Legal

Privacy policy

Current version: 2.1.0 — effective September 26, 2026

This policy governs Homeschool Harbor, available at ourhomeschoolharbor.com. It is operated by Jason Hudson, an individual (there is not yet a separate formed company), who is the contact for privacy questions, the data-protection contact named in our breach-response process, and the person who receives any parental-rights request under this policy. Reach us at [email protected].

Notice to parents: this service is directed to children

Homeschool Harbor’s core feature is a shared dashboard that includes a family’s children. We knowingly collect information about children under 13 as part of that feature, so the Children’s Online Privacy Protection Act (COPPA) applies to us, and we design around that rather than argue we are exempt. A child never signs up for Homeschool Harbor directly: only a parent or guardian, inside their own adult account, can add a child profile to a household. A child has no email address, no password-reset path, and no way to create or control their own account.

What we collect about a child

Everything below comes directly from our own schema audit (maintained as an internal engineering document and re-verified before each change to this policy), not written from memory:

• Profile: a display name the parent chooses, an optional profile photo, and a display color. A child may optionally sign in with a PIN (on a shared family device) or a parent-managed username and password; we store only a cryptographic hash of a PIN or password, never the value itself.
• Activity: which chores or curriculum items a child has completed and when, an optional free-text note attached to a completion, an optional photo as evidence of a completed task, points earned and spent, curriculum/course assignments and per-lesson progress, and personal goals the child or a parent creates (a title and an optional, longer free-text description).
• Device/session: records of shared-device “kiosk” lock and unlock events, and sign-in session metadata (an IP address and browser/device identifier) kept for security purposes.

We deliberately do not collect, and have no field anywhere in our systems for, a child’s date of birth, email address, phone number, physical address, school name, or a legal name distinct from the display name a parent chooses. A small number of fields (a chore-completion note, a curriculum-adjustment note, and a goal description) are free text a family can type anything into; we do not scan, analyze, or repurpose that text — it is simply displayed back to the household that entered it, and we call it out here because it is the one place a family could accidentally type something more identifying than we otherwise ask for.

Verifiable parental consent

Before a parent can add a child to their family account, we require explicit parental consent. The signed-in adult must attest that they are the child’s parent or legal guardian and give permission to create the profile. This flow is available on free and paid plans. We keep an append-only consent record for every child (who consented, when, which version of this policy they agreed to, and the request context for the attestation), separately from the child’s own profile data, and a parent can review it at any time from their account.

How we use this information

Solely to run the product: to show your family its shared dashboard, track chores, points, curriculum progress and goals, bill your household’s subscription, send transactional email and push notifications about your own household’s activity, and keep your account secure. We do not use any child’s information, or any household’s information, for advertising. We do not use, and have never used, any advertising, attribution, or analytics SDK or service, and we have no plans to.

Goals can be for one or several people. A goal and its progress are visible only to the people on it and household owners or parents. Each person has their own reminder settings and private in-app reminder inbox, which can show the goal title; a parent cannot read a child’s reminder inbox. Goal push reminders go only to adults and contain generic text and an identifier that opens the goal, with no goal title, description, or person’s name. We do not send push reminders for a goal that is for a child, including to an adult who is also on that goal. Goal reminders are not sent by email.

Who we share information with

We use a small number of service providers to operate Homeschool Harbor, each under contract and limited to the purpose below. None of them is an advertising, attribution, or analytics vendor.

• Stripe — payment processing and subscription billing; also the source of our verifiable-parental-consent evidence. Stripe never receives a child’s name, photo, PIN, or activity.
• Resend — delivers our transactional email (account verification, password reset, invitations, and curriculum rollover notifications) to the adult’s email address on file. A notification email can include a child’s display name in its body.
• Expo Push API — delivers push notifications to our mobile app; a notification can reference a child’s activity (for example, a rollover-review summary). Goal reminders use only generic text and an opaque goal identifier; Expo receives no goal title, description, or child’s name for these reminders.
• Cloudflare R2 — private object storage for uploaded photos (avatars and chore-completion evidence) and encrypted weekly database backups.
• Cloudflare CSAM Scanning Tool — automated scanning of served copies of uploaded images, to detect known abusive imagery. It runs only against already-served derivative images, not our private storage of originals. See our safety reporting page.

We also use infrastructure hosts to run our servers and database — Neon (database), Fly.io (application servers), and Vercel (this web app) — under the same limited, contractual terms.

Parental rights and controls

A parent can review everything Homeschool Harbor stores about their child from inside the app, or with a full, portable account data export. A parent can correct a child’s display name or photo at any time without contacting us. A parent can revoke consent and request their child’s removal at any time — doing so has one of two outcomes, and we describe both plainly:

• Deleting the whole household deletes it entirely. We hold it read-only for a 30-day recovery window (in case the request was a mistake) and then permanently and irreversibly purge substantially all of its data — including every child’s profile, photos, sign-in credentials, and activity — from our production systems.
• Removing a single member — including revoking a child’s consent while keeping the rest of the household — anonymizes that member; it does not delete their history. We delete the member’s display name, profile photo, and any sign-in credential outright. But we keep the shared record of that member’s chore completions, points, curriculum progress, and goal history, attached to an anonymized, no-longer-identifying member row (shown in the app only as “Removed member”). We keep it because that history is shared family record: other members’ point totals, reward history, and the household’s shared activity log are computed from it, and deleting those rows would corrupt everyone else’s history, not only the removed member’s. This is a deliberate trade-off and we are stating it plainly rather than leaving it implicit.

How long we keep information, and the two retention exceptions

We keep a household’s information for as long as the household exists. When an owner requests full household deletion, we hold it read-only for 30 days and then permanently purge it. We name exactly two exceptions to that purge, and there are no others:

• Billing records, 7 years. We retain a minimal billing-event record — an invoice reference and the date it occurred, never card numbers and never any child data — for seven years after a household is purged, because tax and accounting law requires us to be able to substantiate past transactions for that long.
• There is no consent-record retention exception. We had earlier planned to keep parental-consent evidence for three years after a household was purged; we decided against that and removed it. A consent record is purged along with the rest of a household’s data — it receives no special retention.

Separately, background operational audit-log entries (a record of who did what, kept for security and abuse investigation) are retained for up to two years; any free-text detail in an audit entry referencing a member is cleared at the moment that member is removed, even though the entry’s identifiers are kept.

Security

We encrypt data in transit, store PINs and passwords only as cryptographic hashes, and keep uploaded photos in a private storage bucket with no public route. If we ever learn of a breach affecting your data, we will notify affected households and follow our published breach-response process, using the contact named at the top of this policy.

Where we operate

Homeschool Harbor currently operates in the United States only. We are not offering the service to residents of the European Union or United Kingdom, and this policy does not address the GDPR.

No sale, no advertising, no public disclosure

We do not sell a child’s personal information. We do not use it for behavioral advertising. We do not publicly disclose it. This is a firm commitment, not a default we might change without telling you first.

Changes to this policy

This policy is versioned. Whenever we publish a new version, every household must review and accept it again before continuing to useHomeschool Harbor — the app will prompt for this automatically. The exact version you accepted, and when, is recorded as part of your household’s consent evidence.

Contact us

Questions about this policy, or a parental-rights request: [email protected].