Parents stay in control.

Pre-launch status

Digital Christmas List is building an under-13 experience and is not relying on an adult-only classification. Under-13 Child Mode remains behind staged privacy enforcement while the implemented parent-verification lanes, operator contact details, vendor assurances, security evidence, and qualified legal review are completed. This notice does not claim that the service has received a legal certification or COPPA Safe Harbor approval.

Operator and privacy contact

Digital Christmas List is operated by Nora Knows LLC, based in Mason, Michigan, United States. Nora Knows LLC handles parent privacy requests for Digital Christmas List and the service providers listed below.

Privacy questions and parent requests may be sent to josh@digitalchristmaslist.com.

A complete mailing address and telephone contact must be configured and published here before under-13 Child Mode moves from staged audit into a blocking rollout.

Who creates the account

A parent or other managing adult creates the account, household, family profile, and Christmas list. A child does not need an email address or a public account. The household owner may later choose to activate Child Mode on an authorized device after reviewing the direct parent notice, choosing permissions, and completing the approved parent-verification process.

Information a parent may provide

• Parent or managing-adult name and email address.
• A family member’s first name, nickname, age range, and relationship.
• Child Mode, product-processing, Nora Lens, and sharing choices.
• A parent-created PIN and authorized-device controls.
• Consent, verification, withdrawal, export, and deletion requests.
• Christmas Pass payment and entitlement information processed by Stripe.

Information a child may provide in Child Mode

• Gift names, product links, stores, prices, quantities, sizes, and colors.
• Gift notes, favorites, priorities, and list order.
• Product searches and product-focused search phrases.
• A photo of a product or catalog page when the parent separately allows Nora Lens.

Children should not enter a home address, school name, phone number, email address, account credential, or other identifying information in gift notes or images. The service is designed for product and gift information, not social profiles or communication between children.

Device and security information

The service creates random setup, device, session, share, and reservation credentials. Readable credentials are returned only when needed; stored credentials are generally hashed. The parent can revoke devices, sessions, setup links, shopper links, and Child Mode. Child privacy routes do not mount the adult Google Analytics, Vercel Analytics, Nora Pulse, adult workspace, or Nora chat-history systems.

How child information is used

• To create, display, organize, and protect the family Christmas list.
• To preview and match products when product processing is allowed.
• To provide optional price guidance and requested price alerts.
• To process an optional product photo through the child-only Lens path.
• To show parent-approved gift information to invited relatives.
• To prevent duplicate gifts without showing claimant identities to the child.
• To secure accounts, private links, devices, sessions, and parent rights.

Parent choices

The household owner controls separate choices for:

• Child Mode: whether the child can operate the private list.
• Product processing: whether child-entered product links and searches may be processed through retailer, product-search, and price-data services. Child Mode can remain off while the parent manages the list.
• Nora Lens: whether an authorized child session may submit a temporary product photo for recognition. Lens also requires product processing to be allowed.
• Invited-relative sharing: whether approved gift details may be shown through private shopper links or the family shopper page.
• Sharing mode: whether child-added gifts require parent review before relatives can see them.

A parent may consent to Child Mode and internal list use without consenting to invited-relative sharing. Turning off a permission blocks the related capability and revokes related access where applicable.

Service providers and disclosures

Nora Knows LLC uses service providers only for the functions needed to run Digital Christmas List. Depending on the permissions and features used, provider categories may include:

• MongoDB Atlas for application database storage, indexes, backups, and deletion operations.
• Vercel for hosting, server functions, routing, and limited operational logs.
• OpenAI for optional Nora Lens product recognition. The child path sends a resized, metadata-stripped image in memory with store: false; DCL does not represent this as an account-level Zero Data Retention guarantee until the provider account and contract are confirmed.
• Retailer, product-search, and price-data providers for product terms, product identifiers, prices, availability, and matches. Requests are designed not to include the child’s name, household ID, parent email, child image, or consent record.
• Resend or another configured email provider for parent notices, access, alerts, reservation recovery, and privacy-operation mail.
• Stripe for Christmas Pass payments and, only after legal approval and deliberate production enablement, the paid parental-verification transaction lane.

When a parent allows invited-relative sharing, approved gift information may be disclosed to people who receive a private shopper link. Shopper pages do not receive the child PIN, child session, consent history, device secrets, parent account credentials, or Lens image. Gift claimant names and purchase status remain hidden from the child.

Digital Christmas List does not sell or rent children’s personal information and does not use child information for targeted advertising.

Nora Lens image handling

The child-only Lens path requires an authorized child session plus separate parent permission for both Lens and product processing. The browser resizes and re-encodes the image, and the server removes JPEG metadata again. The image is processed in memory and is not written to DCL’s public Blob storage, child Lens history, or workspace history. The child response omits OCR text, visible personal information, provider diagnostics, and the original filename.

Retention and deletion

DCL retains child information only while it is reasonably needed for the family-list purpose, security, parent rights, or restore-suppression purpose. Current technical defaults are:

• Active child profiles and lists remain until the parent removes or deletes them.
• Removed child or teen profiles receive a 90-day restore grace period.
• PIN-unlocked child sessions expire after 12 hours.
• Authorized child-device access expires after 180 days unless revoked sooner.
• Expired invitations, setup records, and onboarding drafts are deleted after expiry.
• Child-data export files are generated for the parent and are not stored by DCL.
• Minimal hashed deletion tombstones are retained for the oldest restorable database-backup window plus a safety buffer, currently configured with a conservative 400-day technical default until the actual production backup maximum is confirmed.

The retention worker runs on a protected schedule to remove expired access records, reconcile interrupted deletions, purge archived child profiles after the grace period, and remove child records that reappear after an older database restore. Final production timeframes remain subject to vendor and qualified legal review before broad under-13 enforcement.

Parent review, withdrawal, export, and deletion rights

The authenticated household owner may open the selected family member’s Access & Sharing screen and use the Parent Privacy Center to:

• Review the age band, consent status, permissions, devices, and sessions.
• Change permissions or turn off Child Mode.
• Revoke one device or every child device.
• Withdraw consent and stop future child collection and sharing.
• Download a child-data JSON export.
• Permanently delete the child profile and linked information.

Permanent deletion requires the signed-in household owner, a fresh passwordless email reauthentication, the exact child-specific deletion phrase, and a final acknowledgment. A parent may also request help by emailing josh@digitalchristmaslist.com.

Open Christmas home to select a family member and reach the Parent Privacy Center.

Parent verification

A checkbox, PIN, ordinary account login, or possession of the parent email address is not automatically treated as verifiable parental consent. The system records privacy choices as pending until an approved verification method completes.

DCL has implemented two separate, fail-closed verification lanes. The paid lane may use a matching Christmas Pass Stripe transaction after the exact method receives legal approval and is deliberately enabled. The free lane uses two single-use parent emails separated by a required delay and is limited to internal-only Child Mode while product processing, Nora Lens, and invited-relative sharing are all off. Neither lane is treated as approved in production merely because the code exists.

Changes to this notice

DCL stores the notice, privacy-policy, and terms versions associated with a parent’s consent record. If a material collection, use, disclosure, or retention practice changes, DCL will issue an updated direct notice and seek any additional parent choice or consent required before applying the changed practice to an under-13 child.