Last updated October 14, 2026.

Roots & Wings ("we," "us") is created for and used by parents and guardians on behalf of their household, including their children. This policy explains what we collect from the parent who holds the account and about the children in that household, why, and what rights you and your children have over that information.

Information we collect

Account & household data. Your email and password are managed by our authentication provider (Supabase) — we never see or store your password ourselves. We also store your display name and household settings. At sign-up we ask for your birthdate only to confirm you're 18 or older — we record that the check passed, not the date itself.

Consent records. We keep a record of when you agreed to our Terms and this policy (and which version), and when you consented to our notice about children's information before adding your first child.

Children's profiles. Each child profile (name, grade, birthdate, subjects, interests, strengths, growth areas, learning style, and an optional photo) is entered by you and used only to generate and personalize that child's lessons and activities. It is never shown to other families.

Learning differences. You can optionally tell us about how a child learns best — for example dyslexia, ADHD, sensory needs, or an IEP or 504 plan. We treat this as sensitive: it's shown only to your household, and it's used only to tailor that child's lessons and assessments (see "AI processing" below).

Learning activity. When your child uses the Student Portal, we store their worksheet and assessment answers, game results (coins, streaks, and questions to revisit), attendance, and grades or test scores you record, so you can see their progress and keep homeschool records.

Photos and documents you upload. Child profile photos, Memory Book photos, Travel Journal photos, and compliance documents (such as notices of intent, evaluations, or IEP/504 paperwork) are stored in private cloud storage — never a public location. They're only ever displayed to you through temporary links that expire after an hour. Removing one deletes the underlying file, not just its reference.

Gratitude reflections & Community sharing. In the Student Portal, your child can write a short daily gratitude reflection. These stay private to your household by default, and are used to create your weekly family recap (see "AI processing"). If you choose to share one to Community, it's posted under your own name — never your child's.

State / country. We ask which U.S. state (or country, if you're outside the U.S.) your family is in so lessons can be aligned to the academic standard that state or country actually uses, rather than a generic national framework. This is never shown to other families.

ZIP code. You can optionally add your ZIP code in Settings. We use it to show local weather and suggest nearby activities, and — only if you opt in to Community — to compute a rounded distance range to other opted-in families. It is never shown to anyone as an exact address or ZIP code.

PINs. Student Portal PINs (and the parent PIN that unlocks the parent dashboard from the portal) are stored only as salted one-way hashes — a form no one, including us, can read back into the original PIN.

Payments and print orders. Subscriptions and print orders are paid through Stripe; we never see or store your full card number. If you order a printed workbook or journal, your shipping details are stored and shared with our print partner to fulfill that order, and not used for any other purpose.

AI processing. Lessons, assessments, activities, and print content are generated using Anthropic's Claude API. To do that, we send Anthropic only what each request needs:

• For lessons and assessments: the child's first name, grade, interests, strengths, growth areas, and any learning differences you've entered.
• For your weekly family recap: your child's gratitude reflections from that week.
• For local family-activity ideas: your household's city and state.
• For Community moderation: the text of posts and comments, before they're shown.

AI-generated content can contain mistakes. Please review it before relying on it.

Email. We send account emails (sign-in links, worksheet answer keys you request) and an optional weekly recap, which you can turn off in Settings or with the unsubscribe link in any recap.

Basic technical data. Like any website, our hosting provider logs standard technical information (such as IP address and browser type) for security and reliability.

Site analytics. We use a cookieless analytics tool (Plausible) to understand aggregate traffic (like which pages are visited and how many people sign up) — it doesn't use cookies, doesn't track you across other sites, doesn't identify individual visitors, and is turned off entirely in the Student Portal.

Error monitoring. When something breaks, an error-monitoring service (Sentry) receives technical details about the error so we can fix it. It's configured not to collect personal information or record sessions.

Cookies. We only use cookies that are needed for the site to work — keeping you signed in and remembering which child is using the Student Portal. We don't use advertising or tracking cookies.

How we use information

To personalize lessons, activities, and print content for each child; to run your household account and the optional Community features you opt into; to moderate Community content for safety; and to fulfill print orders. We don't sell your data, we don't use your family's information to train AI models, and we don't use children's information for behavioral advertising.

Children's privacy (COPPA)

Roots & Wings is designed to be used by a parent or guardian on behalf of their children — not signed up for directly by a child.

Only adults create accounts. Signing up requires confirming you're 18 or older; children never create their own account or log in independently of a parent enabling that access.

Parental consent. Before adding a first child, the parent reviews a notice describing what we collect about children and how it's used — including that it's shared with our AI provider to create lessons — and gives consent. We record when that consent was given.

What children provide directly. In the Student Portal (which a parent turns on and protects with a PIN), a child can answer worksheets and assessments, play learning games, and write gratitude reflections. Those are visible to their parent and used as described above.

Parents stay in control. All profile information about a child is entered by their parent, who can review every generated lesson and activity, and can review, edit, or permanently delete that child's information at any time from the Children page.

Deleting an account deletes everything. Deleting your household account cancels any paid plan and permanently removes every child profile and all associated data — lessons, gratitude entries, print orders, uploaded photos and documents.

We do not knowingly collect information directly from a child independent of their parent's account, and we never sell a child's information.

A note on FERPA

FERPA governs student education records held by schools and school districts that receive federal funding. Because Roots & Wings is used directly by families rather than by a school, it likely does not directly apply to us — but this should be confirmed with counsel, particularly if any school or district ever uses Roots & Wings on behalf of their students.

How we share information

We never sell your information. We share it only with service providers acting on our behalf, under obligations to protect it:

• Supabase — database, authentication, and file storage
• Vercel — website hosting
• Anthropic — AI generation and moderation (see "AI processing")
• Stripe — payments
• Resend — sending email
• Lulu — printing and shipping physical orders
• Sentry — error monitoring
• Plausible — cookieless, aggregate site analytics
• Open-Meteo and Zippopotam.us — weather and ZIP-code lookups (they receive a ZIP code or approximate coordinates, never your name)

Other families only ever see what you explicitly choose to share — your display name, a Community post or comment you wrote, or a rounded distance bucket — never a child's name or anything you haven't chosen to post. We may also disclose information if required by law or to protect someone's safety.

Data retention & deletion

We keep your information while your account is active. You can permanently delete your account at any time from Settings — this cancels any paid plan and irreversibly removes your household, every child profile, all associated lesson, gratitude, and print history, and every photo and document you've uploaded. Copies may remain in our providers' encrypted backups for a limited period until they're overwritten. Payment records are kept by Stripe as required for tax and accounting.

Security

Authentication is handled by Supabase using industry-standard practices; we never store your password ourselves. Student Portal PINs are stored as salted one-way hashes and lock out after repeated incorrect attempts. Uploaded child photos are stored privately and served only through temporary, expiring links. All traffic to this site is encrypted.

Your rights and choices

Everyone. Regardless of where you live, you can access, correct, or delete your (and your children's) information at any time in the app, or by contacting us, and you can opt out of Community and location sharing at any time. You can download a copy of your household's data from Settings → Download my data.

California residents. Under the CCPA/CPRA, you have the right to know what we collect, delete it, correct it, opt out of the sale or sharing of it (we don't sell or share data as those laws define it), limit use of sensitive information, and not be discriminated against for exercising these rights. Separately, because Roots & Wings processes information about K-12 students, we don't use a child's information to build advertising profiles or for targeted advertising, and we don't sell it — consistent with California's SOPIPA requirements for operators of school-related sites and services.

Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws. You have the right to access, correct, delete, and obtain a portable copy of your data, and to opt out of targeted advertising, sale, and profiling — we don't do any of these. To exercise these rights, contact us using the information below; we won't discriminate against you for doing so.

Every other U.S. state. Even where a state doesn't yet have a comprehensive privacy law of its own, we apply these same access, correction, and deletion rights to every user, regardless of state.

Outside the United States. If applicable law — such as the EU or UK GDPR — grants you additional rights (access, correction, erasure, restriction, portability, or objection), we honor them for any user, regardless of location.

Changes to this policy

We may update this policy as the platform develops. We'll note meaningful changes here.

Contact us

To exercise any of the rights described above, or with questions about this policy, contact us at privacy@rootsandwingsco.com.