Once Upon a Bit · Legal

Children's Privacy

Our notice under the Children's Online Privacy Protection Act (COPPA). For parents and grown-ups.

Effective 2026-08-08 · Once Upon a Bit, operated by Mauricio Eastmond (California, USA) · mauricio@onceuponabit.com

The claim page is designed for children, so the Children’s Online Privacy Protection Act (COPPA) applies to it. The page is built to collect nothing from a child: there is no field a child can type into, no account, no login, no email, no photo, no upload, and no analytics. The only thing our servers receive is the IP address that any website receives in order to deliver a page.

1 · Who we are

Once Upon a Bit is operated by Mauricio Eastmond, an individual; there is no company behind it. For any question about this notice, or to exercise any right described below, email mauricio@onceuponabit.com. No other operator collects information through this service.

2 · What we collect from a child

One item: the IP address of the device opening the page, received automatically as part of delivering the page, together with ordinary request logs (time and page requested).

We use it solely to support the internal operations of the service: routing the page to the device, keeping the site available, and protecting it from attack and abuse. We do not use it to build profiles, target advertising, recognize a child across services, or contact anyone.

We do not condition a child’s participation on disclosing any information. The page asks a child for nothing.

3 · What a child is never asked for

  • No name, age, birthday, address, phone number, or email.
  • No photo, video, drawing, or voice recording.
  • No account, login, password, or “save my progress”.
  • Quiz answers are never transmitted. They are checked inside the browser and discarded.
  • The child’s wallet words never leave the device. They are generated in the browser and written on paper with a grown-up; they are not transmitted to us or to anyone.
  • We never store the child’s bitcoin address or connect a child’s name to one.

4 · Information provided by the adult

The recipient’s first name and the message shown on the claim page are entered by the adult who created the gift, before the child opens it. They are not collected from the child, and the child cannot change them.

The gift form asks givers to keep the message free of identifying details — no last names, addresses, phone numbers, or school names — and we treat it with the same care as children’s data, including deleting it on the schedule in Section 6.

5 · No third parties on the child’s page

The claim page contains no third-party scripts, advertising networks, analytics services, social plugins, embeds, tracking pixels, or error reporters. Fonts are served from our own domain, so opening the page contacts no company beyond the infrastructure that delivers this website, named in Section 4 of the Privacy Policy.

When the child sends the gift to their wallet, our own server passes the transaction to the bitcoin network on the browser’s behalf. As a result, the child’s IP address is never disclosed to the bitcoin services we query; it is seen only by the infrastructure that delivers this website.

We do not disclose information about a child to anyone, and we do not sell, share, or transfer it, except where legally required.

6 · How long we keep it

We do not retain information indefinitely. An automated job runs nightly and erases the personal parts of a gift record:

  • 90 days after the gift is claimed — the giver’s name, the recipient’s first name, the message, and the claim transaction identifier are erased.
  • 365 days after the gift was created, if it was never claimed — the same fields are erased.

Server request logs, including IP addresses, are retained by our hosting provider only as long as needed for security and network operation.

The remainder of the record — the storybook, a public bitcoin address, and dates — is kept so the claim link continues to work.

7 · Parents’ rights

As a parent or guardian, you may at any time:

  • ask what information we hold relating to your child;
  • ask us to delete it;
  • refuse any further collection — in practice, by not opening the claim link, since nothing else is collected.

Email mauricio@onceuponabit.com with the gift’s ID — the short code in the link, before the “#” symbol. No reason is required, and no account is needed to make the request. Never send us the claim link itself: everything after the “#” is the key to your child’s bitcoin, and anyone who has it can take the gift.

We cannot delete anything from the bitcoin blockchain. It is a public record that no one controls, and a claimed gift leaves a permanent trace there. What we can delete — and do delete on the schedule above — is our record, including anything connecting a child’s name to that trace.

8 · A warning for grown-ups

A claim link works like cash in an envelope: whoever opens it can take the gift. Claim it together with your child, and keep the link private until then. If the link is lost, no one — including us — can recover the gift.

Bitcoin’s value fluctuates. The number of satoshis in a gift never changes, but their value in your currency rises and falls. Nothing on this site is financial advice.

9 · Changes to this notice

If we ever change what we collect from children, we will update this notice before the change takes effect. Because we hold no contact information, we cannot notify you individually.

← The general Privacy Policy