iConfirm Children's Privacy Notice — v2
Reviewed — effective 2026-08-31
Effective date: 2026-08-31
This Notice supplements the iConfirm Privacy Policy. It explains how BIBS Specialty Services, Inc. ("iConfirm," "we," or "us") handles personal information from Students, including children under 13. If this Notice conflicts with the general Privacy Policy about children's information, this Notice controls to the extent of the conflict.
Our contact information
BIBS Specialty Services, Inc.
735 Scanlan Avenue
St. Louis, Missouri 63139
office@iconfirm.app
314-222-2777
Who may use a Student account
iConfirm is designed for United States church-confirmation students age 11 and older. Every Student account must be created and authorized by a Parent, regardless of whether the Student is younger or older than 13. We collect the Student's date of birth when the Parent creates the account, and use it only to check eligibility for the optional Discussion Board, which is limited to Students 13 and older; it is never shown to a Church Leader, never included in a roster or export, and not used for any other purpose. A Student enrolled before we began collecting it has none on file, and in that case the Parent supplies one only if they choose to opt that Student into the Board. The Parent also attests to the Student's eligibility and the Parent's authority.
Decided 2026-08-23; premise corrected 2026-08-31. New York, Colorado, and Montana treat a 13-17-year-old as capable of consenting for certain processing themselves. iConfirm asks every Student for their own assent, regardless of age, alongside this parental notice and consent. When this was decided iConfirm held no date of birth and could not tell which Students fell in that band; it now holds one, and the universal step is kept deliberately, because asking every Student is more protective than asking only the band a particular state names. The step is live: no Student account is fully active without both the Parent's consent described in this Notice and the Student's own assent.
Information collected from or about a Student
We may collect:
- real name and nickname;
- Parent and Church association;
- a hashed PIN;
- attendance, lesson activity, progress, and completion;
- reflections and notebook entries;
- survey responses;
- whether the Student marks an item private or shared;
- authentication, security, device, IP-address, and server-log information; and
- records of exports, privacy requests, consent, and deletion.
Photo uploads are disabled at launch. We will update our notices and obtain any required consent before enabling a materially different photo feature.
How we use Student information
We use it to provide lessons and Student accounts, save work, display progress, follow Student sharing choices, secure the Service, respond to verified Parent requests, support the Service, and comply with law. We do not use real Student-generated content to train AI or language models.
We do not use Student information for targeted advertising, and we do not sell or rent it.
Who can see what
| Information | Student | Parent | Authorized Church Leader | iConfirm operator |
|---|---|---|---|---|
| Name/nickname and account association | Yes | Yes | Yes | Yes, as needed to operate the Service |
| Attendance, progress, and completion | Yes | Through Parent account/request as available | Yes | Yes, as needed |
| Private reflections and private survey responses | Yes | Through Student-directed sharing or a verified legal/privacy request | No | Technically accessible only for documented operational, privacy-rights, security, or legal needs; not routinely read |
| Content marked shared | Yes | As shared or requested | Yes | Yes, as needed |
| Student PIN | Student knows the PIN | Parent may reset it | No | Stored as a hash; not available as readable PIN text |
A Student's "private" entry is private from Church Leaders through the Service. It is not end-to-end encrypted, routinely monitored, pastoral counseling, or guaranteed to be legally privileged.
Service providers
Supabase provides database/authentication/storage, Vercel provides hosting, Resend sends transactional email, and Stripe processes subscriptions and payment verification. They receive information only as needed to perform services for iConfirm, secure those services, or comply with law.
Parental consent
Before collecting Student information, we provide the Parent a direct notice and request affirmative consent. Consent, notice-version, and verification-method details are recorded for every enrollment (this is now built — see parent_consent_events).
Resolved 2026-08-23. For a discounted ($0) seat, we do not rely on the checkout charge to verify the Parent. Our operator instead confirms consent directly with the Parent before the Student's enrollment code is issued, and records the verification event — comparable to the video-conference method recognized under 16 C.F.R. §312.5(b)(2)(iv). For a paid seat, the Stripe payment-card process serves as verification.
Parent rights
A Parent may email office@iconfirm.app from the Parent's verified account email to:
- review information collected from or about the Student;
- request a secure export;
- ask us to correct account information;
- request deletion;
- refuse further collection or use; or
- withdraw consent.
We will verify the request and may need to retain minimal consent, payment, security, dispute, or legal records after deleting Student content. Withdrawal or deletion may end the Student's ability to use iConfirm.
We satisfy a review request by verifying the requester as the Student's Parent through the Parent's account email, then providing the Parent the actual content requested through that same secure channel.
Retention
While the subscription remains active, we retain Student information to provide the Service, because doing so is necessary to deliver lessons, track progress, and honor sharing choices. After paid access ends, ordinary Student use is intended to lock by day 5 while export remains available. Student content remains available for retrieval through day 90 and is then deleted from active systems and applicable backups under our control, because we do not keep children's information beyond what our program needs. Minimal legal and transaction evidence may remain as described in our Data Retention and Deletion Policy.
Help and monitoring
iConfirm does not routinely monitor private reflections. A Student should not place an emergency request in a private entry and expect someone to see it. Instead, the app shows a static "Need help?" page reminding the Student of that, and pointing them to a trusted adult, Parent, or Church representative, 911 for immediate danger, and the 988 Suicide & Crisis Lifeline (call or text). That page collects no information and sends nothing to anyone — it is informational only. (Revised 2026-08-24: an earlier interactive version that notified a Leader and Parent has been removed on counsel's recommendation, for the reasons in the Privacy Policy §11.)
Changes
We will notify Parents of material changes and obtain new consent when required. The current version and effective date will appear at the top of this Notice.