Welcome to Homeducate. We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our homeschool management platform.
By using Homeducate, you agree to the collection and use of information in accordance with this Privacy Policy.
For the complete, detailed Privacy Policy, please see: PRIVACY-POLICY.md
📌 Quick Summary
What we collect: Email, username, educational data you enter, payment info (via Stripe), basic usage data
Optional wellbeing notes: If you switch on Wellbeing & Support, you can record health and wellbeing information. This is off by default, needs your explicit consent, and is deleted if you turn it off (see section 8)
Why: To provide the homeschool planning service, manage subscriptions, improve the platform
Who we share with: Stripe (payments), Supabase (database), Resend (emails) - We do NOT sell your data
Your rights: Access, download, correct, or delete your data anytime
Contact: privacy@homeducate.com
1. Information We Collect
Personal Information You Provide:
- Account: Email, username, password (encrypted)
- Profile: Family name, student names, exam dates
- Educational: Subjects, timetables, work logs, assignments, resources
- Wellbeing & Support (optional, only if you enable it): Daily mood, sleep and energy check-ins, notes about difficult moments and what helped, support goals and adaptations (see section 8)
- Payment: Billing info (processed by Stripe)
Automatically Collected:
- IP address, browser type, device info
- Session cookies (authentication only)
- Usage data (pages visited, features used)
2. How We Use Your Information
- Provide and maintain the Homeducate platform
- Manage your account and authentication
- Process subscription payments
- Send important emails (verification, password resets, billing)
- Improve the service and fix bugs
- Comply with legal obligations
3. How We Share Your Information
We do NOT sell, rent, or trade your personal information.
We only share with:
- Stripe: Payment processing (EU-based)
- Supabase: Database hosting (EU data centers)
- Resend: Transactional emails
- Authorities: Only if legally required
4. Your Data Protection Rights (GDPR)
Under GDPR, you have the right to:
- Access: Request copies of your data
- Rectification: Correct inaccurate data
- Erasure: Delete your data ("right to be forgotten")
- Restrict Processing: Limit how we use your data
- Data Portability: Download your data in machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent at any time
- Lodge Complaint: File complaint with UK ICO
To exercise these rights: Email privacy@homeducate.com - We'll respond within 30 days.
5. Data Security
Security Measures:
- ✅ Password encryption with bcrypt
- ✅ HTTPS/SSL encryption for all data
- ✅ Organization-scoped access control
- ✅ Token-based authentication
- ✅ Rate limiting against attacks
- ✅ Regular backups
6. Data Retention
- Active Accounts: Data retained during subscription
- Cancelled Accounts: 30 days grace period, then permanently deleted
- Tax Records: 6 years (UK legal requirement)
7. Children's Privacy
- Parent/guardian accounts must be 18+ years old
- Parents create and control all student accounts
- We collect only essential educational data for students
- We collect no sensitive personal data about children by default. Health and wellbeing information is only recorded if a parent switches on the optional Wellbeing & Support feature (see section 8)
- Parents can access, edit, and delete all student data
8. Wellbeing & Support Data (Optional)
Wellbeing & Support is an optional feature. If a parent switches it on, the account can record information about a child's health and wellbeing. Under UK GDPR this is special category data, so we handle it with extra care.
- What may be recorded: daily self-rated mood, sleep and energy scores and optional notes; notes about difficult moments (what led up to them, what helped, recovery time); support goals; and adaptations in place (for example extra time or breaks)
- Why: to help families understand patterns, plan support, and, if the parent chooses, evidence the provision they make for their child
- Lawful basis: your explicit consent (UK GDPR Article 9(2)(a)), given by the parent or guardian when they switch the feature on. It is never turned on automatically
- Who can see it: the parent accounts in your family and the child's own login (which can only see their own check-ins, goals and adaptations; difficult-moment notes are visible to parents only). Our staff do not access it unless you ask for support. It is not shared with other families, tutors or advertisers
- Reports: it is never included in a report or export for a Local Authority unless you tick the option to include it each time
- Analytics: this area is excluded from session recording and heatmaps
- Withdrawing consent: a parent can turn the feature off at any time in the Wellbeing tab. Doing so permanently deletes all wellbeing data held for your family. Individual entries can also be deleted at any time
- Retention: kept until you delete it, withdraw consent, delete the student, or your account is deleted. It is included in the data download (Export Center → My Data)
- Not medical advice: it is a record-keeping tool. It does not diagnose, assess or monitor any condition, and we make no automated decisions about your child from it
9. Cookies & Analytics
We use minimal cookies:
- Authentication Cookie: Keeps you logged in (essential, cannot be disabled)
- Optional Analytics (Microsoft Clarity): Heatmaps and session replays to help us improve the app — only if you opt in via our consent banner. Typed text and student details are masked, and you can withdraw consent at any time
- Cookieless Page Counts (Rybbit): Privacy-friendly visit counting; sets no cookies and does not identify you
- No Advertising: No ad networks or retargeting
- No Social Media Tracking: No Facebook/Twitter pixels
10. International Data Transfers
Homeducate operates from the UK. Data may be transferred to/processed in UK/EU with adequate protection through:
- EU-based service providers where possible
- Standard Contractual Clauses (SCCs) for non-EU transfers
- Full GDPR compliance
11. Your Responsibilities
To help protect your data:
- Keep your password secure (8+ characters, mixed case)
- Don't share your account
- Log out on shared devices
- Report suspicious activity immediately
12. Contact Us
Questions about privacy?
- Email: privacy@homeducate.com
- Website: homeducate.online
- Response Time: Within 30 days
UK Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
13. Updates to This Policy
We may update this Privacy Policy. When we do:
- We'll update the "Last Updated" date
- We'll email you about material changes
- Continued use constitutes acceptance
⚠️ Important
This is a summary for readability. For complete legal details, please refer to the full Privacy Policy document in our legal folder.
By using Homeducate, you acknowledge that you have read and understood this Privacy Policy.