What this app holds, and who can see it

The short version

This is a homeschooling app used by one family. It holds a record of a child's schooling — what they have been taught, what they found hard, and how their practice went. That record is private to the household, sits behind a password, and is never sold, shared or used to train anything.

What is stored

• Children. A first name, the grade they are doing, and the date they were added.
• Teaching records. Which units have been taught, which parts of a day were done, notes a parent wrote about a day, and observations about the child.
• Games. One row per finished round: which activity, how many questions were right out of how many were asked. Not which answers a child gave.
• Work. Questions a parent wrote, and who they were for.
• Photographs of work. Pictures a parent chose to take of a finished page, with the subject and the day it was done. These are the most sensitive thing here — a page can carry a child's handwriting, their name, or their face — so they are stored in this same database rather than a third-party bucket, and are only ever served to a signed-in parent of that household.
• Notes. The assistant's memory — a plain-text file per topic, written by the assistant and readable and editable by the parent.
• Accounts. A username, a password stored only as a salted hash, a role, and optionally one Google address permitted to sign in.
• A change log. What changed and when, never the content of the change.

What is not stored

No address, phone number, date of birth, location or device identifier. No photograph of a person: the portfolio is for photographs a parent deliberately takes of finished work, and nothing takes a picture on its own. No advertising or analytics of any kind — there is no third-party script on any page. Nothing about a child is ever included in a page that can be shared publicly.

Who can see it

A parent account can see everything in their own household. A child account can reach only the games and their own assigned work — never the assistant, never another child's record. Every query is scoped to one household, so one family's data is not reachable from another's account.

Where it goes

The data sits in a Postgres database hosted by Neon, in the United States. Messages typed into the assistant are sent to Anthropic's API to produce a reply, along with the assistant's notes and the current week's plan; Anthropic does not train on API traffic. Nothing else leaves the app. Fonts are served from the app itself rather than from a font host, so opening a page does not tell anybody else that you did.

Children, and consent

The subject of this record is a child under 13, so COPPA applies. It is currently operated by that child's own parents for their own child, which is the case COPPA does not restrict.

Adding another family's child requires that child's parent to give verifiable consent first, and to have read this notice. That is a conversation between the families, not a setting in the app.

Seeing it and deleting it

A parent can ask the assistant to export everything held about a named child, and get it back in full. A parent can also ask it to delete a child: that removes the child record, the work aimed at them, their game history, their tier settings, every photograph of their work, and their sign-in. It requires the name to be given twice, because it cannot be undone.

Shared household notes are not deleted by that, because they belong to the whole household — they are plain text and can be read and edited directly.

What is not true yet

Being straight about the gaps: there is no formal retention policy, so records are kept until somebody deletes them. There is no way to revoke a single sign-in session before it expires, which takes twelve hours. Backups taken to a local machine hold the same data, including password hashes. These are written down in the project's compliance notes rather than left to be discovered.

Asking

The app is run by the family that uses it. Ask them.