Privacy Policy

Effective Date: March 21, 2026 · Last Updated: March 21, 2026

KidStocks (“we,” “our,” or “us”) operates a mobile application and related services (collectively, the “Service”) that allow adults to gift stocks to children. We are committed to protecting the privacy of our users, including parents, guardians, and especially children under the age of 18.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information. By using KidStocks, you agree to the practices described in this policy.

KidStocks is a US-based service. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States.

1. Information We Collect

1.1 Information Provided by Adults (Parents/Guardians)

When you create an account or use our Service, we may collect:

• Account Information: Full legal name, email address, phone number, date of birth, and mailing address.
• Identity Verification Information: Social Security Number (SSN) or Tax Identification Number (TIN), government-issued photo ID, and other information required to verify your identity and comply with federal “Know Your Customer” (KYC) and anti-money laundering (AML) regulations.
• Financial Information: Bank account numbers, routing numbers, and other banking details needed to fund stock purchases.
• Payment Information: Credit or debit card details processed through our payment provider, Stripe.
• Beneficiary Designation Information: Details you provide about the child recipient, including the child’s full legal name, date of birth, SSN (required for custodial brokerage account creation), and relationship to the adult account holder.

1.2 Information Collected from or About Children

KidStocks collects limited information about children under 18 strictly as required to open and maintain custodial brokerage accounts in compliance with securities regulations. This includes:

• Full legal name
• Date of birth
• Social Security Number (SSN)

1.3 Information Collected Automatically

When you use the Service, we may automatically collect:

• Device Information: Device type, operating system, unique device identifiers, and mobile network information.
• Usage Data: Pages and screens viewed, actions taken, time spent on screens, and feature usage patterns.
• Log Data: IP address, access times, app crashes, and system activity.
• Location Data: General location based on IP address (we do not collect precise geolocation).

1.4 Information from AI-Powered Features

KidStocks offers AI-powered learning and tutoring features designed to help children learn about investing and financial literacy. When these features are used:

• We collect interaction data such as questions asked and topics explored.
• We use this data to personalize the learning experience and improve our educational content.
• We do not use children’s AI interaction data for advertising or marketing purposes.
• AI interaction data is processed in accordance with COPPA requirements.

2. How We Use Your Information

3. How We Share Your Information

We do not sell your personal information.

3.1 Brokerage Services — Alpaca Markets, Inc.

To facilitate stock gifting and custodial brokerage account management, we share necessary personal and financial information with Alpaca Markets, Inc. (“Alpaca”), our registered broker-dealer partner. This includes names, dates of birth, SSNs, and other information required to open and maintain brokerage accounts. Alpaca’s use of this data is governed by Alpaca’s Privacy Policy.

3.2 Payment Processing — Stripe, Inc.

We use Stripe, Inc. (“Stripe”) to process payments. When you make a payment, your payment card details are transmitted directly to Stripe and are not stored on our servers. Stripe’s handling of payment data is governed by Stripe’s Privacy Policy.

3.3 Infrastructure and Data Storage

We use Neon (PostgreSQL cloud database) to store user data. All data stored in our database is encrypted at rest and in transit.

3.4 Other Disclosures

We may also share your information:

• With your consent: When you direct us to share information with a third party.
• For legal compliance: When required by law, regulation, legal process, or governmental request, including tax reporting to the IRS.
• To protect rights and safety: When we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
• In business transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets, in which case you will be notified of any change in ownership or use of your personal information.
• With service providers: With third-party vendors who perform services on our behalf, bound by contractual obligations to keep your information confidential.

4. Data Security

We implement robust technical and organizational measures to protect your personal information:

• Encryption at Rest: All sensitive personal data, including SSNs and financial information, is encrypted using industry-standard AES-256 encryption.
• Encryption in Transit: All data transmitted between your device and our servers is protected using TLS 1.2 or higher.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with role-based access controls and multi-factor authentication.
• Secure Storage of SSNs: Social Security Numbers are stored using tokenization and/or strong encryption. Raw SSNs are never stored in plaintext.
• Regular Audits: We conduct periodic security assessments and vulnerability testing of our systems.
• Incident Response: We maintain an incident response plan and will notify you and relevant authorities in the event of a data breach as required by applicable law.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

• Account and identity data: Retained for the life of the account plus 5 years after account closure, as required by securities and financial regulations.
• Transaction records: Retained for at least 7 years after the transaction, as required by tax and financial regulations.
• KYC/AML records: Retained for at least 5 years after account closure, as required by the Bank Secrecy Act and FinCEN regulations.
• AI interaction data: Retained for up to 2 years to improve educational features, then anonymized or deleted.
• Usage and analytics data: Retained in anonymized form for analytical purposes.

When data is no longer required, we securely delete or anonymize it.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request your data in a structured, machine-readable format.
• Opt-Out of Communications: Unsubscribe from marketing emails at any time. Transactional and legal communications cannot be opted out of.
• Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

For California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at support@kidstocks.com. We will respond to verified requests within 30 days.

7. Children’s Privacy and COPPA Compliance

7.1 Parental Consent

• We do not collect personal information from children under 13 without verified parental consent.
• For children ages 13–17, we collect information only as provided by and authorized by a parent or legal guardian.
• All child accounts are custodial accounts managed by an adult parent or legal guardian.

7.2 Verifiable Parental Consent

Before collecting any personal information about a child, we obtain verifiable parental consent through one or more of the following methods:

• Requiring the parent/guardian to provide their own verified identity first.
• Signed consent forms submitted electronically.
• Credit card verification or other monetary transaction as a form of identity verification.

7.3 What We Collect About Children

We collect only the minimum information necessary:

• Full legal name
• Date of birth
• Social Security Number (SSN)
• Profile photo URL (optional): if a parent uploads a profile photo for a child, we store a URL pointing to that image. The image is stored in our secure cloud storage (Cloudflare R2) and is accessible only to the parent’s account. Photos are not shared with third parties and may be deleted at any time by contacting us.
• AI learning interaction data (for personalized educational content)

7.4 How We Use Children’s Information

Children’s information is used exclusively for:

• Opening and maintaining custodial brokerage accounts as required by law.
• Providing age-appropriate AI-powered educational features.
• Complying with legal and regulatory obligations.

We do not use children’s information for advertising, marketing, behavioral profiling, or sharing with third parties for their own marketing purposes.

7.5 Parental Rights Under COPPA

Parents and guardians have the right to:

• Review the personal information we have collected about their child.
• Request deletion of their child’s personal information (subject to regulatory retention requirements).
• Refuse further collection of their child’s information, which may require closure of the child’s custodial account.
• Withdraw consent at any time.

To exercise these rights, contact us at support@kidstocks.com with “COPPA Request” in the subject line.

7.6 Children’s Access to the App

Where children are given access to the app (e.g., to use educational or portfolio-viewing features), they interact only with age-appropriate content. Children cannot execute financial transactions; all transactions require adult authorization.

8. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy in the app and on our website.
• Sending an email to the address associated with your account.
• Displaying an in-app notification.

The “Last Updated” date at the top of this policy indicates when changes were last made. Continued use of the Service after changes constitutes acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

11. Regulatory Disclosures

• Brokerage services are provided by Alpaca Markets, Inc., a registered broker-dealer and member of FINRA/SIPC.
• KidStocks is not a registered broker-dealer or investment adviser. We facilitate stock gifting through our partnership with Alpaca.
• Securities in custodial accounts are protected by SIPC up to applicable limits.
• Investments involve risk, including the possible loss of principal.