COPPA & FERPA

1. Overview

COPPA (the Children's Online Privacy Protection Act) regulates how online services collect information from children under 13 in the United States. FERPA (the Family Educational Rights and Privacy Act) governs the privacy of student education records held by schools and the providers schools work with.

Circles complies with both. The summary below tells you how.

2. Guardian consent

Children under 13 can only join Circles through a guardian. During onboarding we ask for the child's date of birth so we can determine their age, and we ask the guardian to consent to the child using Circles, including the data that will be collected. We record that consent along with the method used and a timestamp.

Today that consent is captured as an acknowledgement by the guardian during onboarding. We are actively strengthening this into a more robust verifiable-parental-consent process, and this page will be updated as that method rolls out.

Until consent is given, the child cannot post, message, or share information with people outside the household.

3. What we collect from children

For accounts of children under 13, we limit collection to what's needed to run the platform through their guardian: a display name, date of birth (used to derive age and apply age-based safety settings), the circles they have joined, the assignments they have submitted, and the messages they choose to send inside a circle.

If a child uses the Fez AI assistant, its responses are subject to extra guardrails, and the guardian can review and clear what it has remembered about the child.

• No advertising identifiers, ever.
• No analytics or advertising trackers on a minor's account; those run only after an adult accepts the cookie banner.
• No public profile fields enabled by default; a minor's data is masked on public surfaces.
• No messaging outside circles approved by the guardian.

4. Guardian rights

Guardians can review, export, correct, or delete their child's information at any time, including what the Fez AI assistant has remembered about the child. Deletion removes the child's data from our production systems and, in time, from backups as they cycle out.

Guardians can also decline to allow further collection while keeping the existing account, and can withdraw consent by deleting the child's account.

5. FERPA & schools

When a school operates a private circle on Circles for its students, the school is the controller of the education records and Circles is acting as a school official under FERPA's school official exception.

We use student records only for the purposes the school directs, do not sell them, and return or delete them at the end of the engagement.

6. Recordings & minors

Live classes can be recorded. Recording only begins after a consent step, and every participant sees a recording indicator while it is active. For any class involving a minor, a guardian's consent is required before recording can take place.

7. Service providers

We rely on a small set of vetted service providers, including hosting, payments (Stripe), email delivery, error tracking (Sentry), and live video (LiveKit). They are contractually bound to process information only to support Circles and not for any other purpose, and we do not enable advertising or analytics trackers on a child's account.

8. Contact us

COPPA and FERPA questions can be sent to hello@circles.app. School data processing agreements are available on request. If you believe a child has used Circles without proper guardian consent, contact us and we will look into it promptly.