Privacy Policy

Homeroom.AI ("we," "us," or "our") operates the website www.homeroom-ai.com and the Byte-Sized AI web application (collectively, the "Service"). This Privacy Policy explains how we collect, use, and protect information — with special attention to children's privacy.

1. Our Commitment to Children's Privacy

Homeroom.AI is designed for children ages 5–8 and is fully compliant with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verified parental consent.

Before any child can use the Service, we require verifiable parental consent through our "Email Plus" verification method (an FTC-approved mechanism), which includes:

• Parent/guardian providing their full legal name
• Email verification via a 6-digit code sent to the parent's email address
• Explicit consent checkbox acknowledging data collection practices

2. Information We Collect

From Parents/Guardians (account holders)

• Email address — used for account creation, authentication, COPPA verification, and transactional emails (password resets, subscription receipts)
• Full name — collected during the COPPA consent process to verify parental identity
• Payment information — processed securely by Stripe. We never see, store, or have access to credit card numbers

From Children (with parental consent)

• First name only — used to personalize the in-app experience (e.g., "Great job, Alex!")
• Age — used to tailor content difficulty
• Game progress — episodes completed and stars earned, stored to track learning progress

What We Never Collect From Children

• Last names, photos, videos, or audio recordings
• Location data or GPS coordinates
• Device identifiers, advertising IDs, or persistent identifiers for tracking
• Contact information of any kind
• Social media accounts or friend lists

3. How We Use Information

• To provide and operate the Service
• To personalize the child's learning experience
• To process subscription payments via Stripe
• To send transactional emails (verification codes, password resets, subscription confirmations) via Resend
• To comply with legal obligations, including COPPA

We do not use any collected information for advertising, marketing to children, or behavioral profiling.

4. Analytics

We use Umami, a privacy-first analytics platform, to understand general site usage (page views, session counts). Umami:

• Does not use cookies
• Does not collect personal information
• Does not track users across sites
• Does not store IP addresses
• Is fully GDPR and COPPA compliant

We do not use Google Analytics, Facebook Pixel, or any advertising-based analytics tools.

5. Third-Party Services

We use a limited number of third-party services to operate the platform. Each is chosen for its privacy practices:

• Supabase — database and authentication. Stores account data and child profiles. SOC 2 Type II certified.
• Stripe — payment processing. Handles all credit card and billing data. PCI DSS Level 1 compliant.
• Resend — transactional email delivery. Sends verification codes and account-related emails only.
• Umami — privacy-first web analytics. No personal data collected.
• Vercel — website hosting. Serves the static site files.

We do not share, sell, rent, or trade any personal information with third parties for advertising or marketing purposes.

6. Data Storage and Security

All data is stored in Supabase's secure cloud infrastructure with encryption at rest and in transit (TLS 1.2+). Payment data is handled entirely by Stripe and never touches our servers. Access to production databases is restricted and requires authenticated access.

7. Parental Rights

As a parent or guardian, you have the right to:

• Review your child's personal information at any time
• Request deletion of your child's account and all associated data
• Refuse further collection of your child's information
• Revoke consent at any time, which will result in the deletion of your child's profile

To exercise any of these rights, email us at help@homeroom-ai.com. We will respond within 48 hours and complete deletion requests within 30 days.

8. Data Retention

We retain account data for as long as your account is active. When you delete your account or request data deletion:

• Child profiles and progress data are deleted immediately
• Parent account data is deleted within 30 days
• Stripe retains payment records per their own retention policy and legal requirements
• Anonymized analytics data (with no personal identifiers) may be retained

9. No Social Features

The Service contains no social interaction, chat, messaging, comments, forums, user-generated content, friend lists, or any features that allow children to communicate with other users. Children interact only with pre-built educational content.

10. No Advertising

The Service displays no advertisements of any kind — no banner ads, no sponsored content, no in-app purchases beyond the parent-managed subscription. There is no advertising SDK or tracking pixel on the platform.

11. External Links

The Byte-Sized AI game experience contains no external links. The landing page at homeroom-ai.com may contain links to our social media profiles and third-party service providers (Stripe, Supabase). We are not responsible for the privacy practices of external sites.

12. Changes to This Policy

If we make material changes to this Privacy Policy, we will notify parents via email and update the "Last Updated" date at the top. We will obtain fresh parental consent if we begin collecting new categories of information from children.

13. Contact Us