Children's Privacy Notice (COPPA)
Goal100 is made for students, many of them under 13. This notice explains how we protect children's information.
The short version
- Many Goal100 users are under 13. The Children's Online Privacy Protection Act (COPPA) protects them, and we follow it.
- Children give us no account, no name and no email. Progress stays on the device. The only thing that reaches our website host is the technical data needed to deliver a page, such as an IP address; it is used to run and protect the site and for nothing else.
- If child accounts open, they will be created only by a school for school use, or with a parent's verifiable consent.
- No ads, no tracking, no selling, and no sharing of children's information with third parties for their own use.
- Parents can review, delete and stop the collection of their child's information at any time.
This summary helps you read the full text; the full text controls.
Contents
1. Who runs Goal100 (the operator)
ZAKAZIKY LLC, a New York limited liability company doing business as Goal100 Learning, is the only operator collecting information through Goal100. Contact: the Contact page (mark it “Children's privacy”). Our postal address, telephone number and email address will be listed here before any child account opens, as the COPPA Rule (16 CFR § 312.4(d)) requires.
2. What we collect from children today
Nothing. Children can use every course and extra without an account, email or name. Nicknames, answers and progress stay in the browser on the device and are never sent to us. A progress code is made on the device and goes only where the child or a parent pastes it. The “Listen” button plays recordings made in advance or uses the device's own voice; it never records the child. The contact form is for adults 18+; if we learn a child sent us personal information, we delete it.
Typefaces and the 3D code library are stored on our own website, so no font or code service receives the device's IP address.
3. If child accounts open: what we would collect and why
| Information | Why | Shared with |
|---|---|---|
| Nickname (not a full name) | To show the child's own progress | The child's teacher or parent only |
| Class code and picture password | To sign in without email | Nobody |
| Answers, scores, progress, settings | To teach, review and show mastery | The child's teacher, school and parent |
| Sign-in times, device type, IP address | To keep the account secure (internal operations) | Our hosting and database providers, only to run the Service |
We will not collect a child's email, birthday, last name, photo, voice, precise location or government or biometric identifier. We will not ask a child for more information than an activity reasonably needs. Our service providers (hosting, database) process information only on our behalf, under written commitments to protect it, and this disclosure is integral to running the Service. We do not disclose children's personal information to any third party for its own purposes; if that ever changed, we would first ask parents for separate consent, as 16 CFR § 312.5(a)(2) requires.
4. How consent works
- School accounts. A school may authorize collection for the use and benefit of the school and for no other commercial purpose, as the Federal Trade Commission's COPPA guidance for schools describes. We use school data only for that educational purpose, under the school's agreement, FERPA and New York Education Law § 2-d. Parents may ask the school to see the information or to have it deleted.
- Family accounts. We get a parent's verifiable consent before collecting a child's information, using a method the COPPA Rule allows (for example a payment-card transaction with notice, or another approved method). We send the parent a direct notice that explains what we collect, how we use it, and the parent's rights.
5. Parents' rights
A parent or guardian may at any time: review the personal information we hold about their child; have it deleted; refuse further collection or use; and revoke consent. Use the Contact page; we verify that the requester is the parent before sharing any information, and we answer in writing. For school accounts, we work through the school.
6. Data retention policy (16 CFR § 312.10)
- Purposes: to provide lessons, show progress to the child, teacher and parent, and keep the account secure.
- Business need: we keep information only while it is needed for those purposes.
- Deletion timeframe: family-account data is deleted within 30 days after a parent asks or the account is closed, and after 12 months with no sign-in. School-account data is deleted or returned as the school's agreement requires, and no later than 60 days after the agreement ends unless the school directs otherwise in writing. Backups roll off within a further 35 days.
- We do not keep children's information indefinitely.
7. How we protect children's information
We maintain a written information security program appropriate to the sensitivity of children's information, as 16 CFR § 312.8 requires: a named person coordinates it; we assess risks at least once a year; we use encryption, least-privilege access, row-level security and two-step sign-in for staff; we test and update safeguards; and we require written security commitments from service providers.
8. No ads, no tracking, no selling
No behavioral advertising, no third-party trackers or analytics, and no sale or sharing of children's information. Persistent identifiers, if any, are used only to support internal operations (for example keeping a child signed in securely).
9. Changes
We will update this notice before any change in how we collect or use children's information, and we will ask for new parental consent before any material change that affects information already collected.
Laws and official sources referenced
- COPPA Rule amendments, 90 Fed. Reg. (Apr. 22, 2025), effective June 23, 2025, compliance date April 22, 2026: https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule (checked Nov 7, 2026)
- COPPA Rule, 16 CFR Part 312: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 (checked Nov 7, 2026)
- NY Child Data Protection Act, General Business Law § 899-ee and following (effective June 20, 2025): https://www.nysenate.gov/legislation/laws/GBS/899-EE (checked Nov 7, 2026)
- FERPA regulations, 34 CFR Part 99 (school official exception, § 99.31(a)(1)(i)(B)): https://www.law.cornell.edu/cfr/text/34/99.31 (checked Nov 7, 2026)
- New York Education Law § 2-d: https://www.nysenate.gov/legislation/laws/EDN/2-D (checked Nov 7, 2026)
Questions about this document: use the Contact page; we answer in writing. We post every change on this page with a new date.