SmartScroll Privacy Policy

Last updated: October 22, 2026

SmartScroll is a learning app for students, set up and managed by a parent or legal guardian. This policy explains, in plain language, exactly what we collect, why, how long we keep it, and how to delete it. It is written to match what our software actually does, not what a template says.

SmartScroll is operated by SmartScroll LLC (34 14th St, Wheatland, WY 82201; (704) 615-0231). Questions or privacy requests: admin@smartscroll.org.

The short version

• Parent-managed profiles contain a first name or nickname, optional grade, and learning progress. Parents may also enter report-card grades and private notes.
• Optional AI help processes submitted text, learning context and selected homework photos when a permitted provider is enabled. The provider and consent controls are described below.
• We do not sell learner data or show ads in the learning app. First-party operational measurement is separate from adult marketing measurement, which loads on parent marketing pages and can be turned off.
• Parents can review and delete student records from the family page. Deletion removes the live account/progress records and disconnects linked access; copies on a device and provider-held records have separate handling.
• Scheduled cleanup removes families after all learners have been inactive for 24 months, except accounts with active or trialing subscriptions. Parents can request deletion earlier.

What we collect, why, and for how long

From parents

Your email address. This is the only email address in our system. We use it to sign you in (we email you a one-time sign-in link instead of using passwords) and, if you subscribe, to send billing notices such as a failed payment or an upcoming renewal. It is kept until you delete your account or until the automatic inactivity purge removes it.

A consent record. When you link your child's device, we record that you consented: the time, a one-way hash of your IP address (we deliberately do not keep the IP address itself), and the first part of your browser's identification string. This records the confirmation supplied through the authenticated parent account; it is not independent identity verification. It is deleted with your account.

Subscription state. If you subscribe, we store your plan (Good, Better, or Best) and billing period, its status, the billing period end date, and two Stripe identifiers (a customer ID and a subscription ID). See "Payments" below for what Stripe holds and we never do.

Your timezone and email preferences. When you are signed in, your browser's timezone is captured so the weekly progress email is sent at a sensible local time. If you unsubscribe from an email, we store that preference (separately for the weekly digest and the session-reminder emails) so we honor it. A parent can also separately choose to receive product news, feature updates, and occasional offers. That optional choice is off by default, is never inferred from having an account or subscription, and can be turned off in the family account or from any such email. We retain the choice, its timestamp and source, and a minimal delivery record so we can honor opt-outs and avoid duplicate messages. These records contain no student questions, conversations, homework images, or private learning details, and are kept until the parent deletes the account.

Report-card grades you enter (optional). From your dashboard you may log a student's real report-card grade (a subject, a value such as "B+", and a date) so you can see progress before and after. This is entered by you, shown only to you, and kept as an append-only history until you delete the student or account. The student's device never sends or receives it (see below).

From students

First name or nickname, and an optional grade level. A parent supplies the profile name when linking. We keep the first word, capped at 24 characters; we do not ask for a surname, birthdate, student email or profile photo. This profile limit is separate from optional learning inputs described in the AI section.

Learning progress. One progress record per student. It holds the data that powers the feed's adaptivity, the tutoring program, and the parent dashboard, in these categories:

• Practice and mastery: which questions were answered right or wrong, how many times each has been served, a per-skill mastery score (with attempt counts and timestamps), and the first-seen and first-mastered dates per skill.
• Game and streak state: experience points, coins, the daily streak and its date, cosmetic avatar accessories the student bought or selected, and streak-freeze and reward counters. These are scores and counters so the rewards and coin economy work, never messages.
• Usage counters and focus plan: today's XP and per-day counts of tutor messages and photo solves (not the messages or photos). An optional focus plan includes chosen topics, dates and the learner's short description of a preferred teaching method. That teaching preference synchronizes with the linked profile; students should not put personal details into it.
• The Day-1 starting snapshot: a one-time record made when the student first maps their level: first name, grade, which subjects were mapped, placement scores, and the stated learning goal (with an optional upcoming-test date). Anything the student typed in their own words about what is hard, and any grades a student self-reports, stay only on that student's device and are never sent to us.
• Tutoring sessions and schedule: for the tutoring program, a record of each completed session (the skill, minutes on task, and the exit-ticket result, never the questions or answers), the weekly session schedule and its timezone, the current learning pathway, and a log of when the plan was re-shaped.

This is what powers the feed's adaptivity and the parent dashboard. On the parent dashboard we show a computed summary built from this record (progress by subject, skills mastered, where the student is stuck, recent session reports, and time on task); the raw progress record itself is not exposed.

A device sync credential. The student's device holds a random sync token that lets it save progress. We store only a one-way hash of it, so neither we nor anyone who obtained our database could impersonate the device.

Progress is kept until the parent deletes the student or account, or scheduled cleanup applies under the family inactivity and subscription conditions below.

From everyone

Abuse prevention. We use request IP addresses and account/device keys to prevent flooding, guessed codes and spam. Shared rate-limit counters are stored in Supabase using secret-derived hashes rather than raw IP addresses or device tokens. These remain pseudonymous data, not anonymous data. Counters stop applying when their configured window expires; a scheduled cleanup removes expired rows. Service outages can delay cleanup. Upstash is used for aggregate AI quotas and operational counters, not these user-specific abuse counters. Hosting providers may separately process request metadata as described in their policies.

First-party product analytics. SmartScroll sends a limited set of events directly to our own server so we can tell whether the product works: for example, whether placement or a learning run was started and completed, whether a scheduled tutoring session was seen and completed, whether a notification was delivered, and whether a technical error occurred. Events can include only coarse categories chosen by our software, such as platform, device class, grade band, subject, app version, plan, result, and bucketed duration or count. The server rejects unknown event names or fields. We do not attach names, emails, typed content, homework photos, exact answers, account or student IDs, advertising identifiers, raw IP addresses, or precise timestamps from the device.

To estimate active use and sessions without identifying a student, the device creates random installation and session keys. The installation key rotates every 30 days, and the server stores only one-way hashes of both keys. Raw pseudonymous events are deleted after 90 days. Daily aggregate counts, which contain no installation or session key, are kept for 25 months so we can compare product reliability and broad usage over time. These analytics are used only to operate, secure, and improve SmartScroll. They are not used for advertising, cross-site tracking, profiling a child for sale, or making automated decisions about a student.

Parent-facing marketing website analytics. The public pages written for adults (such as the parent, pricing, comparison, purchase-confirmation, and parent-guide pages, including /help and its guides) load Google Analytics, Google Ads, Meta, and TikTok when those tools are configured, on the first visit to those pages. Visiting one of those pages is the adult measurement context. These tools may receive the page visited, campaign parameters included in the link, browser/device information, and purchase-event value and currency. When a campaign link includes a Google, Meta, TikTok, or ChatGPT Ads click identifier, we may use that identifier for attribution on the responsible adult's account for up to 90 days so a later provider-verified trial or first payment can be attributed to the campaign. We use it only for advertising measurement and delivery to the provider that issued it. We do not send student names, learning activity, tutor messages, homework photos, learner identifiers, or parent email addresses in these conversion events. Choosing Decline in Privacy choices turns the tools off, and campaign click identifiers are not kept after that choice. A browser that sends Global Privacy Control does not receive this load. This marketing measurement never runs in the native learning app, on learner routes, or on the signed-in family dashboard. A visitor can open Privacy choices and choose Decline, or clear the site's browser data. Clearing that stored choice and returning to a parent marketing page turns measurement back on, because that visit is a new adult measurement context. A visitor can also contact us to revoke the choice and remove retained campaign attribution.

TikTok advertising measurement. On eligible parent marketing pages, TikTok's browser Pixel measures page visits, selected marketing interactions, verified parent registration and created web checkout. Our Events API integration can report the same registration and checkout outcomes with matching event identifiers to prevent double-counting, plus provider-confirmed web subscription trials and first positive payments. Server reports use the original TikTok ad click identifier (`ttclid`), an opaque event ID, event time, public parent-page address, and value/currency when applicable. Click attribution is eligible for up to 90 days. Terminal server delivery records become eligible for scheduled cleanup 90 days after creation. We do not send parent email addresses, student identities, learning activity or tutoring content for matching. Decline or Global Privacy Control prevents eligible new measurement; withdrawal cannot recall a report already sent or in flight.

ChatGPT Ads conversion measurement. When adult marketing measurement is on, our server may report a verified new parent registration, created web checkout, subscription trial, or first positive payment to OpenAI's ChatGPT Ads service. This includes the original ChatGPT ad click reference (`oppref`), an opaque event identifier used to prevent duplicate reporting, the event time, a public parent-page address, and payment value and currency when applicable. We use the click reference for adult attribution for up to 90 days after the click is captured. A reference copied into a conversion delivery record can remain longer: terminal delivery records become eligible for scheduled cleanup 90 days after the record is created. We do not install an OpenAI advertising Pixel or automatically collect contact information for matching. These reports contain no parent email, student identity, learning activity, questions, answers, tutor conversations, or homework photos. Declining or withdrawing marketing consent prevents subsequent eligible reports; a report already transmitted or in flight cannot be recalled by our delivery queue.

For a signed-in adult browser with marketing measurement on, we may also retain the Google Analytics browser identifier issued by the configured Google tag, including for visits without campaign parameters. We bind it privately to that browser's authenticated adult context and a verified Stripe checkout so our server can report an eligible trial and first positive payment to Google Analytics. We do not send the account identifier, email, learner information, or authentication binding to Google, and do not place Google identifiers in Stripe metadata or general product analytics. Browser context is eligible for 30 days; expired identifiers and associated snapshots are physically removed by scheduled cleanup (normally within the following week, within our 90-day retention ceiling). A signed browser safety marker lasts up to 90 days to prevent reuse after an account switch; the checkout-binding cookie lasts up to 24 hours and is cleared at logout. Google Tag Manager may manage these tags. They stay off after Decline, when Global Privacy Control is on, in the learning app, and on learner routes. Revocation invalidates retained contexts and unsent conversions; it cannot recall a request already transmitted to a provider. These implementation details do not themselves constitute legal approval of the measurement purposes. When measurement starts on a parent page before signing in, a first-party HttpOnly safety cookie records the measurement basis (automatic parent-page measurement or an explicit choice) for up to 30 minutes before the Google cookie is created; it contains no Google or account identifier. Signing in can consume that earlier context to associate the eligible browser with the responsible adult before checkout. Existing unowned Google cookies are not adopted by this handoff, and logout clears the temporary safety cookie.

Privacy-preserving iPhone install attribution. The iPhone app supports Apple’s AdAttributionKit/SKAdNetwork so an advertising network can receive delayed, aggregate reports that an advertisement led to an installation. Apple limits the postback to prevent it from identifying a person or device. This aggregate install path does not use advertising identifiers or Meta’s app-events SDK and does not send learner activity. It is separate from the optional parent subscription measurement described below.

Optional parent app advertising measurement in supported iPhone releases. On authenticated parent-only screens, a parent or guardian aged 18 or older can separately opt in to Meta measurement. This is optional and does not affect purchases or learning access. We also require Apple’s App Tracking Transparency authorization. The current notice covers eligible recent installs (including first-open time), parent-only app opens, verified subscription trials and first positive payments. Older permissions are not automatically expanded to include app opens. We send the event time, opaque event/order reference, app version/build, iOS version, device advertising identifier, and payment value/currency when applicable. We do not send learner activity, learning content, parent email or account identifiers. Permission records and the advertising identifier expire after 30 days. Install and app-open reporting require a device authorization check within the preceding five minutes. Eligible verified billing events can be reported without reopening the app during the existing consent term, using the last observed authorized device status. You can turn measurement off in Family → Privacy and data or Apple Settings. Device-level changes synchronize when the app next connects; we cannot claim to observe an offline device’s current settings. Turning this off clears the live advertising identifier and prevents subsequent dispatch once recorded. It cannot undo a delivery already processed by Meta. We keep bounded delivery records and restrictive backup-recovery records under the retention periods below.

Optional Singular measurement on parent iPhones. When this separate option is available in a supported release, a signed-in parent or guardian aged 18 or older may choose to enable Singular measurement on a parent-only device. Apple’s App Tracking Transparency authorization is also required. This choice does not affect learning access or purchases and does not enable measurement of learner activity. Singular can receive advertising and app identifiers, IP address, app/iOS version, device model and locale, parent app opens, and eligible provider-verified subscription trials and first positive USD payments. We do not send learner identities, learning activity, tutor messages, homework photos, parent email or parent account identifiers to Singular. Verified payment reporting can continue within the permission term without the parent reopening the app; it uses the last observed authorized device status. Our retained permission and device context expire after 30 days. This is our permission term, not a promise that Singular deletes previously received data after 30 days. Our bounded operational records become eligible for scheduled cleanup after 90 days, and restrictive recovery records preserve withdrawals. You can turn the choice off in Family → Privacy and data or withdraw Apple’s tracking authorization. Queued delivery is stopped once withdrawal is recorded; a request already authorized or in flight cannot be recalled, and offline device changes synchronize when the app reconnects. Singular partner forwarding is not enabled by this consent alone. Apple’s aggregate SKAdNetwork reports remain separate from identifiable server event reports.

Server logs. Our servers write structured technical logs (which route failed, an HTTP status, a latency). They are built so that personal data never enters them: no emails, no names, no student text, no photos. Logs are hosted by Vercel and expire on Vercel's platform schedule.

Adult context for website analytics. An eligible visit to a parent marketing page enables website measurement by default; it does not establish the visitor's age or mean that they clicked Allow. We record automatic enablement separately from an explicit choice in Privacy choices. Earlier records that did not distinguish the two are not evidence of an affirmative choice. This measurement context does not change any student profile, authorize collection of a child's data, or override a known learner context. Decline removes the browser context and requests account-level withdrawal when signed in. A later default-on visit cannot reverse a recorded account opt-out. Turning measurement back on in Privacy choices requires an explicit 18-or-older parent/guardian confirmation. Declining does not affect access to SmartScroll. Global Privacy Control keeps these browser tools off.

What we never collect

We do not ask students to provide an email, password, phone number, birthdate, surname, or photo of themselves. Free-text questions or optional homework photos may nevertheless contain personal information; please avoid including names, faces, contact details, or other identifying information. No contacts, no precise location, no microphone or camera access beyond the homework photo the student chooses to submit, no social features, no public profiles, no messaging between users, no advertising identifiers.

AI learning features and their providers

AI learning features include tutoring, homework and study-guide photos, writing feedback, teach-back, study-plan matching, and optional interpretation of parent notes. When available and used, these features process the text submitted, recent conversation context, relevant learning context, and any photo selected for that request. Anthropic's Claude API is the selected provider for these learning features. An OpenAI path remains disabled unless its separate retention requirements are verified and parents receive the applicable notice. Gemini is disabled for student learning, with no silent Gemini fallback. This is separate from adult ChatGPT Ads measurement.

Hosted learning requests require a linked student, reviewed core parental permission and a separate current permission for AI processing. Historical checkbox confirmation alone does not authorize AI processing. Provider processing is disabled unless the operator has verified the applicable permission and data controls. OpenAI requires the applicable project-level no-training and Zero Data Retention configuration. A software flag does not itself create a contract, enable those controls, or establish legal compliance. When a provider is unavailable, authored lessons and local topic matching remain available; personalized AI functions may be unavailable.

We do not intentionally save tutor conversations, writing drafts, teach-back explanations or submitted photos in our application database. A request is processed transiently by our server and, when enabled, the relevant provider. Chat history can remain on the student's device. Parent-written notes are different: the current note and a bounded history of up to 12 earlier notes are stored for the family; model interpretation may receive the parent note when enabled. Learners receive distilled teaching guidance rather than the parent's raw note history.

Anthropic does not use commercial API content for training by default, and SmartScroll does not opt into training. Under standard retention, API inputs and outputs are normally deleted within 30 days. Content flagged for potential policy violations may be retained for up to two years, related safety classification scores for up to seven years, and legal requirements may require longer retention. This is not Zero Data Retention. OpenAI's contractual retention controls and documented exceptions apply if that provider is separately enabled. Image inputs are scanned for potential child sexual abuse material; flagged images may be retained for manual review even under Zero Data Retention. Disabling response storage alone does not establish zero retention. We do not use submitted learning content for advertising or to train our own models.

Safety checks screen generated responses and replace rejected responses with an authored fallback. Detected crisis messages are handled with authored support resources without sending that request to an AI provider. These safeguards reduce risk but cannot guarantee every unsafe message will be detected.

Payments

On the web, subscriptions are processed by Stripe. Checkout happens on Stripe's own payment page, so your card number, CVC, and billing address go directly to Stripe and never touch our servers, ever. We store your plan, its status, the current period end date, a Stripe customer ID, and a Stripe subscription ID. Stripe holds the payment details and invoice history under its own privacy policy, and you can manage or cancel your subscription in Stripe's billing portal from your family page.

Private billing measurement. To distinguish subscription starts, later payments and adjustments, we keep provider-verified payment/refund amounts and currency, occurrence dates, and one-way subscription and transaction references linked privately to the responsible adult. These reconciliation associations are deleted by scheduled cleanup after the 90-day raw-data window, or when that adult account is deleted. Authorized marketing reports receive only aggregate outcomes for groups of at least 25 adults, separated by currency, never these private associations. Where adult marketing measurement is on, the private report association may also retain bounded campaign/ad/creative labels and identifiers; removing that attribution clears those campaign associations. Revoking optional marketing attribution does not delete the billing state needed to manage your subscription. Student learning content is not included, and disabled measurement destinations do not receive these records.

In the mobile apps, subscriptions are purchased through the Apple App Store (iOS) or Google Play (Android). Your payment details go to Apple or Google, never to us, and you manage or cancel the subscription in your Apple or Google account. We use RevenueCat to confirm and track the subscription's status. RevenueCat receives an app user identifier tied to your account and the store's purchase and device metadata; it does not receive your card details. What we store is the same as on the web: your plan, its status, and the store transaction reference.

Children's privacy (COPPA)

SmartScroll is designed for students roughly 11 to 14 and is built so that a parent or legal guardian controls the student's data from start to finish.

How linking and consent work. Demo learning and its on-screen results can remain on the device before linking. Loading the service still involves hosting, security and the first-party operational measurement described above; it is not a promise that no information reaches a server. Our current client does not submit unlinked learner questions or photos for AI help. Linking works as follows:

1. On the child's device, the student taps "Save your progress", which shows a 6-character code. The code and a random device-secret hash are held until expiry and cleanup. Codes expire after 15 minutes. New pending codes contain no student name, grade or progress.
2. The parent signs in on their own device with their email (a one-time sign-in link that expires in 15 minutes and works exactly once).
3. The parent reviews the direct notice and completes the parental-permission process described below. Signing in or checking a box alone does not grant learning permission. Optional AI processing requires its own affirmative choice.
4. The parent confirms the intended learner or device. We retain permission evidence and the account-to-learner association. An already connected device does not need a second association merely to renew permission.

Parent rights, all self-serve on the family page:

• Review. The dashboard shows each linked student and a summary of their progress.
• Delete one student. A "Delete this student's data" button permanently removes the student record and all their progress from our servers, immediately, and tells you exactly how many records were removed. The child's device keeps its own local copy but stops syncing.
• Delete everything. A "Delete my account and all student data" button permanently removes the parent record, every student, all progress, and the subscription record, immediately, with the deletion counts shown to you. These are hard deletes, not deactivations.
• Withdraw permission. In Family → Privacy and data → Account & data, select “Withdraw” under Learning permission. This stops linked learner access and new cloud learning writes for your family, while preserving saved records for your review, download or deletion. Learning reminder emails stop. It does not erase copies already held on devices or by providers, cancel subscriptions, or retroactively undo a request already processed. Contact admin@smartscroll.org about restarting services with appropriate permission.

Automatic deletion. Every week, a scheduled job on our servers deletes:

• accounts whose students have all been inactive for 24 months, excluding accounts with an active or trialing subscription. Activity by one sibling retains the family’s student records. Parents with no students are eligible 24 months after account creation, subject to the same subscription exception; and
• any expired sign-in links and device link codes. Link codes expire after 15 minutes and are also actively deleted whenever the linking routes run, to remove expired credentials and any legacy pairing data. They are erased, not just disabled.

Backups and deletion safeguards. Deleting live records does not immediately remove copies from existing encrypted backups. Our independent encrypted backup artifacts expire after 14 days; our database provider also maintains daily backups under its plan-specific retention. To prevent a restored backup from undoing a deletion or withdrawn permission, we retain limited recovery records containing an internal account or learner identifier, a restrictive action and its time. These contain no names, email addresses, questions, photos or learning progress, and are not used for advertising. Scheduled cleanup removes live recovery records after 90 days; an encrypted backup or recovery export can retain a copy for up to another 14 days. A restored database must remain isolated until applicable deletion and permission restrictions are reconciled. Provider security, legal and billing records follow their separate applicable requirements.

Your choices and rights

• Parents can review, delete, and disconnect their student's data at any time, directly, as described above. No support ticket is needed.
• You can also email admin@smartscroll.org with any privacy request, including access or deletion, and we will act on it.
• Depending on where you live, you may have additional rights under your state's privacy law. Contact us and we will honor the rights that apply to you.

How we protect it

All traffic to SmartScroll and between SmartScroll and every provider is encrypted in transit (TLS). Our database is encrypted at rest by our database provider. Sign-in links and sessions use signed, single-use, expiring tokens instead of passwords. Device credentials and the consent IP are stored only as one-way hashes. Production access is restricted to authorized operators. We are completing enforcement of multi-factor authentication across administrative provider accounts and the documented security and retention controls; we do not represent that rollout as complete.

Service providers

We use a small number of providers, each only to run the product:

We do not sell personal information. We do not share student information for advertising. Marketing-site providers may process the limited adult website measurements described above only on parent marketing pages, only while that measurement is on, and only to provide measurement or advertising services to us. Website measurements do not run in the learning app or on learner routes, after Decline, or when the browser sends Global Privacy Control. Optional parent iPhone app measurement is separate, as described above; it excludes learner activity. Apple may provide advertising networks with privacy-preserving aggregate install reports that do not identify a person or device.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the "Last updated" date, and for any material change affecting children's data we will notify parents by email and, where required, obtain new consent before the change applies to their student.

Contact

SmartScroll LLC

34 14th St, Wheatland, WY 82201

(704) 615-0231

admin@smartscroll.org

Paperless parental permission

For the internal learning uses described in our direct notice, a parent can read the notice and affirmatively confirm with a fresh code sent to their parent email. An ordinary sign-in or previously checked box is not reused as this permission. We send a follow-up confirmation after one day containing the notice and withdrawal instructions. Optional Claude processing requires a separate choice. We retain the notice versions, recipient email, confirmation and sending timestamps, and limited retry evidence with the parent account. Codes expire after 15 minutes and their hashes are removed after confirmation. Parents can withdraw learning permission in Family → Privacy and data or contact support@smartscroll.org; optional AI can be withdrawn separately. Account deletion removes these live consent records; backups follow the retention schedule described above. This method does not authorize advertising or public sharing of learner information.

Terms of Service  ·  Disclaimer