Your child's data, your call.

1. Plain-English summary

Dr. Spark Academy is a learning program for U.S. students in Grades 5–7 (typically ages 10–13). A parent or legal guardian must set up the account, give consent, and approve key activities on the child's behalf. We collect only what we need to teach your child and to send you useful weekly reports. We don't sell personal information. We don't run advertising trackers. We share your child's first name and schoolwork only with the service providers listed in Section 8 and with people you approve (such as a teacher).

If anything below feels confusing, email privacy@drsparkacademy.com and we'll explain in plain language.

2. Who this policy is for

This policy applies to:

• Parents and legal guardians who create an account on Dr. Spark Academy.
• Children (typically U.S. Grades 5–7, ages 10–13) using the service through the parent's account.
• Visitors to drsparkacademy.com who haven't signed up.

Children may not sign up directly. Only a parent or legal guardian (18+) may create the account, accept these terms, and provide consent on behalf of the child.

3. What we collect from parents

From you (the parent / guardian), we collect:

• Your first and last name, email address, and the password hash you set up.
• Your billing information when you subscribe — handled by our payment processor (Stripe). We never see your full card number.
• Your consent records — who gave consent, when, through which verification method, and which version of the disclosure you accepted.
• Your reward approvals, friend-invite decisions, and any teacher / school sharing approvals.
• Communications you send us (support emails, feedback).

4. What we collect from children

From your child, we collect only the minimum needed to teach:

• Your child's first name or nickname (you provide this — it's how the agents address them).
• Grade level and parent-selected enrichment tracks.
• Your child's answers to learning missions and placement questions, and short written reflections, in your child's own words.
• Mastery scores derived from those answers (no other behavioral profiling).
• Reward progress and badges earned.

What we deliberately do NOT collect from children:

• Home address, phone number, or personal email for the child.
• Exact location (GPS).
• Photos or videos of the child.
• Health diagnoses or private faith reflections (we keep Health & Wellness and Christian Leadership content educational and age-appropriate, not personal).
• Unmoderated child-to-child messages outside parent-approved learning squads.
• Cross-site advertising identifiers.

5. Children's Online Privacy Protection Act (COPPA)

Because Dr. Spark Academy is directed to children under 13 in the United States, COPPA applies. Here's how we comply:

• Parental consent. Record your consent at /parent/consent before your child starts; your parent dashboard reminds you until you do. We keep an auditable record of each consent: who gave it, when, the verification method, and the exact disclosure you accepted. One consent covers everything that disclosure describes (lesson grading, weekly reports, achievement export, teacher sharing, social learning, and AI processing). You can't pick individual parts yet.
• You can review what we have. Sign in and go to your parent dashboard to see your child's profile, answers, scores, and shared content. You can request a full export anytime — email privacy@drsparkacademy.com.
• You can delete it. Visit /parent/data-deletion to request deletion of your child's data. We process deletion within 30 days. Some records (consent receipts, payment records) must be kept for legal or accounting reasons; we'll tell you which.
• You can refuse further collection. Email privacy@drsparkacademy.com to revoke consent. We then stop collecting your child's information and delete what we hold within 30 days, unless you ask us to keep a copy. Revoking is handled by our team; it does not switch features off automatically.
• We don't condition participation on disclosing more than is necessary.The core lessons run on the minimum data set described in Section 4.

6. How we use what we collect

• To personalize the daily missions to your child's level.
• To generate weekly reports for you (and, only if you approve, for a teacher).
• To award badges, certificates, and a parent-approved transcript.
• To process subscription payments and prevent fraud.
• To improve the product (in aggregate, never personally identifying your child).
• To respond to your support requests and legal obligations.

We do not use children's data to train external AI models. Some features use an AI provider (see Section 8): grading your child's written answers, tutoring hints, your weekly report, and safety checks on squad project messages. These requests can include your child's first name and grade, the lesson or question, and your child's own written answers and reflections. AI processing is covered by the consent you record at /parent/consent: the disclosure there describes it, and your consent record includes it. It is not a separate opt-in.

7. Parent controls

From your parent dashboard you can:

• Create and manage child profiles.
• Choose optional subjects and faith settings (no faith content, Christian character only, or Christian Bible-based leadership).
• Approve or deny rewards before they're issued.
• Approve friend invitations — parent-mediated only. A child can request a friend invitation, but the link is sent to the friend's parent, not the friend directly.
• Control learning squad visibility (defaults hide exact scores, health-check answers, and faith reflections).
• Enable or disable live sessions and external integrations.
• Approve or revoke teacher / school sharing.
• Request export or deletion of your child's data.

8. Who we share data with (very few)

We share data only with the third parties listed below, and only as necessary:

• Anthropic (our AI provider; requests go directly or through OpenRouter, which passes them to Anthropic's models) — receives what each AI feature needs: your child's first name and grade, the lesson or question, your child's written answers when they are graded, recent written reflections and weekly progress counts for your weekly report, and squad project messages for safety checks. We don't add your name, email, address, photo, or contact details, but your child's answers are sent as written. These providers act as our data processors and do not use the content to train their models.
• Stripe — processes payments when you subscribe, under its own published privacy policy, and runs the optional no-charge card check that verifies parental consent. For that check it also receives your name, your email, and your child's first name.
• Resend — delivers account emails (email verification and password reset) to your email address.
• Vercel — hosts the application and processes every request on our behalf, including your child's answers. Our managed database provider stores account and learning data.
• Sentry — receives technical error reports (such as the page address and the error) when something breaks, so we can fix it.
• Image-generation services — receive lesson topics to draw illustrations. They never receive information about your child.
• Cloudflare — provides DNS, CDN, and email routing for drsparkacademy.com. Sees the same request metadata as Vercel.
• Teachers / schools — only when you explicitly approve sharing, and only the specific items you approve.
• Law enforcement — only if compelled by valid legal process.

We do not sell personal information. We do not share your child's information with advertising networks for cross-site tracking. Ever.

9. School deployments (FERPA-adjacent)

If Dr. Spark Academy is used in a school setting, the school may direct certain handling of education records under FERPA. In that case the school is the controller of student data and Dr. Spark Academy acts as the school's service provider. The school's data-handling agreement supplements (and where conflicting, supersedes) this policy for the records it covers.

For most home / family use, FERPA does not apply — but we follow similar minimization and access principles by default.

10. Health & wellness and faith content

Health & Wellness lessons teach general concepts about food, movement, hydration, sleep, stress, and chronic-disease prevention. They do not diagnose, treat, or shame a child. If your child has a medical condition, talk to their pediatrician — we are not a substitute for medical advice.

Christian Leadership content is optional and parent-controlled. The default setting includes no faith content; you can opt in to "Christian character only" or "Christian Bible-based leadership" if those align with your family's values. We do not log your child's private faith reflections in a way that can be shared outside your account.

11. How long we keep data

• Active accounts: we retain your child's profile and learning history while the subscription is active so you can see weekly progress and your child can resume missions.
• After deletion request: we delete personal data within 30 days. Aggregated, de-identified statistics may be retained.
• After cancellation (no deletion request): child personal data is deleted after 180 days of inactivity. We notify you before deletion.
• Consent receipts and payment records: kept for the duration required by law (typically 7 years for tax/payment records).

12. How we protect data

• HTTPS / TLS for everything in transit.
• Hashed passwords (we never store plain text).
• Encrypted storage at rest for the database.
• Least-privilege access for our team — we can't see your child's specific answers without a specific support reason and a recorded access event.
• Audit logging on sensitive operations (consent changes, sharing approvals, data exports, deletions).
• No advertising trackers anywhere on the site.

No system can be 100% secure. If we ever experience a breach affecting personal information about your family, we will notify you and the appropriate regulators as required by law.

13. Your privacy rights (parent + child)

Depending on where you live, you may have rights to:

• Access — see what we have about you and your child.
• Correct — fix inaccurate information.
• Delete — have us erase data, subject to legal retention requirements.
• Port — receive your data in a portable format.
• Restrict or object to certain processing (e.g., object to AI processing of your child's answers).
• Withdraw consent at any time.
• Opt out of the sale or sharing of personal information (we don't sell, but California residents may exercise this right by request).
• Lodge a complaint with your state attorney general or the FTC.

Email privacy@drsparkacademy.com to exercise any of these. We'll respond within 30 days. We may need to verify your identity before acting on the request.

14. Cookies and similar technologies

We use only the cookies needed to keep you signed in and to remember your dashboard preferences. No third-party advertising cookies, no cross-site trackers, no analytics cookies without your consent where required by law.

15. International transfers

Dr. Spark Academy is operated from the United States. If you use the service from outside the U.S., your information may be transferred to and processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses) where required by the applicable jurisdiction. The service is primarily designed for U.S. families and may not be appropriate for use elsewhere.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. If a change is material — for example, a new category of data collection or a new third-party processor — we'll notify you by email before the change takes effect, and you may need to re-confirm consent.

17. Contact

GENAK Estates LLC — Privacy
Email: privacy@drsparkacademy.com
Mail: GENAK Estates LLC, Tolland, Connecticut, USA
Operating brand: Dr. Spark Academy (drsparkacademy.com)

For company-level questions, see our parent company at genak.ai.