Your child's data, your call.

1. Plain-English summary

Dr. Spark Academy is a learning program for U.S. Grade 6 students (typically ages 11–12). A parent or legal guardian must set up the account, give consent, and approve key activities on the child's behalf. We collect only what we need to teach your child and to send you useful weekly reports. We don't sell personal information. We don't run advertising trackers. We don't share your child's first name or schoolwork with anyone you haven't explicitly approved.

If anything below feels confusing, email privacy@drsparkacademy.com and we'll explain in plain language.

2. Who this policy is for

This policy applies to:

• Parents and legal guardians who create an account on Dr. Spark Academy.
• Children (typically U.S. Grade 6, ages 11–12) using the service through the parent's account.
• Visitors to drsparkacademy.com who haven't signed up.

Children may not sign up directly. Only a parent or legal guardian (18+) may create the account, accept these terms, and provide consent on behalf of the child.

3. What we collect from parents

From you (the parent / guardian), we collect:

• Your first and last name, email address, and the password hash you set up.
• Your billing information when you subscribe — handled by our payment processor (Stripe). We never see your full card number.
• Your consent records — which scopes (lesson grading, weekly reports, etc.) you approved, when, and through which verification method.
• Your reward approvals, friend-invite decisions, and any teacher / school sharing approvals.
• Communications you send us (support emails, feedback).

4. What we collect from children

From your child, we collect only the minimum needed to teach:

• Your child's first name or nickname (you provide this — it's how the agents address them).
• Grade level and parent-selected enrichment tracks.
• Your child's answers to learning missions and short reflections.
• Mastery scores derived from those answers (no other behavioral profiling).
• Reward progress and badges earned.

What we deliberately do NOT collect from children:

• Home address, phone number, or personal email for the child.
• Exact location (GPS).
• Photos or videos of the child.
• Health diagnoses or private faith reflections (we keep Health & Wellness and Christian Leadership content educational and age-appropriate, not personal).
• Unmoderated child-to-child messages outside parent-approved learning squads.
• Cross-site advertising identifiers.

5. Children's Online Privacy Protection Act (COPPA)

Because Dr. Spark Academy is directed to children under 13 in the United States, COPPA applies. Here's how we comply:

• Verifiable Parental Consent. Before we collect any personal information from your child, you must complete the parent consent flow at /parent/consent. We keep an auditable record of the specific scopes you approved (lesson grading, weekly reports, achievement export, optional teacher sharing, optional social learning, optional LLM processing).
• You can review what we have. Sign in and go to your parent dashboard to see your child's profile, answers, scores, and shared content. You can request a full export anytime — email privacy@drsparkacademy.com.
• You can delete it. Visit /parent/data-deletion to request deletion of your child's data. We process deletion within 30 days. Some records (consent receipts, payment records) must be kept for legal or accounting reasons; we'll tell you which.
• You can refuse further collection. Withdraw any consent scope at the consent page; the related feature turns off immediately for your child.
• We don't condition participation on disclosing more than is necessary.The core lessons run on the minimum data set described in Section 4.

6. How we use what we collect

• To personalize the daily missions to your child's level.
• To generate weekly reports for you (and, only if you approve, for a teacher).
• To award badges, certificates, and a parent-approved transcript.
• To process subscription payments and prevent fraud.
• To improve the product (in aggregate, never personally identifying your child).
• To respond to your support requests and legal obligations.

We do not use children's data to train external AI models. When LLM processing is enabled (a scope you must explicitly approve), prompts may include your child's first name and the lesson topic, but never last name, address, photo, or contact details.

7. Parent controls

From your parent dashboard you can:

• Create and manage child profiles.
• Choose optional subjects and faith settings (no faith content, Christian character only, or Christian Bible-based leadership).
• Approve or deny rewards before they're issued.
• Approve friend invitations — parent-mediated only. A child can request a friend invitation, but the link is sent to the friend's parent, not the friend directly.
• Control learning squad visibility (defaults hide exact scores, health-check answers, and faith reflections).
• Enable or disable live sessions and external integrations.
• Approve or revoke teacher / school sharing.
• Request export or deletion of your child's data.

8. Who we share data with (very few)

We share data only with the third parties listed below, and only as necessary:

• Anthropic (and optionally OpenRouter) — receives lesson prompts when the LLM processing scope is enabled. Prompts may include your child's first name and the lesson topic but never your last name, address, photo, or contact details. These providers act as our data processors and do not use the content to train their models.
• Stripe — receives the payment information you provide when you subscribe. Stripe is the merchant of record and processes payments under its own published privacy policy.
• Vercel — hosts the application. May see request metadata (IP address, user agent, page accessed) but not child content beyond what's required to deliver the page.
• Cloudflare — provides DNS, CDN, and email routing for drsparkacademy.com. Sees the same request metadata as Vercel.
• Teachers / schools — only when you explicitly approve sharing, and only the specific items you approve.
• Law enforcement — only if compelled by valid legal process.

We do not sell personal information. We do not share your child's information with advertising networks for cross-site tracking. Ever.

9. School deployments (FERPA-adjacent)

If Dr. Spark Academy is used in a school setting, the school may direct certain handling of education records under FERPA. In that case the school is the controller of student data and Dr. Spark Academy acts as the school's service provider. The school's data-handling agreement supplements (and where conflicting, supersedes) this policy for the records it covers.

For most home / family use, FERPA does not apply — but we follow similar minimization and access principles by default.

10. Health & wellness and faith content

Health & Wellness lessons teach general concepts about food, movement, hydration, sleep, stress, and chronic-disease prevention. They do not diagnose, treat, or shame a child. If your child has a medical condition, talk to their pediatrician — we are not a substitute for medical advice.

Christian Leadership content is optional and parent-controlled. The default setting includes no faith content; you can opt in to "Christian character only" or "Christian Bible-based leadership" if those align with your family's values. We do not log your child's private faith reflections in a way that can be shared outside your account.

11. How long we keep data

• Active accounts: we retain your child's profile and learning history while the subscription is active so you can see weekly progress and your child can resume missions.
• After deletion request: we delete personal data within 30 days. Aggregated, de-identified statistics may be retained.
• After cancellation (no deletion request): child personal data is deleted after 180 days of inactivity. We notify you before deletion.
• Consent receipts and payment records: kept for the duration required by law (typically 7 years for tax/payment records).

12. How we protect data

• HTTPS / TLS for everything in transit.
• Hashed passwords (we never store plain text).
• Encrypted storage at rest for the database.
• Least-privilege access for our team — we can't see your child's specific answers without a specific support reason and a recorded access event.
• Audit logging on sensitive operations (consent changes, sharing approvals, data exports, deletions).
• No advertising trackers anywhere on the site.

No system can be 100% secure. If we ever experience a breach affecting personal information about your family, we will notify you and the appropriate regulators as required by law.

13. Your privacy rights (parent + child)

Depending on where you live, you may have rights to:

• Access — see what we have about you and your child.
• Correct — fix inaccurate information.
• Delete — have us erase data, subject to legal retention requirements.
• Port — receive your data in a portable format.
• Restrict or object to certain processing (e.g., turn off LLM processing).
• Withdraw consent at any time.
• Opt out of the sale or sharing of personal information (we don't sell, but California residents may exercise this right by request).
• Lodge a complaint with your state attorney general or the FTC.

Email privacy@drsparkacademy.com to exercise any of these. We'll respond within 30 days. We may need to verify your identity before acting on the request.

14. Cookies and similar technologies

We use only the cookies needed to keep you signed in and to remember your dashboard preferences. No third-party advertising cookies, no cross-site trackers, no analytics cookies without your consent where required by law.

15. International transfers

Dr. Spark Academy is operated from the United States. If you use the service from outside the U.S., your information may be transferred to and processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses) where required by the applicable jurisdiction. The service is primarily designed for U.S. families and may not be appropriate for use elsewhere.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. If a change is material — for example, a new category of data collection or a new third-party processor — we'll notify you by email before the change takes effect, and you may need to re-confirm consent.

17. Contact

GENAK Estates LLC — Privacy
Email: privacy@drsparkacademy.com
Mail: GENAK Estates LLC, Tolland, Connecticut, USA
Operating brand: Dr. Spark Academy (drsparkacademy.com)

For company-level questions, see our parent company at genak.ai.