Privacy Policy

My Learning Shell complies with the Children's Online Privacy Protection Act (COPPA). Children under 13 cannot independently register an account. There are two consent paths: (a) Parent-managed accounts — a verified parent or guardian creates the child's account and completes Verifiable Parental Consent (VPC) through a $1.00 credit card authorization that is refunded immediately. The Stripe transaction ID is retained as the COPPA verifiable-consent audit record. (b) School-consent accounts — a school administrator authorizes a teacher (via our magic-link attestation flow) who then creates student accounts directly in the classroom. Under COPPA's school-consent exception, the school administrator's authorization stands in for parental consent for those students. Each student receives a unique Family Code so a parent can link and view the child's workspace.

For parent-managed students, we collect: the child's display name, email address, and grade level; the parent's email address. For teacher-created students, we collect: the student's display name, email address, and grade level; the teacher's name and email; the authorizing school administrator's name and email. We also record a timestamp of each student's most recent login ('last_seen_at') solely to identify accounts that have been inactive for extended periods and may be eligible for dormancy pause (see Data Retention). This timestamp contains no content or activity data. We do NOT collect or require a date of birth, home address, phone number, or any biometric or location data from children. Chat messages the student types are processed to generate tutoring responses (see Data Sharing). We do not sell data, share it with third parties for advertising, or use it to train external machine-learning models.

Student display name, grade level, and chat inputs power the Socratic AI tutor ("Professor Shelly") and tailor guidance to the child's grade band. Progress records track mastery so the curriculum advances appropriately. Parent and teacher emails enable account access, safety alerts, and observer access to the child's work. The Family Code lets a parent link to a school-enrolled student for read-only viewing. Aggregate, de-identified analytics may be used to improve the service.

Our AI tutor uses third-party AI language-model providers (currently Anthropic, Google, and OpenAI) to generate responses. We do not sell your child's data. We are actively confirming with these providers the specific contractual terms governing retention and use of data for model training, and will update this section with those confirmed terms. Safety alerts are emailed to the linked parent or teacher when the AI judges a student's message indicates distress, bullying, or abuse (see Safety Interventions).

Student chat history, game-play records, and progress records for topics not yet mastered are retained for a maximum of 90 days from the date of last activity. An automated daily process permanently deletes ChatHistory, GamePlay, and non-mastered Progress records whose last activity is older than 90 days. Progress records for topics the student has mastered are retained for the life of the account to preserve the student's cumulative learning history and power spaced-repetition review scheduling. Verifiable Parental Consent records (the Stripe transaction audit trail) and school administrator authorization records are retained for the duration required to satisfy COPPA and applicable record-keeping regulations, and are not subject to the 90-day purge. Parents may request earlier deletion at any time (see Parental Rights). Separately, parent-managed student accounts (not school/classroom accounts, which remain under the teacher's control) that have been inactive for more than 12 months are automatically paused: the account is set to a dormant status that blocks login, but all account data — display name, grade level, progress, badges, and consent records — is preserved so the account can be seamlessly reactivated by the parent at any time from the parent portal, with no new consent verification or re-onboarding required. Thirty (30) days before any account is paused, an email notice is sent to the linked parent so they can log in to keep the account active or choose to permanently delete it instead. This automatic pause is reversible and distinct from parent-initiated deletion, which is irreversible and clears the child's display name, grade level, and all session data while retaining the consent audit record for compliance.

Parents and verified guardians retain full control over their child's data. From the parent portal you may, at any time: (a) access and review your child's chat history and progress records; (b) download a complete export of your child's data (chat history, progress, and game records) as a file; (c) delete your child's data and withdraw consent — this permanently deletes the child's chat history, progress, and game records and deactivates the account so the child can no longer log in, while retaining the consent audit record for compliance; (d) generate or revoke shareable Review Codes that grant a teacher temporary, read-only access to your child's work. To exercise these rights, use the controls in your parent portal or reach out to us directly.

Professor Shelly's behavior is governed by built-in safety instructions. When the AI judges that a student's message indicates severe distress, bullying, or abuse, it responds with a caring redirect and triggers an automated email alert to the student's linked parent or teacher, without notifying the student that a flag was raised. The alert email includes a verbatim excerpt of the student's message that triggered the flag so the parent or teacher can assess the situation. The AI tutor uses only warm, age-appropriate language and gently redirects inappropriate language back to the lesson without repeating or engaging with it.

All data is transmitted over encrypted connections. Access to student records is restricted to the linked parent, the authorizing teacher, and authorized school administrators. Row-level security ensures one parent or classroom cannot access another's data. Account passwords are never displayed or stored in plaintext by our application.