Privacy Policy

Cardinea is a family business in Victoria, British Columbia, Canada. If you have a question about your privacy, write to us at Robert@cardinea.ai.

• Nothing is collected from a child. Kids have no login, no email, and no way to message anyone.
• The parent holds the account and provides the little we hold about the reader.
• Card details never touch us. Payment is handled by Stripe.
• We never sell or rent your information, and never use it for advertising.

Accounts belong to parents and guardians who are at least 18 years old, in the United States or Canada. A child is a record on a parent account, never a user.

From your child, nothing. Browsing needs no account, and a child never signs in or gives us any information.

About your child, only what you enter: a first name or nickname, an age band (8 to 12, or 12 to 15), whether the box is for a boy or a girl, and an optional short note about what they love to read. We do not ask for a last name, a birthdate, a school, a location, or a photo.

About you, the parent: your email, your name, and your shipping address, so we can bill you and ship the box.

Payment: handled by Stripe on a page Stripe hosts. We never see or store your card number.

Basic technical information: to keep the site working and secure we process things like your IP address, and we read the country your request comes from to show the right currency. We do not use advertising trackers.

We use your information only to run the subscription: to curate and ship each box, to bill you, to send you service email such as a shipping note, and to keep the service secure. That is the whole list.

Cardinea is designed so that no personal information is collected directly from a child, in keeping with the Children's Online Privacy Protection Act. The parent provides the limited reader details above and consents to them by setting up the subscription. As the parent you can review, change, or delete your child's information at any time from your account or by writing to us.

We share information only with the service providers we need to run Cardinea, and only so they can do that job: Stripe for payments, Resend for service email, Supabase for our secure database, and Vercel for hosting. They are bound to protect it.

We never sell or rent your information, and never share it for advertising. We may disclose information if the law requires it.

There is no messaging anywhere on Cardinea. No other family ever sees your name, your email, your address, or anything about your child. A subscriber and a curator can never contact one another.

Information travels over an encrypted connection, access is limited, and every table in our database uses row level security, so one family's information is never visible to another.

We keep your information while your account is active. You can delete your account or a child profile at any time from your account or by writing to us, and we will delete it within a reasonable time, except where we must keep a limited record to meet a legal obligation such as tax records of payments.

You can ask to see, correct, or delete the information we hold about you and your child. Depending on where you live, including under Canada's personal information law and various United States state laws, you may have additional rights. To make any request, email Robert@cardinea.ai.

Cardinea serves the United States and Canada, and our providers may process information in either country. By using Cardinea you understand your information may be handled in both.

If we change this policy we will post the new version here with a new date, and for a meaningful change we will let account holders know by email.

Cardinea, Victoria, British Columbia, Canada. Robert@cardinea.ai