Privacy Policy

1. Who we are

This policy covers Homeschul (homeschul.com) and explains what personal data we collect from visitors, parents, and account holders, why, and what rights you have over it, in line with the EU/UK General Data Protection Regulation (GDPR). If you're looking for how we handle a child's information specifically, see our Children’s Data & Privacy Notice, which this policy incorporates by reference.

2. Data we collect

• Account data: the name and email you sign up with, and a securely hashed password (if you use email/password rather than Google sign-in).
• Marketing preference: whether you’ve opted in to hear from us.
• Consent record: that you accepted our children’s-data terms, and when.
• Billing status: whether your subscription is active. Card details are entered directly into Stripe’s checkout — they never pass through our servers.
• Support correspondence: anything you send us by email.
• AI request content: when you generate a lesson pack or chat with Beamy, the topic, subject, and grade band involved are sent to our AI provider, Anthropic, to generate that content. See §4 below for what’s deliberately left out of that request.

Your homeschool’s actual working data — students, lessons, grades, attendance, and so on — is covered separately in the Children’s Data Notice, since most of it lives only in your browser, not on our servers.

3. Cookies and local storage

We don’t use tracking or advertising cookies, and we don’t run third-party analytics scripts. Your signed-in session and your homeschool’s data are kept in your browser’s local storage, on your own device — not in a cookie, and not readable by other websites.

4. What we deliberately don’t send to the AI

When we ask Anthropic to generate a lesson pack or a Beamy response, we send the topic, subject, and grade band — never your child’s name, your account email, or any other identifying information. Anthropic processes that request to return the content and does not use it to train models on our plan.

5. Why we process it (our legal basis)

• Performance of a contract — creating your account, running the app, and processing payment for the plan you chose.
• Consent — for marketing emails, and for the children’s-data processing described in the dedicated notice.
• Legitimate interests — keeping the service secure, debugging problems, and preventing abuse, always weighed against your rights.
• Legal obligation — where we’re required to keep billing records for tax purposes.

6. Who we share it with

We don’t sell or rent your data. We use a small number of service providers (“processors”) to run Homeschul, each under their own privacy commitments and bound to only use your data to provide their service to us:

• Supabase — authentication and account storage.
• Stripe — payment processing. Stripe holds your card details; we never see or store them.
• Anthropic — generates AI lesson content and Beamy’s responses, from the limited inputs described in §4.

We may also disclose data if required by law, or to protect the rights and safety of our users.

7. How long we keep it

Account records are kept for as long as your account is active. If you delete your account, we remove your parent record (name, email, marketing preference, billing status) from our servers. We may retain billing records for longer where the law requires it. Data that lives only in your browser is removed the moment you clear it or uninstall the app from that device.

8. Security

Data in transit is encrypted (HTTPS/TLS), and our site sends security headers (including a Content-Security-Policy) to reduce the risk of malicious scripts running in your browser. Server-side credentials that can read or write account records are kept out of the browser entirely. Access to your homeschool’s cloud backup, where enabled, is restricted by database policy to your own signed-in account only.

9. International transfers

Our service providers may process data outside the country you live in. Where that includes transfers outside the EEA/UK, we rely on their respective data processing agreements and standard contractual clauses.

10. Your rights

Under GDPR Articles 12–23 you can ask us to: confirm what data we hold about you, correct it, erase it, restrict or object to its processing, or give you a portable copy. Contact us using the details below and we’ll respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority at any time.

11. Changes to this policy

If we make material changes to this policy, we’ll update the “last updated” date above and, where the change is significant, let you know directly.

12. Contact us

Questions, requests, or concerns about this policy or your data: privacy@homeschul.com.