime)
- School intelligence: Match your zip code to nearby schools from public federal data
Who Sees Your Data
| Service | What they see | Why |
|---|---|---|
| Google Gemini (AI) | Tokenized child data (no real names) | Generate insights |
| Supabase (database) | All data (encrypted at rest) | Data storage |
| Stripe (payments) | Parent payment info only | Process subscriptions |
| PostHog (analytics) | Page views, clicks (no child data) | Product improvement |
| Resend / Flodesk (email) | Parent email only | Send emails |
We never sell your data. We do not run behavioral or targeted advertising against child profiles. We never share identifiable child data with advertisers or data brokers. Subprocessors above may only receive what is needed for their service and your chosen consent scopes.
School Data Sources
School information displayed on Puddle comes from publicly available federal sources:
- National Center for Education Statistics (NCES) — Common Core of Data
- Civil Rights Data Collection (CRDC) — U.S. Department of Education
- Education Data Portal — Urban Institute (aggregated federal data)
This is public data about public institutions. It does not contain information about individual students or families.
How Long We Keep Data
We keep information only as long as needed for the purpose it was collected, subject to your account and your consent choices. For example: child-linked builder data is removed when you delete the child profile or your account (with database-level cascade where applicable); anonymous wizard sessions expire on a schedule; and unclaimed Growth Snapshot rows are cleaned by automated jobs.
Your Rights
You have the right to:
- Access all data we hold about you and your children
- Correct inaccurate information
- Delete your account and all associated data
- Export your data in a portable format
- Withdraw consent for specific processing (AI, analytics, email digest, or subprocessors) per child, without deleting your entire account where the product allows it
To exercise any of these rights, email privacy@askpuddle.com. We will respond within 30 days.
California Privacy Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA):
- Right to know what data we collect and why
- Right to delete your data
- Right to opt out of data sales (we don't sell data)
- Right to non-discrimination for exercising your rights
Data Retention
- Active accounts: Data retained while your account is active
- Deleted accounts: All data permanently deleted within 30 days
- Growth Snapshots (anonymous): Retained for social proof and product improvement. Not linked to your account after deletion.
- Analytics: Aggregated, de-identified data may be retained indefinitely
Security
We use industry-standard security measures: encrypted data at rest and in transit (TLS), row-level security policies in our database, PII stored in a separate vault with restricted access, and Google OAuth (we never handle passwords).
No system is perfectly secure. If we discover a breach affecting your data, we will notify you within 72 hours.
Changes to This Policy
We may update this policy as Puddle evolves. Material changes will be communicated via email. The effective date at the top reflects the latest version.
Contact
Privacy questions? Email privacy@askpuddle.com
SayMake, Inc. · Delaware C-Corp · askpuddle.com