Privacy Policy

1. Information We Collect

Parent account information: Email address and authentication credentials (via Google OAuth or email magic link).

Child profile information: First name, age band, grade band, tutor personality preference, and learning preferences. We do not collect children's email addresses or direct contact information.

Usage data: Chat transcripts between children and AI tutors, topic selections, spelling practice results, homework photos (if uploaded), and session metadata (duration, message counts).

Device information: Device tokens for linked devices, browser type, and basic analytics data.

2. How We Use Your Information

• To provide personalized AI tutoring tailored to your child's grade level and interests
• To track learning progress and generate parent summaries
• To enforce safety filters and keep content age-appropriate
• To process payments and manage subscriptions
• To send parent notification emails (daily summaries, safety alerts)
• To improve the quality and safety of our AI tutoring

3. Children's Privacy (COPPA)

TutorSprout is designed with children's privacy as a priority. We comply with the Children's Online Privacy Protection Act (COPPA):

• Child accounts are created and managed exclusively by parents
• We do not collect personal information directly from children beyond what is needed for tutoring
• Parents have full access to all chat transcripts and can review their child's activity
• Parents can delete their child's profile and associated data at any time
• All child-facing content passes through multi-layer safety filters

4. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL) with row-level security policies. Authentication is handled through industry-standard protocols. Payment information is processed by Stripe and is never stored on our servers.

5. Third-Party Services

We use the following third-party services:

• Supabase: Database and authentication
• Anthropic (Claude): AI tutoring responses
• OpenAI (Whisper): Voice-to-text transcription
• Stripe: Payment processing
• Vercel: Application hosting
• Resend: Email delivery

6. Data Sharing

We do not sell your personal information. We share data with third-party services only as necessary to provide the Service (as listed above). We may disclose information if required by law.

7. Your Rights

You have the right to:

• Access all data associated with your account and your children's profiles
• Review all chat transcripts via the parent dashboard
• Delete child profiles and their associated data
• Cancel your account and request data deletion
• Opt out of non-essential email communications

8. Data Retention

We retain your data for as long as your account is active. When you delete a child profile, associated chat transcripts and learning data are permanently removed. If you cancel your account, we retain data for a reasonable period to allow for reactivation, after which it is deleted.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at larry.waldman@gmail.com.