1. Who we are
HomeScholar AI is a web application that helps homeschool parents look up their state's legal requirements, plan AI-assisted lessons for their children, and track attendance and progress. This Privacy Policy explains what information we collect, how we use it, and the choices you have. If anything here is unclear, email creamcapitalva@gmail.comand we'll answer in plain English.
2. Information we collect
Parent account
- Email address (used to sign you in and send transactional messages).
- A password, stored only as a hash by our authentication provider.
- How you arrived at signup (e.g., which feature card you clicked) — used to understand which parts of the product are working.
Child profile
We collect the minimum needed to run the service for each child: a first name or nickname, a grade level, and a 4-digit PIN that the parent sets so the child can sign in on their own device. We do not collect dates of birth, addresses, phone numbers, or photos for children.
Usage data
Lesson plans you generate, attendance records, compliance checklist progress, and the state you select. This data is tied to your account and is not shared with anyone else.
Payment data
When subscriptions are enabled, billing is handled by Stripe. Card numbers go directly to Stripe and never touch our servers. We receive only a customer ID and subscription status. Until subscriptions are enabled, no payment data is collected.
3. How we use your information
- To provide the service: keep you signed in, store your lessons, track your compliance progress.
- To generate AI lesson plans (we send the lesson details to Anthropic; see Section 5).
- To send transactional messages — for example, signup confirmation, password reset, or material changes to this policy.
- To improve the product in aggregate (e.g., understanding which subjects are most used). We do not profile individual children for marketing.
- To comply with legal obligations and respond to lawful requests.
4. Children's privacy (COPPA)
HomeScholar AI is designed for homeschool families with children of all K-12 ages, including children under 13. We comply with the Children's Online Privacy Protection Act (COPPA).
- Parental consent.Children under 13 may use HomeScholar AI only with their parent's consent. That consent is established by the parent creating the account and adding the child profile themselves. Children cannot register accounts directly.
- Minimum data. For each child we collect only a first name or nickname, grade level, and the PIN you set. No date of birth, no address, no phone, no photo.
- No advertising to children. We do not display third-party ads anywhere in the product, and we do not track children for advertising or marketing purposes.
- No marketing analytics on student routes. Product analytics and error monitoring tools are explicitly disabled on the
/student/* routes that children use. This is a hard project rule. - Parent rights.Parents can review their child's data at any time from the dashboard, edit or delete it directly, or email creamcapitalva@gmail.com to request review, export, or deletion.
- No sale or sharing.We do not sell, rent, or share children's data with third parties for their own purposes.
5. Third-party services we use
We use a small number of carefully chosen third parties to run the service. Each handles a specific job and is bound by their own privacy policies.
- Supabase — authentication, database, and file storage. Hosted in the United States. All app data lives here, protected by Row Level Security so accounts can only read their own data.
- Anthropic (Claude API)— generates AI lesson plans. When you click "Generate lesson plan", we send the subject, topic, grade level, and student name to Anthropic. Per Anthropic's data policy, prompts are processed in transit and are not used to train their models.
- YouTube Data API v3 — searches for relevant educational videos. We retrieve metadata only (title, thumbnail, URL) and link out to youtube.com in a new tab. We never embed YouTube videos inside HomeScholar AI.
- Stripe — when subscriptions are enabled, processes payments. Card data is collected directly by Stripe and never sent to our servers. Their privacy policy governs that relationship.
- Vercel — hosts the website. Standard server logs (IP address, request path, response code) are retained for short windows for security and performance monitoring.
6. Cookies and tracking
- Strictly necessary.We use a Supabase authentication cookie to keep you signed in. Without it, the app can't recognize you across page loads.
- No advertising cookies. We do not use third-party advertising cookies and do not allow advertisers to set cookies through our site.
- No selling of tracking data. We do not sell or share device-level tracking data with anyone.
- Product analytics. If we add product analytics in the future, they will be parent-account-only and will never run on the
/student/* routes.
7. Your rights
You have the following rights over your data. To exercise any of them, use the dashboard where possible, or email creamcapitalva@gmail.com.
- Access. Request a copy of the data we hold for your account.
- Correction. Edit account fields and child profiles directly in your dashboard.
- Deletion. Delete your account from the dashboard. Deletion cascades to all children, lesson plans, and progress records.
- Opt-out. Pause or cancel a subscription at any time.
- California (CCPA/CPRA). California residents have the right to know what we collect, to delete it, and to opt out of sale or sharing. We do not sell or share personal information as defined by the CCPA.
- EU / UK (GDPR / UK GDPR). EU and UK residents have the same access, correction, deletion, and portability rights. Our lawful basis for processing is the contract you enter into when you create an account.
8. Data retention
- Account data, child profiles, lesson plans, and attendance records are kept while your account is active.
- When you delete your account, this data is removed from the live database within 30 days.
- Backups are retained on a rolling 30-day window and then purged. After that window, deleted data is fully gone.
- Aggregate, non-identifying statistics (e.g., total number of lessons generated across the platform) may be retained longer.
9. Security
- All traffic is encrypted in transit with TLS.
- Per-user data isolation is enforced at the database row level (Row Level Security), not just at the application layer.
- Passwords are stored only as hashes via our authentication provider; we never see or store plaintext passwords.
- Service-role database access is restricted to server-side code and is never exposed to the browser.
- No system is perfectly secure. If we discover a breach that affects your data, we will notify you.
10. Changes to this policy
We may update this Privacy Policy from time to time. For material changes, we will notify the account holder by email at least 14 days before the change takes effect. The effective date at the top of this page always reflects the latest version.
11. Contact
For privacy questions, data requests, or any concerns about children's data, email creamcapitalva@gmail.com. We try to respond within 7 days.