Children's privacy is at the heart of everything we build. Here's exactly how we protect it.
Last updated: August 13, 2026 · Effective date: August 13, 2026
The short version for parents: Krissy Banx is built for children and follows the U.S. Children's Online Privacy Protection Act (COPPA). A parent or guardian creates the account and gives verifiable consent before any child data exists. We collect as little information as possible, we never show ads to children, we use no analytics or tracking SDKs, we never sell personal information, and you can review or delete your child's data at any time.
Krissy Banx ("Krissy Banx," "we," "us," or "our") provides a financial-literacy platform for children. Our Services include our mobile app (iOS and Android), our kid web app, this marketing and information website, our online shop for physical products (savings kits and boxes, tees, cards, and our book), and school workshops (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use and protect it, and the rights that children, parents, guardians, and schools have.
The best way to reach us about privacy is by email at Krissybanxsc@gmail.com. This Policy applies to all of our Services. Because our Services are directed to children under 13, we have designed them to comply with COPPA and other applicable children's privacy laws.
Krissy Banx is intended for use by children with the involvement of a parent or guardian. We comply with the Children's Online Privacy Protection Act (COPPA) and its implementing regulations (16 C.F.R. Part 312). In practice, this means:
Before a child can create a profile or use the app's personalized features, a parent or guardian must verify their identity and provide consent. Our onboarding includes a "COPPA firewall": the child's experience is gated until a guardian completes consent.
If we learn that we have collected personal information from a child without the required parental consent, we will delete that information promptly.
The guardian sets up the account first; children are added by the guardian after consent. Here is exactly what we collect.
Uploading a profile photo is entirely optional. When a photo is uploaded, it is stored in our own private object-storage bucket on Cloudflare R2 (bucket krissy-banx). Photos are used only to display the profile inside the app; they are not shared, sold, or used for any other purpose, and they are deleted from R2 when the profile or account is deleted.
If you allow notifications, we store a push-notification token so we can deliver messages (for example, savings reminders or a note that a child requested help). Delivery is handled by Expo's push service, which relays through Apple (APNs) on iOS and Google (FCM) on Android. You can turn notifications off at any time in your device settings.
When you buy a physical product, we collect your order details, plus the shipping name and address needed to fulfill and deliver it. Payment is processed by Stripe: your card is entered directly with Stripe and we never see or store full card numbers. To quote real carrier shipping rates and print labels, the shipping address is sent to our shipping-rate provider (EasyPost or Shippo).
What we do not collect from children: we do not require precise geolocation, we do not enable open chat or public usernames, we do not use advertising identifiers, and we do not request contact information from children beyond what is described above. Any tips ("tattles") a child shares are limited to a curated library of pre-approved options; free-text suggestions are reviewed by our team and are never shown to other children unless approved, so children are not exposed to unmoderated user-generated content.
We do not use children's personal information to build advertising profiles or to make automated decisions that produce legal or similarly significant effects.
Krissy Banx contains no third-party advertising directed at children and no behavioral ad tracking. We do not embed third-party analytics, advertising, or tracking SDKs in the app or on this site. We do not sell or rent personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws. The only third parties that ever receive personal information are the operational service providers listed in Section 7, each acting on our instructions to help run the Services.
We share personal information only in these limited situations:
When Krissy Banx is used in schools, we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), under the direction and control of the school.
Parents and guardians can, at any time:
Depending on where you live, you may have additional rights under laws such as the GDPR or U.S. state privacy laws (for example, to access, port, correct, or delete personal information, and to appeal a decision). We honor these requests and do not discriminate against you for exercising them. To make a request, contact Krissybanxsc@gmail.com.
You can delete data at any time, in the app or by email:
We verify the request and complete deletion within 30 days (usually much sooner), except where we must retain limited records to comply with law (such as order/transaction records). See our Delete Account page for full details.
We use technical and organizational safeguards appropriate to the sensitivity of children's data, including encryption in transit, access controls, PIN-protected child profiles with lockout after repeated failed attempts, and routine review of our security practices. No system is perfectly secure, but protecting children's information is our top priority.
We keep personal information only as long as needed to provide the Services and for the purposes described here. When an account is deleted or a school term ends, we delete or de-identify the associated personal information, except limited records required for legal, accounting, or security purposes.
Krissy Banx is operated from the United States, and information is processed and stored in the U.S. Some of our service providers (such as Cloudflare and Stripe) operate global networks and may process data in other regions on our behalf. If you access the Services from outside the U.S., you understand that your information will be processed in the U.S. under this Policy.
If we make material changes — especially any change in how we collect, use, or disclose children's personal information — we will notify parents/guardians and, where required, obtain new consent before applying the change to previously collected data. The "Last updated" date above shows when this Policy last changed.
Questions or privacy requests? We're here to help:
The operator of the Services responsible for children's data under COPPA is Krissy Banx. We respond to verified parent and guardian requests promptly.