Children's Privacy Policy

Our Commitment to Children's Privacy

Capital City is a Canadian company committed to protecting the privacy of children online. We fully comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws designed to protect children's personal information.

This statement explains how we collect, use, and protect children's information and what rights parents have regarding their children's personal data.

Canadian Privacy Laws and Children

In Canada, children's privacy is protected by:

• PIPEDA (Federal): Canada's federal private sector privacy law that sets ground rules for how businesses must handle personal information, including children's information
• Provincial Laws: Some provinces have additional privacy protections (e.g., PIPA in BC and Alberta)
• CASL: Canada's Anti-Spam Legislation regulates electronic communications
• OPC Guidance: The Office of the Privacy Commissioner provides guidance on protecting children's privacy online

Under Canadian law, organizations must obtain meaningful consent before collecting, using, or disclosing personal information. For children under 13, we obtain this consent from parents or guardians.

Information We Collect from Children Under 13

Capital City is designed for children ages 6-15. For children under 13, we only collect information that is reasonably necessary to provide the educational service:

Required Information:

• Username: A child-chosen username (not their real name)
• Parent's Email: To obtain consent and communicate about the account
• Password: Securely hashed for account access

Automatically Collected Information:

• Game Progress: Districts completed, coins earned, Financial IQ score
• Quiz Answers: To track learning progress
• Avatar Selection: Character customization choices
• Login Sessions: To keep the child logged in securely
• Device Information: Browser type and screen size (for optimal display only)

What We Do NOT Collect:

• Child's real name
• Child's address or phone number
• Child's email address
• Social insurance number or other government IDs
• Photos or videos of the child
• Precise geolocation information
• Audio recordings

How We Obtain Parental Consent

Under PIPEDA, we must obtain meaningful consent from parents before collecting personal information from children under 13. Our process:

1. Initial Notification: When a child attempts to create an account, we require a parent's email address.
2. Consent Request: We send an email to the parent explaining:
   • What information will be collected
   • Why we need the information
   • How it will be used and shared
   • How parents can access, correct, or delete the information
   • How to withdraw consent
3. Consent Verification: Parents must actively provide consent by:
   • Clicking a consent link in the email
   • Creating their own parent account with payment information
4. Account Activation: The child's account is only activated after parental consent is received.

How We Use Children's Information

We only use children's personal information for purposes identified at the time of collection:

• Provide the Service: Enable gameplay, track progress, save achievements
• Improve Learning: Analyze which districts are effective and identify areas for improvement
• Parent Communication: Send progress updates to parents via email
• Safety & Security: Protect against unauthorized access and maintain account security
• Legal Compliance: Comply with legal obligations when required by Canadian law

How We Share Children's Information

We do NOT sell, rent, or share children's personal information with third parties for marketing purposes. EVER.

We only share children's information in these limited circumstances:

Service Providers (with Privacy-Compliant Contracts):

• Hosting Services: Secure servers that store account data (Canadian or privacy-compliant providers)
• Payment Processors: Stripe for subscription billing (parent accounts only)
• Email Services: For sending parent notifications only

All service providers are contractually required to:

• Keep information confidential
• Use it only for providing our service
• Comply with Canadian privacy laws
• Delete information when no longer needed

Legal Requirements:

We may disclose children's information if:

• Required by Canadian law, court order, or legal process
• Necessary to protect the safety of a child or others
• Needed to protect the security or integrity of our service

Parental Rights Under Canadian Law

Under PIPEDA and provincial privacy laws, parents have the following rights:

Data Security for Children

We take extra precautions to protect children's information:

• Encryption: All data transmitted using SSL/TLS encryption (HTTPS)
• Secure Storage: Data stored on secure servers in Canada (where possible)
• Access Controls: Strict limits on who can access children's data
• Password Protection: Passwords hashed using industry-standard bcrypt
• Regular Audits: Security assessments and penetration testing
• Employee Training: All staff trained on privacy compliance and data protection

Data Retention for Children

We retain children's personal information only as long as necessary for identified purposes:

• Active Accounts: Retained while account is active and subscription is valid
• Inactive Accounts: After 90 days of inactivity, we send reminder to parent
• Cancelled Accounts: Most data deleted within 30 days of cancellation
• Backup Systems: Backup copies deleted within 90 days
• Legal Requirements: Some data may be retained if required by Canadian law

No Conditioning of Service

We do not require a child to provide more personal information than is reasonably necessary to participate in Capital City. We collect only what is needed for the educational service, and we never condition participation on disclosure of more information than required.

No Advertising or Marketing to Children

Capital City does not:

• Display third-party advertisements to children
• Use children's information for targeted advertising
• Build behavioral profiles of children for marketing
• Share children's information with advertisers
• Send marketing emails to children (all communications go to parents)

Changes to This Policy

If we make material changes to how we collect, use, or share children's personal information, we will:

• Update the "Last Updated" date at the top of this statement
• Send email notification to all parents of affected children
• Obtain new parental consent if required by law
• Provide parents the opportunity to opt-out of new practices

Contact the Privacy Commissioner

If you have questions or concerns about our privacy practices, you may contact:

Contact Us

For any questions, concerns, or requests related to children's privacy: