RikRak Privacy Policy

Effective Date: April 2, 2026 | Last Updated: April 2, 2026

Introduction

This Privacy Policy explains how Yardstick Inc. ("we," "us," or "our"), a Washington State company, collects, uses, and protects information through our AI-powered tutoring platform, RikRak, available at rikrak.ai.

RikRak is designed for middle school and high school students. Because many of our users are children, we take privacy seriously — particularly the privacy of users under 13. This policy is written in plain English so that parents, guardians, and students can understand what data we collect, why we collect it, and what control they have over it.

If you have any questions after reading this policy, contact us at privacy@yardstick.team.

Who This Policy Applies To

RikRak is a US-only service. We serve three categories of users:

Children under 13. Under the Children’s Online Privacy Protection Act (COPPA), children under 13 cannot create their own accounts. During signup, RikRak uses a date-of-birth age gate to determine the user’s age. If the entered date of birth indicates the user is under 13, self-signup is blocked and the user is redirected to a parent signup flow. A session flag prevents going back and retrying with a different age. A parent or guardian must sign up and create a child profile on their behalf, completing our email-plus consent verification process before the child’s account is activated. See the “Age Verification” and “Children’s Privacy” sections below for details.

Teens aged 13–17. Teenagers may create their own RikRak accounts. During signup, teens are asked to provide a parent or guardian’s email address. RikRak sends the parent an email explaining what the service is, what data is collected, and giving them the ability to review, manage, or delete their teen’s account. The teen may begin using RikRak (up to the free tier session limit) while the parent is being notified. Parents can object and request account deletion at any time.

Adults 18 and older. Adults are subject to our standard Terms of Service and this Privacy Policy.

The minimum age to use RikRak in any capacity is 8 years old.

What Information We Collect

Information parents provide

When a parent or guardian creates an account, we collect:

Name — to identify the account holder.
Email address — to communicate about the account, send updates, and handle support requests.
Payment information — if you subscribe to a paid plan. Payment processing is handled by Stripe; we do not store your full credit card number on our servers.

Information provided about children

When a parent creates a child profile, we collect:

Child’s name — to personalize the tutoring experience.
Grade level — to tailor content to the appropriate difficulty.

Parents may also set up a PIN code for each child profile to prevent siblings from accessing each other’s profiles.

Information generated through use of the platform

As students use RikRak, the platform generates and collects tutoring-related data, including:

Session transcripts — records of interactions with the AI tutor.
Performance data — how the student performs on questions and exercises.
MAP score tracking — standardized assessment score tracking, if applicable.
Learning progress — which topics and skills the student has worked on and how far they’ve progressed.
Student interests — subjects and topics the student shows interest in, used to personalize the experience.
Skill mastery levels — how well the student has demonstrated understanding of specific skills.
Struggle patterns — the types of questions or concepts the student finds challenging.
Effective teaching approaches — which tutoring methods work best for the student.

All of this data is collected to provide and improve the tutoring experience. We do not collect more information than is reasonably necessary to deliver the service.

Important: free tier data collection. RikRak collects tutoring data — including session transcripts, performance data, and learning progress — for all users, including those on the free tier. A paid subscription is not required for data collection to occur. As a result, the consent and notification mechanisms described in this policy apply to all users, not just paying subscribers.

Cookies and analytics

We use Google Analytics to understand how people use RikRak — things like which pages are visited most, how long sessions last, and where users encounter issues. Google Analytics uses cookies to collect this information.

We have a cookie consent banner on our site. You can manage your cookie preferences through that banner at any time.

We do not currently use advertising pixels or tracking technologies for ad targeting. If we add advertising-related tracking in the future, we will update this policy and notify users before doing so.

How We Use Your Information

We use the information we collect for the following purposes:

To provide the tutoring service. This is the core reason we collect data. Session transcripts, performance data, learning progress, and related information are used to personalize tutoring, adapt to each student’s needs, and track their growth over time.

To manage accounts. Parent names, emails, and payment information are used to create and maintain accounts, process payments, and communicate about the service.

To improve RikRak. Aggregated and anonymized usage data helps us understand what’s working, what isn’t, and where we can improve the platform.

To communicate with you. We may send emails about account activity, service updates, or policy changes. We will not send marketing emails without your consent.

To comply with legal obligations. We may use or disclose information as required by law, such as in response to a valid legal process.

Automated Decision-Making

RikRak uses artificial intelligence to generate tutoring content, assess student understanding, adapt learning materials, and recommend areas for further study. These processes are automated and are not reviewed by human instructors in real time. The AI adapts its responses based on a student’s interactions within a session and across sessions over time. Users should understand that tutoring recommendations, performance assessments, and content adaptations are algorithmically generated and not the product of human judgment or professional evaluation.

AI Model Training

We do not use identifiable student data to train or fine-tune AI models. Student data is transmitted to our AI providers solely to generate tutoring responses in real time, and our providers are contractually prohibited from using that data for model training. We may use anonymized and aggregated data, from which all personally identifiable information has been removed, to improve our AI tutoring technology. For children under 13, we apply additional safeguards as described in the Children’s Privacy section below.

How We Share Your Information

We do not sell your data. We will never sell your data. This applies to data from all users, including children.

We do not share your data for advertising purposes. We do not currently use ad pixels or share data with advertising networks.

We share data only with the technology vendors (“data processors”) necessary to operate RikRak. These vendors are contractually required to protect your data and may only use it to provide their services to us:

| | | | -------------------- | ----------------------------------- | | Vendor | Purpose | | Supabase | Database and hosting infrastructure | | Anthropic | AI tutoring (primary AI provider) | | Vercel | Web hosting | | Stripe | Payment processing | | Resend | Transactional email delivery | | Google Analytics | Website analytics |

We may add additional service providers in the future. When we do, we will update this policy accordingly.

Your data may be processed in the United States and other countries where our service providers operate. By using RikRak, you consent to the transfer and processing of your data in these locations.

We may also disclose information if required by law, to protect the safety of our users, or to enforce our Terms of Service.

Age Verification

RikRak is committed to not knowingly collecting personal information from children under 13 without verified parental consent. To enforce this, we use a date-of-birth age gate during account signup — not a simple “are you over 13?” checkbox.

When a new user begins the signup process, they are asked to enter their date of birth. Based on that date:

Under 13: Self-signup is blocked. The user is redirected to a parent signup flow, where a parent or guardian must create an account and complete our parental consent verification process (described below) before any child profile is activated. A session flag prevents going back and retrying with a different date of birth.
Ages 13–17: The user may proceed with signup but is asked to provide a parent or guardian’s email address. The parent is notified and given controls over the teen’s account.
18 and older: Standard adult signup applies.

No tutoring data is collected from a child under 13 until a parent has completed the consent process. For teens 13–17, tutoring data collection begins when the teen starts using the service, and the parent is notified concurrently.

Children’s Privacy (COPPA Compliance)

We are committed to complying with the Children’s Online Privacy Protection Act (COPPA). This section explains how we handle the data of children under 13.

Parental consent (email-plus verification)

Children under 13 cannot create their own RikRak accounts. A parent or guardian must:

Create their own parent account.
Initiate creation of a child profile within their account.
Complete our email-plus consent verification process.

During step 2, the parent is shown a clear consent screen that lists the specific categories of data RikRak will collect about their child (name, grade level, session transcripts, performance data, learning progress, skill mastery levels, struggle patterns, and effective teaching approaches). The parent must affirmatively consent to this data collection.

To verify consent, we use an “email-plus” method: after the parent provides consent on-screen, we send a confirmation email to the parent’s verified email address. The parent must click a verification link in that email to activate the child’s profile. No data is collected from the child until this verification step is complete.

A payment card is not required for parental consent. Because RikRak does not share children’s data with third parties (beyond the service providers necessary to operate the platform), the email-plus method provides appropriate verification under COPPA.

What we collect from children under 13

We collect only the information reasonably necessary to provide the tutoring service:

Child’s name and grade level (provided by the parent).
Tutoring data generated through use of the platform (session transcripts, performance data, learning progress, skill mastery, struggle patterns, and effective teaching approaches).

We do not collect more information from children than is necessary to provide the AI tutoring service.

Parental rights

Parents and guardians of children under 13 have the right to:

Review their child’s personal information at any time through their account dashboard.
Delete their child’s personal information by contacting us or through account settings.
Refuse further collection of their child’s data by deleting the child’s profile or contacting us.
Manage their child’s account settings, including PIN codes and profile information.

To exercise any of these rights, log into your account or contact us at privacy@yardstick.team. We will respond to requests within 30 days.

No behavioral advertising for children

We do not serve behavioral advertising to any users, and we do not use children’s data for advertising purposes.

Teen Privacy (Ages 13–17)

Teenagers aged 13–17 may create their own RikRak accounts. During signup, teens are asked to provide a parent or guardian’s email address. Here is how we handle teen accounts:

Parent notification. When a teen signs up, RikRak sends an email to the parent or guardian at the address provided. This email explains what RikRak is, describes the data we collect (session transcripts, performance data, learning progress, and related tutoring data), and gives the parent a link to review, manage, or delete their teen’s account.

Immediate access with limits. The teen may begin using RikRak immediately after signup, with access to the free tier sessions while the parent is being notified. This allows the teen to experience the service while ensuring the parent has the opportunity to review and intervene.

Parental controls. Parents can review their teen’s data, manage account settings, or request account deletion at any time — either through the link in the notification email or by contacting us at privacy@yardstick.team. If a parent objects to their teen’s use of RikRak, we will honor the parent’s request and close the teen’s account and delete the associated data within 30 days.

Same protections. Teens’ data is subject to all of the same protections described in this policy, including our commitments not to sell data and not to share data for advertising purposes.

We encourage parents to stay involved in their teen’s use of RikRak and to review this policy with them.

Data Retention

Active accounts. We retain your data for as long as your account is active, plus two years after cancellation or account closure. This allows users to resubscribe and pick up where they left off without losing their learning history.

After the retention period. Two years after account cancellation, we will either anonymize or delete your personal data.

Deletion requests. Parents and users can request deletion of their data at any time. We honor deletion requests within 30 days. Once data is deleted, it cannot be recovered, and the learning history associated with that account will be permanently removed.

Resubscription. If you cancel your account and later decide to come back, your data will be available for up to two years after cancellation — unless you explicitly request deletion.

Data Security

We take reasonable administrative, technical, and physical measures to protect the personal information we collect. These measures include encryption of data in transit and at rest, access controls limiting who can view personal data, and regular review of our security practices.

That said, no method of electronic transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security.

Data Breach Notification

In the event of a security breach that results in unauthorized access to, or disclosure of, personal information, we will notify affected users in accordance with applicable state and federal law. Where required by law, we will provide notification as promptly as reasonably possible. If the breach involves children’s personal information, we will also notify the relevant parent or guardian account holder. We will take commercially reasonable steps to mitigate the effects of any breach and prevent future occurrences.

Your Privacy Rights

All users

All RikRak users have the right to:

Access the personal information we hold about them.
Request correction of inaccurate information.
Request deletion of their data.
Receive a copy of their data in a portable format upon request.

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to know. You can request that we disclose what personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to delete. You can request that we delete personal information we have collected from you, subject to certain exceptions.
Right to opt out of sale. We do not sell personal information, so this right does not currently apply — but we include it here for transparency.
Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@yardstick.team. We will verify your identity before processing your request and respond within 45 days as required by law.

Washington residents

If you are a Washington State resident, you may have additional rights under the Washington Privacy Act and related state privacy legislation. These rights may include the right to access, correct, and delete your personal data, as well as the right to obtain a copy of your data in a portable format. To exercise any of these rights, contact us at privacy@yardstick.team.

Cookies and Tracking Technologies

RikRak uses cookies — small text files stored on your device — to help the platform function and to understand how it is used.

Cookies we use

Essential cookies. These are required for the platform to function properly, including maintaining your login session and remembering your preferences.

Analytics cookies. We use Google Analytics to collect aggregated data about how RikRak is used. Google Analytics cookies help us understand things like page views, session duration, and general usage patterns. This data is not used to identify individual users.

Managing cookies

When you first visit RikRak, a cookie consent banner will ask for your preferences. You can update your cookie preferences at any time through the banner or your browser settings. Note that disabling essential cookies may affect the functionality of the platform.

Advertising cookies

We do not currently use advertising cookies or tracking pixels. If this changes in the future, we will update this policy, notify users, and update our cookie consent banner accordingly.

Do Not Track

RikRak does not currently respond to “Do Not Track” browser signals. We do not track users across third-party websites.

Third-Party Links

RikRak may occasionally contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any external sites you visit.

Changes to This Policy

We may update this privacy policy from time to time. When we do:

We will update the “Last Updated” date at the top of this policy.
For material changes, we will notify account holders by email before the changes take effect.
For changes that affect how we handle children’s data, we will seek renewed parental consent where required by COPPA.

We encourage you to review this policy periodically.

How to Contact Us

If you have questions about this privacy policy, your data, or your privacy rights, contact us:

Yardstick Inc.

720 Seneca St, Ste 107, #927

Seattle, WA 98101

Phone: (206) 426-2420

Email: privacy@yardstick.team

We aim to respond to all privacy-related inquiries within 30 days.