Privacy policy

Homeschool Up is a planner and record keeper for homeschooling families. It stores what you plan to teach, what you recorded, and the reports built from that. This page explains what that means for the information you and your family leave in it.

The short version: we do not sell anything about you or your children, we show no advertising, we do not use your records to train anything, and you can export or delete everything at any time.

Who we are

SMC Unlimited Services, which operates Homeschool Up, is the data controller for account information and for the records you create in the app, unless you use it through a co-op or other organization, in which case see Co-ops and organizations below. You can reach us at hello@homeschoolup.com.

What we collect

Your account

Your email address, and your name if you give one. If you sign in with Google we receive your email address, name and profile picture URL from Google, and never your Google password. We also store your timezone and your notification preferences, because reminders are sent in your local morning.

Your family

The family name, your state (so the app can show that state's attendance figures), and the school name, address, signer and title you choose to print on reports. If you invite another adult, we store their email address, their role and which children a tutor may record for.

The records you create

For each child: a first name, an optional last name, an optional grade, and an optional birth date, which is used only on the printed transcript. Then the record itself: subjects, the lessons in each sequence, sessions with a date, minutes, a rating and any notes, learning log entries, assignments and scores, the reading list, expenses, and work samples.

Work samples are photos or PDF files you upload yourself. They are stored in private file storage that nothing outside the app can reach, and they open only for a signed-in member of your family. There is no field for a child's address, phone number, email address, government identifier or health record. Please do not put those in a note or a photo.

Payment

Card details are entered on Stripe's own checkout page and never reach our servers. We store the identifiers Stripe gives us, your plan, its status and its renewal date, so the app knows what you are entitled to, and a one-way fingerprint of the card used to start a free trial, so the trial is taken once.

Technical information

Our host and our database keep short-lived operational logs. When you submit the contact or feedback form we store your browser's user agent string and a one-way hash of your IP address, which is used to stop the form being abused and cannot be turned back into your address. Rate limiting works the same way, on hashes only.

The app keeps an activity log of significant actions on your own family account, such as deleting a child or changing a score. Members of the family can read it; nobody else can.

Messages you send us

If you use the contact or feedback form we keep your email address, your message and the page you sent it from, so we can reply.

Why we use it

• To run the service: the plan, the calendar, the records and the reports.
• To send the emails the service depends on: sign-in links, password resets, receipts, family invitations and the reminders you switched on.
• To take payment and manage your subscription.
• To keep the service standing up: preventing abuse, finding errors, and keeping backups.
• To answer you when you write to us.

Where the UK or EU General Data Protection Regulation applies, we rely on performance of our contract with you for running the service and taking payment, on our legitimate interests in keeping the service secure and working, and on your consent where you have given it, such as reminder emails. You can withdraw consent at any time in Settings.

Who processes it for us

These are the only companies that handle your data, each under contract and only on our instructions. We do not sell data, we do not share it with advertisers, and there are no third-party advertising or tracking scripts on this site.

• Hetzner Online GmbH (Finland, European Union): the servers that run our database and sign-in system. This is where your records live.
• Cloudflare (global): hosting, content delivery, storage of the work samples you upload, the bot check on our forms, and delivery of our emails. The bot check receives your IP address and a token; it does not read the page or set an advertising cookie.
• Stripe (United States): payments and subscription billing.
• Sentry (United States): error monitoring, so we hear about a fault before you have to report it. Reports are scrubbed before they leave our server: no request bodies, no query strings, no cookies, no authorization headers, and record identifiers in a web address are replaced with a placeholder. Names, notes and files are not sent.
• Google: only if you choose to sign in with Google.
• Resend (United States): a fallback path for transactional email if our primary provider is unavailable.

Cookies and local storage

We use no advertising or cross-site tracking cookies, so there is no consent banner to dismiss. What we do set:

• Sign-in cookies that keep you logged in. Removing them signs you out.
• lt_in, a marker that you are signed in, so pages can be routed without a database call.
• lt_pwreset and lt_pwreset_sig, set only when you follow a password reset link, readable only by our server and expiring after fifteen minutes.
• hsu_src, where your first visit came from (the referring site, the landing page and any campaign tags), kept for 90 days so we know which pages bring families. It never leaves our own servers.
• lt_ref, set only if you arrive through someone's referral link, so the referral pass can be applied.
• In your browser's local storage: a draft of the setup wizard, and the date you last dismissed a prompt. These never leave your device.

Children

This is the part that matters most, so it is worth being exact.

• Children never have accounts, never sign in, and never interact with Homeschool Up. We collect nothing from a child directly.
• Everything recorded about a child is entered by a responsible adult: the parent, or a tutor or co-op leader the parent has arranged. By entering it, you confirm you have the authority to do so.
• We ask for the least that makes the tool work. A first name is the only required field.
• Records about children are never used for advertising, never sold, never used to build a profile of a child, and never used to train machine learning models.
• When you delete a child, their records and files are removed. When you delete your account, the family and everything in it goes with it.

If you are a parent or guardian and believe a record about your child is held here by someone without authority, write to hello@homeschoolup.com and we will investigate and act.

Co-ops and organizations

Where a co-op, tutor or other organization sets up Homeschool Up for the families it serves, that organization decides what is recorded and we act on its instructions as a service provider. The organization is responsible for notices to families and for any consent its own rules require. Requests about a specific child should go to the organization first; we will support it in answering them.

Where your data is held

Records are stored in Finland, in the European Union, on servers we run at Hetzner. Work samples are stored by Cloudflare. Our pages are served from a global content network, which means a request may be handled close to you, but the database itself stays in Finland. If you are in the United States, your records are held outside your country. Some providers named above, such as Stripe and Sentry, process limited data in the United States, and they rely on standard contractual clauses where the law requires them.

How long we keep it

• Your records, for as long as your account exists. Cancelling a subscription does not delete anything; your records stay readable and exportable.
• Deleted children and deleted accounts are removed from the live database straight away.
• Encrypted database backups are kept on a rolling basis for disaster recovery and age out on their own, so a deleted record can persist in a backup for a short period before it is overwritten.
• Messages you send us, for as long as needed to deal with them and keep a record of the exchange.
• Billing records, for as long as tax and accounting rules require.

How it is protected

Access rules are enforced by the database itself, not only by the app, so a record can only be read by a member of the family it belongs to, and a tutor sees only the children assigned to them. Files open only for signed-in members of the family. Traffic is encrypted in transit. Passwords are hashed by our sign-in system and checked against known breached-password lists. Access to production systems is limited to the people who run the service.

No service can promise perfect security. If a breach affects your data we will tell you and the relevant regulator as quickly as the law requires.

Your rights

You can do most of this yourself, immediately, without asking us:

• See and correct anything, by opening it in the app.
• Export your whole account as a file, or any sequence as CSV. Settings, then Your data.
• Delete a child, a file, or your entire account with everything in it.
• Turn off reminder emails in Settings.

Depending on where you live you may also have the right to object to or restrict processing, to complain to your data protection authority, and to confirmation that we do not sell or share personal information as those terms are defined in California law. We do not, and we do not discriminate against anyone who exercises a right. Write to us and we will answer within one month.

Changes

When this policy changes we update the date at the top. If a change materially affects how your information is used, we will tell you in the app or by email before it takes effect.

Contact

SMC Unlimited Services, 555 N Sheridan Rd, Lake Forest, IL 60045, United States

Questions, requests or complaints: hello@homeschoolup.com. See also our terms of service.