Privacy & data practices
Built to collect less.
Plain-language answers to the questions parents actually ask about kid data online.
By design
What we don't collect.
Your child's age, birthday, or last name
A child's email address or phone number
Precise location, geolocation, or GPS coordinates
Photos of children (strictly prohibited)
Advertising or tracking cookies on child-facing pages
Just as important
What we collect.
Email address and password (encrypted). Used to create and manage your account. We never share this with anyone.
The city and state a parent enters to help with shipping and delivery logistics. We never collect anything more precise. No street-level location, no geolocation, no GPS.
Store name, child's first name, product listings, prices, and store design preferences. This is the content your child creates to run their store.
Buyer name, contact info, items ordered, and order notes. This is provided by customers when they place an order.
Photos uploaded for product listings and store banners. Photos of children are strictly prohibited.
Where your data actually lives.
All data is stored on Supabase, a secure cloud database platform. Supabase uses industry-standard encryption for data in transit (TLS) and at rest (AES-256).
Product images are stored in a secure cloud storage bucket. Only publicly listed products are visible to other users.
Passwords are hashed and salted. We cannot see your password, and neither can anyone on our team.
Who can see what.
Store name, child's first name, product listings, prices, and store design. This is what customers see when they visit a store.
Order details, buyer contact info, earnings, savings data, and account settings. Only the parent who created the account can access this.
We can view store content and order data for moderation and support purposes only. We review content to ensure community standards are met and to keep the platform safe for children.
Your controls.
Every product your child creates requires your approval before it goes live on the store. You review the name, description, price, and image.
Your parent dashboard shows every order, every product, and all earnings. You see everything your child does on the platform.
You can request complete deletion of your account and all associated data at any time by contacting privacy@getlemonadestand.com. We will process deletion requests within 30 days.
Child safety measures.
Parent and child sign-ins are forked. Reaching parent functions requires a separate parent login plus a quick math challenge that is easy for adults but hard for young children. The forked sign-in also keeps child activity on child-facing pages, which we keep free of any third-party advertising or retargeting.
Photos of children or children's faces are strictly prohibited in store listings, product images, and banners. This rule is part of our community standards and is enforced through content moderation.
Children never send or receive messages. When a buyer has a question about an order, it goes to the parent who runs the store, in the parent dashboard and by email notification, and any reply comes from that parent. Your child never sees a message thread and no one can contact them through the platform.
All store content, product listings, and order notes are subject to review by the Lemonade Stand team. We have the right, but not the obligation, to remove any content we determine, in our sole discretion, violates our community standards.
The complete policy
Full privacy policy.
Effective date: October 7, 2026
This Privacy Policy explains how Get Lemonade Stand, Inc. (“Lemonade Stand,” “we,” “us”) collects, uses, and protects information when families use our platform at getlemonadestand.com (the “Service”). The Service lets children, with the active involvement of a parent or legal guardian, create and operate online stores that sell their own handmade physical products. Protecting children’s privacy is central to how the Service is built, and we make all reasonable efforts to comply with the Children’s Online Privacy Protection Act (COPPA).
1. A note to parents
A parent or legal guardian must create and control every account. A child cannot use the Service on their own, cannot sign up on their own, and cannot share personal information through the Service. The parent is the account holder and makes every decision that involves money, data, or what a child can see and do. We ask parents to read this policy in full before enrolling a child.
2. Information we collect from parents
We collect the following from the adult who creates and manages the account:
Account information: a first name for the parent, which may be a nickname or alias and does not need to be a legal name; an email address; and a password. We use these to create and secure the account and to send important notices about the Service. When a parent starts signing up we also note the country and state the connection appears to be in, never a city or anything finer, so we can see where families are finding us.
Optional location: we ask, but do not require, the city and state where you are based, to help with shipping and delivery logistics planning. We do not collect a location more specific than city and state through this field.
Payment information: when a parent verifies consent or receives payouts from store sales, payment is handled by our payment processor, Stripe. Stripe collects and processes card and bank details directly. We do not store full payment card numbers on our systems.
Communications: messages a parent sends us, such as support requests.
Push notifications: if a parent installs our iOS app and allows notifications, Apple gives us a device token for that phone, which we store so we can send a short notice when a new order, a new message, or a product waiting for approval arrives. A notice says only that something happened and which store it concerns; it never contains a buyer’s details or the text of a message. A parent can turn notifications off on the account page or in the phone’s settings at any time, and we delete the token when they do. Children’s logins never register a device.
Buyer newsletter: an adult who shops the stores can ask for a weekly email of new products by giving us an email address on the shop page, on a storefront, or at checkout. Parents with an account and adults who have placed an order with an email address may also receive it. We store that address only to send that email, every issue has a one-click unsubscribe link, and unsubscribing is immediate. This is for adults; we never collect a child’s address for it.
3. Information from and about children
We designed the children’s experience to avoid collecting personal information from children wherever possible.
What a child uses to log in
A parent creates a child’s login inside their own account. We collect a first name for the child, which may be a nickname or alias and does not need to be a legal name. The child signs in with a username and a passcode chosen during setup. We do not ask a child for their email address, phone number, photo, home address, date of birth, or other personal contact information, and the Service does not give a child a way to share that information.
What a child creates
A child’s activity on the platform, such as their store name, product listings, product descriptions, and order records, is stored to operate that child’s store. A parent reviews and approves product listings before they become visible to others. We treat any content a child creates as information a parent controls.
What we do not do
We do not require a child to disclose more information than is reasonably necessary to use the Service.
We do not show behavioral or targeted advertising to children.
We do not allow third-party advertising networks to collect information from children through the Service.
We do not run analytics or third-party tracking scripts on child-facing store pages. Analytics are limited to adult-facing pages only.
How we count visits to our own pages
On our adult-facing marketing pages, our own server counts how many different people visit each day, so we can measure the site without relying on a third party. For each visit we keep the day, the page, where the visit came from (such as a search engine or an ad), whether the device was a phone, the country and state the connection appears to be in (never a city or anything finer), and a one-way code made from the connection that changes every day. That code cannot be turned back into a person, is not linked across days, sets no cookie, and is never used for advertising. Nothing is counted on child-facing pages.
4. How verifiable parental consent works
Before a child can create a store, we obtain verifiable parental consent as required by COPPA. We use a payment card to confirm that the person granting consent is an adult cardholder: the parent certifies, when creating the account, that they are the child’s parent or legal guardian and at least 18, and then starts the family membership by entering a card with Stripe. Nothing is charged at that moment; the first month is free. Stripe verifies the card and we record that consent was given, with a timestamp, before the child’s store is enabled.
At the time of consent, we provide a direct notice to the parent describing what information is involved, how it is used, and the parent’s rights described below. The notice is one tap away on the card screen and is linked from the account screen.
5. How we use information
We use the information we collect to:
Create and secure accounts, and authenticate parents and children.
Operate each child’s store, including listing products and recording orders.
Process consent verification and store payouts through Stripe.
Send parents transactional and service messages, such as order notifications and account notices.
Send adults who asked for it a weekly email of new products from the stores, until they unsubscribe.
Maintain the safety, security, and integrity of the Service, and comply with legal obligations.
We do not use children’s information for advertising, profiling, or marketing.
We may feature products that are publicly listed in a store on our website and social media. A feature shows the product only, such as its photo, description and price. It never includes a child’s name, store name, image, or other personal information, and a parent can ask us to remove a feature at any time.
6. Orders, shipping, and physical products
Stores on the platform may sell physical products that are shipped to buyers. Fulfillment, including handling any shipping address provided by a buyer, is the responsibility of the parent who operates the store as the seller.
Information from buyers
When someone buys a product from a store, we process the order details and the shipping and contact information the buyer provides so that the order can be fulfilled and the buyer can be updated about it. The parent who operates the store is the seller and is responsible for using buyer information only to fulfill the order. We do not use buyer information for advertising, and we do not sell it.
7. Service providers we share information with
We share information only with vendors that help us run the Service, and only as needed for them to perform their function. These include:
Stripe, for payment processing and payouts.
Supabase, for our database and authentication.
Vercel, for hosting the website.
Resend, for sending transactional email to parents.
We do not sell children’s personal information, and we do not share it with advertisers or data brokers.
8. Affiliate links
Some adult-facing pages may contain affiliate links, including Amazon Associates links. These links appear only behind parent authentication and never on child-facing store pages.
9. Parental rights
As the account holder, a parent may at any time:
Review the information associated with their account and their child’s activity.
Request that we delete their child’s information.
Refuse to permit further collection or use of their child’s information by closing the account or the child’s login.
Before we act on a request to review or delete information, we may take reasonable steps to confirm the identity of the account holder. To exercise these rights, a parent can email privacy@getlemonadestand.com.
10. Data retention
We keep information for as long as the account is active or as needed to provide the Service, and then delete or de-identify it within a reasonable period, unless a longer retention period is required by law.
11. How we protect information
We store data with access controls that isolate each household’s information and gate sensitive functions behind parent authentication. Payment data is handled by Stripe and is not stored on our servers. No method of storage or transmission is completely secure, but we take reasonable measures to protect the information we hold. If we become aware of a security incident that affects personal information, we will notify affected parents and any authorities as required by law.
12. Where we operate
The Service is intended for families in the United States. We do not direct the Service to users outside the United States, and we do not transfer personal information for use outside the United States in the ordinary course of operating the Service.
13. Links to other websites
Adult-facing pages may link to websites we do not operate. This policy does not apply to those websites, and we are not responsible for their content or their privacy practices. When you follow a link to another website, that website’s own rules apply.
14. California residents
If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect and how we use it, the right to request deletion of your personal information, and the right not to be treated differently for exercising your rights. We do not sell personal information, and we do not sell or share the personal information of children. To exercise these rights, email privacy@getlemonadestand.com.
15. Changes to this policy
If we make a material change to how we handle children’s information, we will notify parents and, where required by COPPA, obtain new consent before applying the change to previously collected information.
16. Contact us
Questions about this policy or your child’s information can be sent to:
Get Lemonade Stand, Inc.
55 Liberty Street, Apt 22A, New York, NY 10005
privacy@getlemonadestand.com
Still have questions?
Reach out anytime.
If you have any questions about how we handle your family's data, or if you want to request data access or deletion, contact us at:
privacy@getlemonadestand.com