Children's Data & Privacy Notice

1. Who this notice is for

Homeschul is built for parents and legal guardians to plan and track a child's home education. This notice explains, in line with the EU/UK General Data Protection Regulation (GDPR) — including the special protections Article 8 and Recital 38 give to children's data — what information we collect about your child, why, and what rights you and your child have over it.

2. Who is responsible for this data

Homeschul is the data controller for account information (your name and email) and, where you choose to sync across devices, your family's homeschooling records. You, as the parent or guardian entering the data, act as the source and authority for your child's information — Homeschul never collects anything directly from a child.

3. Our legal basis for processing a child's data

Where a child is below the age at which they can consent to data processing on their own (16 in most EU member states, and as low as 13 in some — see GDPR Article 8), the law requires that consent be given or authorised by whoever holds parental responsibility for the child. By creating a Homeschul account and adding a student profile, you confirm that you are that child's parent or legal guardian, and you give that consent on their behalf.

Where we don't rely on consent, we rely on: performance of our contract with you (Article 6(1)(b)) to actually deliver the lesson-planning and progress-tracking service you signed up for, and our legitimate interests (Article 6(1)(f)) in keeping the service secure and working — always weighed against your child's best interests, per Recital 38.

4. What we collect about your child

• A first name or nickname and grade level, entered by you.
• Lesson activity: which lessons are assigned, completed, or missed, and their dates.
• Learning progress: XP, streaks, earned badges, and an avatar colour you choose.
• Grades: worksheet, quiz, and weekly-test scores.
• Attendance records you log for compliance/reporting purposes.

We do not collect a child's email address, a login credential for the child, precise location, biometric data, or any data directly from the child — every field above is entered by the parent through the Parent Workspace.

5. Where it's stored

By default, everything about your child stays in your own browser's local storage on your device — it never reaches our servers unless you explicitly export or print it.

The one exception: when you generate an AI teaching pack, the lesson's topic, subject, and grade band (e.g. "The Water Cycle", "Science", "Key Stage 1") are sent to our AI content partner, Anthropic, solely to generate slides, quizzes, and worksheets. We never send your child's name or any other identifying information as part of that request.

If you sign in to sync your parent account across devices, your own name and email (not your child's data) are stored with our authentication provider, Supabase, so you can log back in from another device.

6. What we don't do

We do not use a child's data for behavioural advertising, build advertising profiles of children, or sell or rent children's data to third parties — ever.

7. How long we keep it

Data is kept for as long as the student profile or account exists. Removing a student from the Students tab deletes their records from your device immediately. Resetting or deleting your account removes everything, including any copy of your (parent) contact details held on our servers.

8. Your rights — and your child's

Under GDPR Articles 12–23, you can, on your child's behalf: access what's held, correct it, erase it ("right to be forgotten" — Recital 65 specifically calls this out as important for data collected as a child), restrict or object to processing, and export a portable copy. Because most of this data lives on your own device, you can already do most of this yourself, at any time, from within the app. For anything held on our servers — your parent account record or marketing preferences — contact us and we'll action your request within 30 days.

9. Withdrawing consent

You may withdraw your consent at any time by deleting your child's profile or your whole account. This won't affect the lawfulness of anything already processed before you withdrew it.

10. Security

Data in transit is encrypted (HTTPS). Server-side credentials that could read or write account records are kept out of the browser entirely and never exposed to end users.

11. International transfers

Our service providers (including Supabase and Anthropic) may process data outside the country you live in. Where that includes transfers outside the EEA/UK, we rely on their respective data processing agreements and standard contractual clauses.

12. Contact us / complaints

Questions, access/erasure requests, or concerns about how we handle your child's data: privacy@homeschul.com. You also have the right to lodge a complaint with your local data protection supervisory authority at any time.