Cookie Policy

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and understand how visitors use the site. Some cookies are essential for the site to function, while others are optional.

The KudoKids website (kudokids.org) uses a minimal set of cookies. Which optional categories start active depends on where you are visiting from:

If we cannot determine your region, we use the "everywhere else" defaults (everything optional stays off). To decide which column applies, we look up your approximate region (country level) once per visit from your network address; only a coarse region bucket (US / Europe / other) is kept for your current tab session (kk_region below), and the country code is not stored with any data about you. We do not use cookies in the KudoKids mobile app.

Essential (Always Active)

These are required for the website to function and cannot be disabled. All of them are first-party values that stay in your browser. Alongside them we keep a handful of small housekeeping values — a draft of the waitlist form if you began one before that form was removed, your email on the purchase-confirmation page, flags that stop us counting the same purchase twice or re-showing a banner you dismissed, a flag marking our own team's visits so they are left out of our analytics, and your signed-in session — which work the same way: first-party, kept in your browser, never used for advertising.

Analytics — on by default in the US; opt-in everywhere else

These cookies are set while analytics consent is active for you: in the US it is active by default until you opt out; everywhere else it activates only if you grant it via the cookie banner.

Advertising — on by default in the US; opt-in everywhere else

These cookies are set while advertising consent is active for you: in the US it is active by default until you opt out; everywhere else it activates only if you grant it via the cookie banner. If you opt out of (or decline) Advertising consent, or your browser sends a Global Privacy Control signal, no advertising cookies are set, no Meta Pixel scripts are loaded, and no server-side Conversions API (CAPI) event is sent to Meta. Both the in-browser pixel and the server-side share are suppressed by the same Advertising-consent choice.

California "Do Not Sell or Share": building advertising/retargeting audiences with Meta — via either the in-browser Meta Pixel or the server-side CAPI event described in Section 3 — is treated as a "sale" or "share" of personal information under the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code §1798.140(ad)–(ah)). For US visitors this sharing is on by default until you opt out. Opting out of Advertising consent, or sending a Global Privacy Control signal, is your "Do Not Sell or Share My Personal Information" opt-out and stops both the pixel and the CAPI share.

We use Google Analytics 4 (GA4) to understand aggregate website traffic patterns. Our analytics configuration includes:

• IP anonymization is enabled -- your full IP address is never stored
• No advertising features -- remarketing, demographic reporting, and interest categories are all disabled
• No cross-site tracking -- we do not link analytics data across different websites
• No child tracking -- website analytics (Google Analytics and Microsoft Clarity) never load on any child-reachable page — including the child login, pairing, referral-landing, and school-join pages — and do not track children; child data collection occurs only in the mobile app with parental consent

Server-side purchase measurement (website checkouts — no cookies required)

When you complete a checkout with us through Stripe, on kudokids.org or in the KudoKids web app — a Premium subscription or lifetime purchase, a lifetime gift purchase, or a founding purchase while that campaign was open — our server records the completed purchase in our own Google Analytics 4 property using the GA4 Measurement Protocol. Purchases are made by signed-in adult account holders, and nothing about a child is included in what is sent. This happens regardless of your cookie choices, because it is strictly first-party measurement of our own sales: Google Ads data sharing is turned off for these events, and the advertising signals (ad_user_data and ad_personalization) are sent as denied unless you consented to advertising cookies — so the event cannot be used for ad personalization or cross-context behavioral advertising. What is sent to Google: the purchase amount and currency, the product purchased, the Stripe checkout session identifier (used as the transaction id), campaign (UTM) parameters, and a pseudonymous client identifier — the Google Analytics identifiers already in your browser (your client id and session id) if you consented to analytics cookies, otherwise a random-looking identifier derived from the checkout session that is not linked to any cookie on your device. Your name, email address, and payment details are never sent to Google.

Session analytics (Microsoft Clarity)

We also use Microsoft Clarity for session analytics — heatmaps and session replays that show us how visitors scroll, click, and navigate the site. Text you type into forms is masked. We signal Microsoft to deny advertising storage for every visitor, so Clarity operates as an analytics tool only. Clarity never loads on child-reachable pages and does not track children.

Advertising cookies (Meta Pixel)

While advertising consent is active for you — your explicit choice, or the US default described in Section 2 unless you opt out — we use the Meta Pixel to measure the effectiveness of our Facebook and Instagram advertising campaigns. The pixel records the pages you view and the actions you take on our website, such as viewing content, starting a checkout, completing a purchase, or clicking through to the KudoKids app or an app store. This data helps us understand which ads are reaching the right families and measure return on ad spend. Meta may use this data to show you relevant KudoKids ads on Facebook and Instagram, build retargeting audiences, and optimize ad delivery to similar audiences. When you complete a gift purchase on the kudokids.org marketing website and Advertising consent is active for you, our server sends that purchase — the only event it sends to Meta — to Meta's Conversions API (CAPI) with a hashed email address and a hashed account identifier, together with the _fbp/_fbc cookie identifiers, for improved event matching. This server-side event is a "sale" or "share" of personal information under the CPRA and is sent only when Advertising consent is active; if you decline Advertising consent or send a Global Privacy Control signal, the CAPI event is not sent. No advertising data is collected from children -- advertising cookies and the CAPI share operate only on the KudoKids website, not in the mobile app.

Booking a call (scheduling windows)

If you click a button to book a call with us, a booking window from one of our scheduling providers (Calendly or a Google Calendar appointment schedule) opens on top of the page or in its own tab. Nothing from either loads until you click, and closing it ends it. Inside it the provider sets its own cookies and applies its own settings (Calendly also shows its own cookie notice), so the choices you make there are separate from the ones you make on this site — the analytics and advertising categories above do not cover them. Where a provider supports it, details you already gave us may be filled in for you. While analytics consent is active for you, Google Analytics records that a booking window was opened and from which page, never what you enter in it. Section 7 of our Privacy Policy lists what each provider receives.

You can manage your cookie preferences at any time:

• US visitors — first-visit notice: if you are visiting from the United States, analytics and advertising cookies start on by default and a notice appears on your first page view. Opt out in that notice switches both categories off in one click; Got it dismisses the notice without changing anything. Your opt-out never expires — once you switch a category off, we keep it off unless you yourself later switch it back on.
• Cookie banner (everywhere else): outside the US — or whenever we cannot determine your region — a banner on your first visit lets you independently accept or decline analytics cookies and advertising cookies before anything optional loads.
• Footer link: Click "Cookie Settings" in the website footer to change your preferences at any time, in any region.
• Browser settings: Most browsers allow you to block or delete cookies through their settings menu.
• Global Privacy Control: We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will treat it as a request to opt out of both analytics and advertising cookies, in every region — including switching off a category that was previously on for you. If you later turn analytics back on yourself in Cookie Settings while GPC is still enabled, we honor that explicit choice. Advertising stays off for as long as the signal is present — a GPC signal is a standing opt-out of the sale and sharing of personal information, so the advertising control is switched off and locked while your browser sends it.

If you opt out of (or decline) analytics cookies — including by sending a Global Privacy Control signal — any existing Google Analytics and Microsoft Clarity cookies (_ga, _ga_ZW40QM7F2L, _clck, _clsk) will be automatically cleared from your browser. If you opt out of (or decline) advertising cookies — including by GPC — any existing Meta Pixel cookies (_fbp, _fbc) will be automatically cleared from your browser.

Google Analytics is operated by Google LLC. When you accept analytics cookies, Google processes this data according to their Privacy Policy. Separately from cookies, when you complete a checkout on kudokids.org or in the KudoKids web app our server reports the purchase to our own Google Analytics property regardless of your cookie choices, as described in Section 3. You can also opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

Meta Pixel is operated by Meta Platforms, Inc. When you accept advertising cookies, Meta processes event data according to their Data Policy. You can control how Meta uses your data through your Facebook Ad Preferences and by opting out of advertising cookies on our website.

International data transfers. Google LLC and Meta Platforms, Inc. are United States processors. When you accept analytics or advertising cookies, the associated data (and, for advertising, the server-side CAPI event described in Section 3) is transferred to and processed in the United States. These transfers rely on the EU-US Data Privacy Framework (and its UK Extension and Swiss-US framework) and, where applicable, on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Microsoft Clarity is operated by Microsoft Corporation. When you accept analytics cookies, Microsoft processes this data as an independent controller according to the Microsoft Privacy Statement. Microsoft is a United States recipient acting as an independent controller; the international-transfer paragraph above applies to Clarity data as well, on that basis.

Calendly is operated by Calendly LLC. If you open a booking window, Calendly sets its own cookies inside that window and processes them under its own Privacy Notice — see Section 3.

Google Calendar appointment schedules are operated by Google LLC. If you open a booking window that uses one, Google sets its own cookies inside it and processes them under its Privacy Policy — see Section 3.

Processor server-side retention. The per-cookie lifetimes in Section 2 govern what is stored in your browser. How long Google and Meta retain the corresponding server-side event data is governed by their own policies, linked above (Google Privacy Policy; Meta Data Policy), not by this Cookie Policy. Microsoft Clarity's retention is covered in the Clarity paragraph above.

If you have questions about our use of cookies, contact us at legal@kudokids.org, or call us at (910) 593-7070.

For complete details about our data practices, see our Privacy Policy.