Privacy Policy
Last updated: October 16, 2026
This Privacy Policy explains how Skylark Creations LLC ("Bank-See," "we," "us," or "our") collects, uses, discloses, retains, and protects information when you use Bank-See.
Bank-See is a financial-literacy education web app designed for teenagers. It is free, does not show ads, does not sell data, does not collect bank-account or payment-card information, and does not require an account, email address, password, or real name.
1. Who Bank-See is for
Bank-See is designed for teenagers ages 13 through 18. Bank-See is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it or obtain any consent required by law. If you believe a child under 13 has used Bank-See, contact us at hello@skylarkcreations.com.
2. Information we collect
2.1 Random visitor cookie
Bank-See uses a first-party cookie named bank_see_visitor_id. The value is a randomly generated UUID. This cookie is the main way Bank-See recognizes a returning browser and connects that browser to saved progress. It is not derived from a real name, email address, or other real-world identifier.
The cookie is currently set with httpOnly, sameSite=lax, secure in production, a one-year expiration, and path /.
2.2 Onboarding and profile information
Bank-See collects the following information from users:
- age, from 13 through 18, self-reported and unverified;
- topic interests, such as making money, avoiding scams, investing/crypto, saving, taxes, how the system works, or "all of it";
- optional display name, which should be made up and not a real legal name;
- optional grade, such as 7th through 12th grade or "not in school"; and
- optional self-assessment, such as beginner, intermediate, or advanced.
Age and topic interests are required to reach lesson and quiz content. Display name, grade, and self-assessment are optional, and leaving any of them blank changes nothing else in Bank-See.
If a user answers the age question with "12 or younger," Bank-See shows a message that it is built for users 13 and up and does not save that answer or collect any further information.
Bank-See does not ask for an email address. From August 9, 2026 to September 27, 2026, Bank-See showed an optional email field after a user's first lesson; that field has been removed. If a user entered an address while the field was shown, it remains in the same database record as that user's learning progress until it is deleted under Section 9 or on request under Section 10. Bank-See has never sent email to such an address and has no email-sending service. Such an address is never sold, never shared with advertisers or data brokers, and was never sent to our analytics provider (see Section 5).
2.3 Timezone
Bank-See detects the browser's IANA timezone, such as America/Denver, during onboarding. We use timezone only to calculate daily streaks at the user's local midnight. We do not collect GPS location, street address, school address, or precise location information.
2.4 First-touch marketing-attribution cookie
Bank-See may use a first-party cookie named bank_see_utm. If a user first arrives through a URL containing UTM campaign parameters, this cookie stores the first-touch UTM labels that were present, such as utm_source, utm_medium, utm_campaign, utm_term, or utm_content.
This cookie is set once and is not overwritten by later visits. It uses the same general cookie attributes and one-year lifetime as the visitor cookie. These values are campaign labels from links we use; they are not intended to contain personal information.
2.5 Learning-progress and activity information
Bank-See stores learning activity connected to the random visitor ID, including: total XP; current level; current and longest streak; streak shields; badges; lessons completed; quizzes completed; estimated time spent; average quiz score; daily XP bucket; quiz questions shown; selected answers; score and correct-count information; timestamps; and topic mastery and spaced-repetition scheduling information.
2.6 IP addresses and technical logs
Bank-See's web host may process IP addresses and technical request information as part of normal hosting, security, and network operations.
Bank-See also has technical capability to record IP addresses for abuse-prevention rate limiting. We may use IP addresses to protect Bank-See, prevent abuse, control costs, debug technical issues, and maintain service security.
2.7 Information we do not collect
Bank-See does not ask for or intentionally collect: real or legal names; email addresses; phone numbers; postal addresses; school names; bank accounts; card numbers; payment information; financial-account data; government identifiers; photos; biometric information; contacts; GPS or precise location; or user-generated content shared with other users.
Please do not enter this type of information into Bank-See.
3. How we use information
We use information to: provide Bank-See and save progress; route users to age-appropriate lessons and quizzes; personalize topic recommendations based on selected interests and activity; calculate XP, levels, streaks, badges, mastery, quiz scores, and spaced repetition; generate lesson and quiz content; calibrate reading level and difficulty; understand which features and topics are useful; measure onboarding, lesson completion, and quiz completion; remember first-touch marketing attribution for internal launch-readiness and product analytics; protect, secure, debug, and maintain Bank-See; prevent abuse, automated traffic, and excessive AI-generation costs; comply with legal obligations; and enforce our Terms.
We do not use Bank-See information to provide individualized financial, investment, tax, legal, lending, banking, or professional advice.
4. AI content generation
Bank-See uses OpenAI's API to generate lesson and quiz content. For a generation request, Bank-See sends OpenAI the topic, difficulty level, and the user's age when available, and asks for content calibrated to the user's reading level. For a lesson, Bank-See also sends the names of up to eight other topics in that category that the user has reached proficient or mastered. For a quiz, Bank-See also sends available topic-progress context (the names of topics in that category the user has mastered or is still working on) and the title of that topic's lesson; on a retake, it also sends an attempt number based on the user's recorded quiz results. Bank-See asks for questions adapted to that context. Bank-See does not send OpenAI the user's display name, quiz answers, visitor ID, UTM attribution values, or any bank, card, payment, or financial-account information.
Bank-See may also use an internal AI-based content-accuracy checker. As of this policy, the production accuracy-checker feature is not active, except for a self-consistency check that re-checks the generator's own quiz math using content already produced. If the accuracy checker is activated later and changes what data is sent to OpenAI or another provider, we will update this Privacy Policy and obtain any consent required by law.
According to OpenAI's public business/API privacy commitments as of this policy, API inputs and outputs are not used to train OpenAI models by default unless the customer opts in. We rely on our agreement with OpenAI and OpenAI's current API data-use terms.
Decode this. If you use "Decode this," Bank-See sends the text you paste to OpenAI's API so it can explain how the offer, contract or message works. Before sending, Bank-See refuses text that looks like a card number, a Social Security number or a street address, and replaces phone numbers, email addresses and links that match its detection patterns with placeholders. Bank-See does not save the text you paste or the explanation, does not write either to its logs, and does not send either to its analytics or error-reporting services. It records the outcome (shown or refused, and the money category it matched) and operational details such as the refusal reason, the number of AI calls, the model used, token counts and response time. Under OpenAI's API data terms as of this policy, OpenAI does not use API data to train its models by default unless the customer opts in, may keep it in abuse-monitoring logs for up to 30 days (or longer if the law requires), and may hold it in a prompt cache for up to 24 hours. Please don't paste names, addresses, or card or account numbers.
5. Analytics
Bank-See uses Amplitude for product analytics. Amplitude may receive anonymous or pseudonymous usage events connected to the random visitor ID, such as user-created, onboarding-completed, lesson-completed, and quiz-submitted events.
Amplitude may also receive profile attributes used for analytics, including age, grade, interests, self-assessment, timezone, and first-touch UTM attribution values when present.
Amplitude never received an email address. While the optional email field existed (see Section 2.2), Amplitude received only a yes/no flag that an address had been provided.
Bank-See does not use session replay or screen recording.
6. Cookies
Bank-See currently uses first-party cookies for: recognizing a returning browser and connecting it to saved progress (bank_see_visitor_id); and remembering first-touch marketing attribution labels (bank_see_utm).
You can clear cookies in your browser settings. Clearing cookies may permanently disconnect your browser from your Bank-See progress because Bank-See does not use a login, password, or account-recovery system.
Bank-See does not use, and will not use, cookies or third-party advertising networks to show or target ads inside Bank-See. We do not and will not use information about our users for behavioral advertising, share it with data brokers, or use affiliate tracking. The bank_see_utm cookie described above records only which campaign or link brought a visitor, including a paid ad.
7. How we disclose information
We disclose information only as needed to operate, secure, and provide Bank-See, or as otherwise described in this Privacy Policy.
7.1 Service providers
We use the following service providers:
- Supabase — database hosting and storage for Bank-See application data.
- OpenAI — AI generation of lessons and quizzes, receiving topic, difficulty level, and user age for generation requests.
- Amplitude — product analytics, receiving pseudonymous usage events and certain profile attributes described above.
- Render — web and application hosting, which may process IP addresses and technical request data at the network and hosting layer.
7.2 Legal, safety, and security disclosures
We may disclose information if we reasonably believe it is necessary to: comply with law, legal process, or governmental requests; protect the rights, privacy, safety, or security of Bank-See, users, or others; investigate, prevent, or respond to fraud, abuse, security incidents, or technical issues; or enforce our Terms.
7.3 Business transfers
If Bank-See or its operator is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be transferred only to a successor that agrees to keep every promise in this Privacy Policy, including that personal information will not be sold. If no successor agrees, we will delete the information rather than transfer it. Personal information will never be sold on its own, apart from Bank-See itself.
8. No sale, ads, or data-broker sharing
Bank-See does not sell personal information. Bank-See does not share personal information with advertising networks or data brokers. Bank-See does not show ads, use affiliate links, or use third-party behavioral advertising.
9. Data retention and deletion
Proposed retention schedule (an automated deletion/expiry job is not yet built — see the note below):
- Visitor cookie: expires after one year unless refreshed by continued use.
- First-touch UTM cookie: expires after one year and is not overwritten by later visits.
- Learning-progress data connected to a visitor ID: retained while needed to provide progress, streaks, XP, mastery, and educational continuity, and deleted or de-identified after 24 months of inactivity.
- Optional profile fields: retained while connected to an active visitor ID and deleted or de-identified after 24 months of inactivity or upon verified deletion request.
- Quiz attempts and learning history: retained while needed for progress, spaced repetition, product quality, abuse prevention, and educational continuity, and deleted or de-identified after 24 months of inactivity.
- IP-based rate-limit records: retained only as long as reasonably necessary for abuse prevention, debugging, cost control, and security, not longer than 90 days unless needed to investigate abuse or comply with law.
- Backups: deleted or overwritten on the ordinary backup cycle, unless longer retention is required for security, legal, or operational reasons.
Because Bank-See has no login or real-world account identity, clearing browser cookies severs the link between the browser and the saved progress record. The record may remain in our database unless deleted under our retention schedule or through a verified request, but without the cookie it may be orphaned and no longer practically associated with a specific user.
10. User choices
Users can choose not to provide optional display name, grade, or self-assessment.
A user who entered an email address while the optional email field existed can ask for it to be deleted by contacting us at hello@skylarkcreations.com or through the "Tell us we're wrong" link in Bank-See, and we will delete it.
Users can clear browser cookies, but this may permanently disconnect them from saved progress.
Depending on where you live, you may have additional privacy rights, such as the right to access, correct, delete, or receive a copy of certain information. To exercise rights, contact us at hello@skylarkcreations.com. We may not be able to fulfill a request if we cannot reasonably identify the relevant record.
11. Security
We use reasonable administrative, technical, and organizational measures designed to protect information. For example, Bank-See stores application data in Supabase, uses secure cookie attributes in production, and limits access through the application layer.
No online service is perfectly secure. We cannot guarantee that information will always remain secure.
12. Children's privacy and data minimization
Bank-See is designed to collect as little directly identifying information as possible. It does not require email, password, real name, phone number, address, school name, bank data, payment data, photos, biometrics, contacts, or precise location.
Bank-See is not intended for children under 13, and we do not knowingly collect personal information from children under 13. See Section 1 above.
13. School use
Bank-See is not currently provided by or through a school, school district, teacher, or educational institution. Bank-See does not ask for a school name and is not currently operated as a school vendor or student-record system.
If Bank-See is later offered through schools or used in classroom programs, we will update this Privacy Policy and related agreements as needed.
14. International users
Bank-See is intended for users in the United States. Information may be processed in the United States and in other locations where our service providers operate. If Bank-See is later offered outside the United States, we will update this Privacy Policy and implement any additional notices, rights, or safeguards required by applicable law.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The "Last updated" date shows when it was last changed.
16. Contact us
Skylark Creations LLC
1500 N Grant St, Ste R
Denver, CO 80203
hello@skylarkcreations.com
This is a draft prepared for founder and counsel review — see the plain-language summary for the honest short version.