Privacy Policy

HomeLearnGrow is operated by Kimlay Ventures LLC, a Pennsylvania limited liability company doing business as HomeLearnGrow, located at 501 E Main St, Suite D, Palmyra, PA 17078. Questions and privacy requests may be sent to privacy@homelearngrow.com. General support is available at support@homelearngrow.com.

The service is available in the United States only to parents and guardians who are 18 or older. No child accounts are available. When adding child information, the parent or guardian confirms they are authorized to provide it for the family workspace.

We collect information that a parent or guardian provides to create and use a private family workspace, such as account email address, family workspace details, child display name, optional birth year or grade band, planning preferences, activities, attendance, and parent-approved learning records.

New photo and file uploads are currently paused. Existing private evidence may include supported documents, images, or text and remains available to its authorized family. Parents should not add medical, diagnostic, disability, legal, accreditation, financial-account, or other sensitive information that is not needed for a homeschool record.

We also process limited service information, such as sign-in/session state, security and error information, and, when product analytics are enabled, coarse product events. We do not intend to place raw child names, activity notes, uploads, evidence text, or AI draft text in analytics or error-monitoring events.

We use information to provide and secure the family workspace; maintain family-scoped records, planning, attendance, portfolio, and private export features; respond to support requests; prevent misuse; and improve the service. We do not sell personal information or use the service to advertise to children.

AI help is optional and only available after the responsible adult provides the in-app consent required for that feature. When a parent requests an AI draft, we send a minimized planning or record context to the configured AI provider to return a structured, editable suggestion. AI output is non-authoritative: it does not automatically schedule a week, create a learning record, mark attendance, or make educational, legal, medical, or diagnostic decisions. A parent must review and explicitly apply or approve any result.

The AI provider for this feature is the OpenAI API; its applicable privacy terms are at https://openai.com/enterprise-privacy(API data is not used for model training under OpenAI’s API terms). Only a minimized planning context leaves the service (subjects, week structure, goal wording, age band); a child’s name, birthdate, and excluded sensitive categories are never sent. Each family plan includes a monthly AI draft allowance; when it is reached, AI requests pause until the next billing month.

Family data is designed to be segregated by family workspace. Private uploads and generated reports are stored privately; report downloads use short-lived access links. Authorized vendors may process information only to provide approved service functions, such as authentication/database hosting, file storage, payment processing, transactional email, error monitoring, analytics, bot protection, hosting, and optional AI processing.

The vendors used to operate the service are:

• Vercel — application hosting; US region; DPA at vercel.com/legal/dpa.
• Supabase — authentication, database, and private file storage; account email, family workspace data, uploads, and learning records, all family-scoped with private buckets; US region; DPA at supabase.com/legal/dpa.
• Resend — transactional account and support email; recipient email address and message content only, no child data in email bodies; US processing; DPA at resend.com/legal/dpa.
• Stripe — we use Stripe to process subscription billing; parent name/email, payment method (held by Stripe, never by us), and subscription status, no child data. HomeLearnGrow does not store full payment-card details; DPA at stripe.com/legal/dpa.
• Sentry — we use Sentry for error monitoring; technical event data only, no child content in events.
• Cloudflare Turnstile — we use Turnstile for bot protection on public forms such as signup; it processes technical request signals only.
• PostHog — we may use PostHog for coarse product analytics; technical event data only, no child content in events.
• OpenAI — we use the OpenAI API for optional AI drafts as described above, only when a parent requests a draft.

We may also disclose information when required by law or to protect people, rights, property, or service security.

We retain information while a family workspace is active. After a verified deletion request, we target deletion within 30 days, except where limited backup, legal, security, or dispute-resolution obligations require retention.

The retention schedule is:

• Account and family workspace data, uploads, and learning records— retained while the account is active; hard-deleted from the live database (including private-bucket objects) within 30 days of a verified deletion request or account closure. Deleted database records may remain in provider database backups for the provider’s stated backup cycle. Supabase database backups do not include private Storage object bytes.
• Audit, security, and error logs — kept 12 months, then deleted; logs record field names and counts, not content. Retention may be extended only for an active security investigation.
• Billing, tax, and payment records — kept 7 years, held primarily by Stripe; not deleted on account closure.
• Generated export artifacts— a completed private report/export file is automatically deleted 7 days after completion; the parent’s downloaded copy is theirs to keep. This artifact cleanup is a housekeeping measure for generated files only and is not the retention policy for family data, which is governed by the schedule above.

Deletion requests must come from the account’s registered email address; we reply to that address to verify before acting and disclose no data to any other address. We acknowledge requests within 5 business days, target completion within 30 days, and send a confirmation email on completion.

Parents and guardians may update certain workspace information, decide whether to use optional AI help, request support, and request access, correction, export, or deletion where applicable law provides those rights. Contact privacy@homelearngrow.com. We may need to verify the request and may retain limited information where required or permitted by law.

HomeLearnGrow is for parents and guardians, not children acting on their own. We do not offer student accounts. The parent or guardian is the account holder, enters any child information themselves, and controls that information, including updating, exporting, or deleting it. We do not knowingly collect personal information directly from a child, and we do not sell children’s information or use it for advertising.

The account holder must be 18 or older and the parent or legal guardian of each child profile they create; children never hold accounts.

We use reasonable technical and organizational measures intended to protect information, including authenticated access, family-scoped authorization, and private storage design. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

We may update this policy as the service changes. If we make a material change, we will provide notice as required by applicable law. Contact us at privacy@homelearngrow.com with questions. Security reports may be sent to security@homelearngrow.com. See also the Terms of Use.