Privacy Policy

Verge Initiatives (“we”) operates Verge Initiatives and is responsible for the information described here.

We deliberately collect as little as possible:

• During the initial under-13 consent request, only the child’s first name and the parent or guardian’s email address are retained. The entered birthdate is used to decide whether consent is required and is not retained at that stage.
• After parental approval, the child’s first and last name, date of birth, and username.
• The parent or guardian’s email address, used for consent, confirmation, account management, and important privacy notices.
• For members 13–18, the member’s own email address. Members under 13 have no email on file and sign in with a username instead.
• A password, stored only in irreversibly hashed form.
• Program records: age-matched group assignment, one-way announcements read, submitted drawings or written assignments, Ambassador feedback, milestone checks, and basic activity such as the last sign-in date.

We do not collect addresses, phone numbers, precise location, or photographs of members outside a drawing they intentionally submit, and we do not use advertising, behavioral profiling, or third-party analytics trackers.

Information is used only to run the program: to place members in age-matched groups, deliver age-appropriate curriculum, authenticate accounts, let an assigned adult Ambassador review submitted work, measure program participation, secure the service, and comply with legal obligations. We do not condition participation on providing information that is unnecessary for these purposes.

We do not sell children’s information or disclose it for targeted advertising. Access inside the program is limited by role: the member sees their own information; an assigned Ambassador sees the member’s group and submitted work; authorized administrators operate the program.

Supabase processes database, authentication, and private file data; Vercel hosts the application; and the configured transactional email provider delivers consent and account messages. These providers process information for us to operate the service, not for their own advertising. We assess their confidentiality and security terms before production use.

For members under 13, no child account is created until a parent or guardian receives our direct notice and approves. Because the launch service does not disclose children’s information to other users or for advertising, we use the “email plus” method: an approval email followed by a confirmation email. The confirmation explains how to review data, stop further collection, withdraw consent, or delete the account.

There is no direct messaging between children on Verge. Members do not contact one another; a member’s submitted work is visible only to them and their assigned adult Ambassador, never to other members.

At any time you may review the information we hold about your child, reset their password, stop further collection by withdrawing consent, or delete their account and associated data. Use the private management link in the confirmation email, or contact info@vergeinitiatives.org. Deletion removes the authentication account, profile, consent link, program records, submissions, and private uploaded files.

An unapproved consent request is deleted when its approval link expires and no later than 30 days after the request. Expired password-reset records are deleted after their two-hour validity period. Active child accounts are retained while used for the program and are automatically deleted after 365 days without account activity. A parent-requested deletion is processed immediately. Routine deletions run daily, subject to the hosting scheduler’s execution window.

Access is restricted by role, passwords are stored hashed, uploaded work is kept in private storage, and the site enforces a strict content-security policy. No system is perfectly secure, but we design for the safety of a young audience first.

If we materially change how we collect, use, or disclose information covered by an existing consent, we will send a new direct notice and obtain fresh parental consent before applying that change. Previous notice versions remain recorded with the corresponding consent.