Privacy Policy

1. Who This Policy Covers

This policy applies to all visitors to zafari.com and all users of ZAFARI Trek, including parents, guardians, and the children whose progress is tracked on the platform. We operate under US federal law (COPPA), European Union law (GDPR), and California law (CCPA/CPRA), among others.

2. Children Under 13 — COPPA Compliance

ZAFARI Trek currently offers Seedlings for ages 3–4 and Explorers for ages 5–6. These children are under 13, so we apply the protections required by the Children's Online Privacy Protection Act (COPPA).

Verifiable Parental Consent (VPC)

We do not collect any personal data about a child until a parent or guardian has given parental consent. A parent creates the family account and reviews this notice before creating a child profile. During the limited free beta, no payment is required. If the parent later purchases paid access, Stripe processes the billing information.

What we collect about your child

• A first name or nickname (optional — your child can be completely anonymous)
• Age group: Seedlings (3–4) or Explorers (5–6)
• Preset avatar selections and the resulting private illustrated character sheet
• Mission and skill completion, time spent, and support or hints used
• Earned stickers, mural additions, coloring pages, and other milestone rewards

What we never collect about your child

• Real full name
• Location data or GPS coordinates
• Device identifiers, IP addresses tied to the child, or browser fingerprints
• Photographs, voice recordings, or video
• Child-entered text or open-ended avatar prompts
• Behavioral tracking data or click-path analytics
• Any information used for advertising or profiling

Parent rights under COPPA

• Access / Review: You may review all personal information we have collected about your child at any time by logging into your dashboard and using the "Download my data" button.
• Correct: You may update your child's display name at any time using the "Edit child name" button in your dashboard.
• Delete: You may permanently delete all of your child's data at any time using the "Delete all progress data" button in your dashboard. Deletion is immediate and irreversible.
• Withdraw consent: You may withdraw parental consent at any time by deleting your child's data and canceling your subscription. Email us at info@persistenceofvision.com if you need assistance.
• Refuse further collection: You may refuse to allow us to collect further information by deleting your account.

3. AI-Generated Avatars & Coloring Pages

ZAFARI Trek may use an AI image service to create your child's illustrated avatar. It receives only preset appearance options selected in the avatar builder. No child photo, audio, name, email address, or child-entered text is provided.

The same private illustrated avatar may be placed into an approved black-and-white ZAFARI scene for a child's earned coloring page. The child does not write the prompt or choose an open-ended scene. ZAFARI selects the lesson topic and an approved scene template, and sends the finished two-page PDF only to the parent's email address.

Approved avatar sheets and coloring pages are retained while the child profile is active and are included in parent data export and deletion. Failed, rejected, and superseded generated assets are scheduled for deletion within 30 days.

ZAFARI requires its image-service provider not to use these inputs or outputs to train models, for advertising, or for unrelated secondary purposes, and to avoid unnecessary retention.

4. Data We Collect from Parents & Guardians

Payment information is processed and stored by Stripe. We never store raw card numbers in our database. We store only the Stripe Customer ID (a non-sensitive reference).

5. Cookies & Local Storage

We use a single session cookie managed by Supabase to keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies on any page where children's learning content is served.

On the public marketing site (zafari.com), we use a minimal first-party cookie consent preference stored in localStorage. No data from this preference is shared with third parties.

On the public marketing site we also use Vercel Web Analytics, a privacy-first, cookieless measurement tool. It sets no cookies and stores no persistent identifiers, and it performs no cross-site tracking. It records only aggregate page-visit counts — which page was viewed, the general referral source, country, and device type (mobile, desktop, or tablet) — which we use solely for our own internal audience measurement, never for advertising or to build a profile of any individual. We do not run Vercel Web Analytics, or any other behavioral measurement tool, on ZAFARI Trek or any other children's learning pages.

6. Data Retention & Automatic Deletion

We retain parent account data for as long as the account is active. We retain child progress data (mission and skill completion, time, support used, and earned rewards) according to the following rules:

• Active accounts: Data is retained for the duration of the subscription.
• Inactivity purge: If a child's account shows no lesson activity for 12 consecutive months, all of that child's progress data is automatically and permanently deleted from our production database. Parents are not required to take any action — this happens automatically.
• Manual deletion: You can delete all data at any time from your dashboard, regardless of the inactivity window.
• Account deletion: Deleting your parent account permanently deletes all associated child profiles, progress data, and rewards. This is immediate and irreversible.

7. No Targeted Advertising to Children

We do not serve targeted advertising of any kind on ZAFARI Trek. We do not build advertising profiles of children or teens. We do not share child data with advertisers, data brokers, or marketing platforms. This is a hard line — not a policy we will change.

Trek limits new mission access to support responsible screen time. Stickers, mural additions, coloring pages, and other rewards recognize completed learning; we do not use streaks or XP to pressure children to remain on screen.

8. Sub-Processors & Third Parties

We use the following third-party services that may process personal data on our behalf. Each has signed a Data Processing Agreement (DPA) with us:

We do not use Google Analytics, Meta Pixel, or any behavioral analytics platform on ZAFARI Trek pages. The cookieless, aggregate-only measurement described in Section 5 runs on the public marketing site only and is expressly excluded from ZAFARI Trek and all children’s learning pages.

9. International Data Transfers

Our infrastructure is based in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data is transferred to the US under the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs), which our sub-processors have adopted.

10. Your Rights Under GDPR (EU/EEA Users)

If you are in the EU/EEA, you have the following rights:

• Access (Art. 15): Request a copy of all data we hold about you and your child. Use the "Download data" button in your dashboard.
• Rectification (Art. 16): Correct inaccurate data by updating your profile or contacting us.
• Erasure (Art. 17): Delete all data using the "Delete all progress data" button or by deleting your account. Requests are fulfilled immediately.
• Portability (Art. 20): Download your data in machine-readable JSON format from your dashboard.
• Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Object (Art. 21): Object to processing based on legitimate interests.
• Withdraw consent: Withdraw parental consent at any time — see Section 2.

To exercise any right, email info@persistenceofvision.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of categories and specific pieces of personal information we collect.
• Right to delete: Request deletion of your personal information (and your child's), subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To submit a CCPA request, email info@persistenceofvision.com with the subject line "California Privacy Request."

12. Security

All data is encrypted in transit using TLS 1.2+. Data at rest is encrypted using AES-256 by our hosting provider (Supabase/AWS). We use Row Level Security (RLS) in our database, ensuring that parents can only access their own family's data — no account can see another's records. We conduct security reviews annually.

13. Contact & DPO

For any privacy question, data request, or COPPA/GDPR concern, contact us at:

We aim to respond to all privacy requests within 30 days.

14. Changes to This Policy

If we make material changes to this policy, we will notify parents by email at least 30 days before the changes take effect. We will also update the effective date at the top of this page. Continued use of ZAFARI Trek after changes take effect constitutes acceptance of the revised policy.