Legal

Privacy Policy

Last updated: April 16, 2026 · Effective immediately

Parent Mindset is operated by Boost Innovation Inc. ("we," "us," "our"). This policy explains what we collect, why, how we use it, who we share it with, and the rights you have. By using the Service, you agree to the practices described here.

1. Who we are

Boost Innovation Inc.
Alberta, Canada
Contact: hello@boostinnovation.ca
Privacy inquiries: privacy@boostinnovation.ca

2. What we collect

Account information. Your email address and a hashed password (or magic-link token). Authentication is handled by Supabase.
Profile information. Your child's age range, sport(s), level of play, and the priorities and pain points you select during onboarding. We do not collect your child's name, photo, date of birth, or other identifying details.
Activity data. Articles you read, situations you open, pathways you start, reflections you save, bookmarks you add, streak status, XP, and badge progress. Used to personalize your experience and provide the Service.
Parent Guide conversations. Messages you send to and receive from the Parent Guide AI feature. Stored so you can review them and so we can improve the Service.
Subscription state. Your plan tier (free or premium), status, and renewal date. We do not see, receive, or store your credit card details. All payment data is handled directly by Stripe.
Product analytics events. Limited event-level data (page views, feature usage, conversion events) to understand how the Service is used.
Technical data. IP address, browser type, device type, timestamps, and referrer, automatically logged for security and debugging. Retained for up to 90 days.

3. What we do not collect

We do not use advertising cookies or trackers.
We do not allow third-party advertising networks on the Service.
We do not sell your personal information to anyone, for any purpose, ever.
We do not use your data to train artificial intelligence or machine learning models for any party.
We do not collect biometric information.
We do not collect geolocation beyond the country level inferred from IP.

4. How we use your information

We use the information we collect to:

Provide, maintain, and improve the Service;
Personalize your dashboard, daily insights, and recommendations;
Operate subscriptions, process billing, and send transactional emails;
Detect, prevent, and address fraud, abuse, security incidents, and illegal activity;
Comply with legal obligations;
With your consent, send product updates, tips, and feature announcements.

5. Legal basis (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your data under the following legal bases:

Contract (Article 6(1)(b)): to provide the Service you signed up for;
Legitimate interests (Article 6(1)(f)): to secure the Service, prevent abuse, and improve the product;
Consent (Article 6(1)(a)): where we request it (e.g. optional emails);
Legal obligation (Article 6(1)(c)): to comply with applicable law.

6. Who processes your data

We share data only with the following sub-processors, under data processing terms with each:

Supabase: authentication and database hosting.
Anthropic: powers the Parent Guide AI feature. Your messages to the Parent Guide are sent to Anthropic's API to generate responses. Anthropic's API does not use your data to train models, per their Commercial Terms.
Stripe: payment processing. PCI-DSS Level 1 certified.
Resend: transactional email delivery.
Railway and Vercel: infrastructure hosting.
Google Fonts: web-font delivery for UI rendering (no personal data shared).

We do not transfer your data to any other third party for their independent use. We may disclose data in response to a valid legal process (court order, subpoena, lawful government request) or to protect the rights, property, or safety of our users or the public.

7. Your rights

Regardless of your location, you have the right to:

Access the personal data we hold about you;
Correct inaccurate data;
Delete your account and all associated data (subject to legal retention obligations);
Export your reflections and profile in a portable format;
Object to or restrict certain processing;
Opt out of non-essential communications at any time.

To exercise any of these rights, email privacy@boostinnovation.ca. We respond within 30 days.

8. Notice to California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you additional rights:

Right to know what personal information we collect, the sources, the purposes of collection, and the categories of recipients;
Right to delete personal information we have collected;
Right to correct inaccurate personal information;
Right to opt out of sale or sharing: we do not sell or share personal information as defined by CCPA/CPRA, but you have the right to opt out regardless;
Right to non-discrimination for exercising these rights;
Right to limit use of sensitive personal information.

To exercise any of these rights, email privacy@boostinnovation.ca. We may need to verify your identity before fulfilling the request.

9. Children's privacy

Parent Mindset is not directed at, and is not intended for use by, anyone under the age of 18. Accounts must be held by adult parents, guardians, or caregivers.

We do not knowingly collect personal information from children under 13 (or under 16 in the European Economic Area). If we become aware that we have inadvertently collected personal information from a child, we will delete it promptly. If you believe a minor has created an account, please contact us at privacy@boostinnovation.ca.

Information about your child that you provide to the Service (such as age range and sport) is never paired with personally identifying details about the child. We collect the minimum necessary to personalize the parent's experience.

10. How long we keep your data

Active accounts. For as long as your account is active.
Closed accounts. Profile, reflections, bookmarks, progress, Parent Guide messages, and season plans are deleted within 30 days of account closure. Billing records are retained for seven (7) years as required by law.
Anonymized analytics. Aggregated, de-identified usage data may be retained indefinitely for product research and improvement.
Technical logs. Retained for up to 90 days.

11. Security

We use industry-standard security controls including encryption in transit (TLS 1.2+) and encryption at rest for user data. Authentication tokens are short-lived. Payment data is never stored on our servers. Row-level security is enabled on every user-owned table in our database.

No security measure is perfect. We will notify affected users in accordance with applicable law in the event of a personal data breach.

12. Cookies and local storage

We use strictly-necessary cookies and browser local storage to keep you signed in, remember your theme, and maintain anonymous analytics identifiers. We do not use advertising cookies, cross-site trackers, or third-party ad network pixels.

13. International data transfers

Your data may be processed and stored in countries outside your jurisdiction, including Canada and the United States. Where required by law, we implement appropriate safeguards (such as standard contractual clauses) to ensure your data receives adequate protection.

14. Automated decision-making and AI

The Parent Guide feature uses AI to generate responses to messages you send. This is assistive content. We do not use automated decision-making to make any decision that produces legal or similarly significant effects about you. Parent Guide outputs are generated for you upon request and are not used for any other purpose without your explicit consent.

15. Do Not Track

We currently do not respond to Do Not Track (DNT) browser signals, because there is no widely accepted standard for how to interpret them. Because we do not engage in cross-site tracking, this has no practical effect on your privacy in our Service.

16. Changes to this policy

If we make material changes to this policy, we will notify you by email and by posting a notice in the Service at least 14 days before they take effect. For non-material changes, we will update the "Last updated" date at the top of this page.

17. Complaints and authorities

If you believe we have violated your privacy rights, please contact us first at privacy@boostinnovation.ca. You also have the right to lodge a complaint with your local data protection authority, for example, the Office of the Privacy Commissioner of Canada, your local EU/UK supervisory authority, or the California Privacy Protection Agency.