SmartScroll Privacy Policy

Last updated: September 6, 2026

SmartScroll is a learning app for students, set up and managed by a parent or legal guardian. This policy explains, in plain language, exactly what we collect, why, how long we keep it, and how to delete it. It is written to match what our software actually does, not what a template says.

SmartScroll is operated by SmartScroll LLC (34 14th St, Wheatland, WY 82201; (704) 615-0231). Questions or privacy requests: admin@smartscroll.org.

The short version

• We collect as little as we can. For a student, that means a first name, an optional grade level, and learning progress (plus, only if a parent chooses to enter them, the student's report-card grades). Anything a student types in their own words about what is hard stays on their device and is never sent to us. Nothing else.
• Students do not have email addresses, passwords, or accounts with us. Only parents do.
• We do not sell personal information. We show no ads in the learning app, and no advertising or analytics tracker runs inside it. On the separate, parent-facing marketing website, optional measurement tools run only after an adult visitor accepts the cookie notice, as described below.
• The AI tutor sends what a student types (and homework photos, if they use the photo solver) to Google's Gemini service to generate a reply. We do not store those messages or photos on our servers.
• Parents can see everything we hold about their student and delete any of it, or all of it, themselves, from the family page. Deletes are immediate and permanent.
• Data from inactive families is deleted automatically after 24 months.

What we collect, why, and for how long

From parents

Your email address. This is the only email address in our system. We use it to sign you in (we email you a one-time sign-in link instead of using passwords) and, if you subscribe, to send billing notices such as a failed payment or an upcoming renewal. It is kept until you delete your account or until the automatic inactivity purge removes it.

A consent record. When you link your child's device, we record that you consented: the time, a one-way hash of your IP address (we deliberately do not keep the IP address itself), and the first part of your browser's identification string. We keep this so we can show that a parent, not a child, approved the collection. It is deleted with your account.

Subscription state. If you subscribe, we store your plan (Good, Better, or Best) and billing period, its status, the billing period end date, and two Stripe identifiers (a customer ID and a subscription ID). See "Payments" below for what Stripe holds and we never do.

Your timezone and email preferences. When you are signed in, your browser's timezone is captured so the weekly progress email is sent at a sensible local time. If you unsubscribe from an email, we store that preference (separately for the weekly digest and the session-reminder emails) so we honor it. A parent can also separately choose to receive product news, feature updates, and occasional offers. That optional choice is off by default, is never inferred from having an account or subscription, and can be turned off in the family account or from any such email. We retain the choice, its timestamp and source, and a minimal delivery record so we can honor opt-outs and avoid duplicate messages. These records contain no student questions, conversations, homework images, or private learning details, and are kept until the parent deletes the account.

Report-card grades you enter (optional). From your dashboard you may log a student's real report-card grade (a subject, a value such as "B+", and a date) so you can see progress before and after. This is entered by you, shown only to you, and kept as an append-only history until you delete the student or account. The student's device never sends or receives it (see below).

From students

First name only, and an optional grade level. By design, we cannot store more than that: our server keeps only the first word of whatever name is entered, capped at 24 characters, and the database refuses anything longer. No surname, no birthdate, no student email address, no photo, no free-form profile. If no name is given, we use "Student".

Learning progress. One progress record per student. It holds the data that powers the feed's adaptivity, the tutoring program, and the parent dashboard, in these categories:

• Practice and mastery: which questions were answered right or wrong, how many times each has been served, a per-skill mastery score (with attempt counts and timestamps), and the first-seen and first-mastered dates per skill.
• Game and streak state: experience points, coins, the daily streak and its date, cosmetic avatar accessories the student bought or selected, and streak-freeze and reward counters. These are scores and counters so the rewards and coin economy work, never messages.
• Usage counters: today's XP, an optional focus plan the student set, and a per-day count of tutor messages and photo solves used (numbers only, never the messages or photos).
• The Day-1 starting snapshot: a one-time record made when the student first maps their level: first name, grade, which subjects were mapped, placement scores, and the stated learning goal (with an optional upcoming-test date). Anything the student typed in their own words about what is hard, and any grades a student self-reports, stay only on that student's device and are never sent to us.
• Tutoring sessions and schedule: for the tutoring program, a record of each completed session (the skill, minutes on task, and the exit-ticket result, never the questions or answers), the weekly session schedule and its timezone, the current learning pathway, and a log of when the plan was re-shaped.

This is what powers the feed's adaptivity and the parent dashboard. On the parent dashboard we show a computed summary built from this record (progress by subject, skills mastered, where the student is stuck, recent session reports, and time on task); the raw progress record itself is not exposed.

A device sync credential. The student's device holds a random sync token that lets it save progress. We store only a one-way hash of it, so neither we nor anyone who obtained our database could impersonate the device.

Progress is kept until the parent deletes the student or the account, or until the automatic 24 month inactivity purge.

From everyone

IP addresses. We use the IP address on each request to enforce rate limits (so nobody can flood the tutor, guess link codes, or spam sign-in emails). These live in short-lived counters that expire on their own, the longest within about 48 hours. We never write raw IP addresses to our database or our logs; the one place an IP-derived value is stored, the parental consent record, holds only a one-way hash.

First-party product analytics. SmartScroll sends a limited set of events directly to our own server so we can tell whether the product works: for example, whether placement or a learning run was started and completed, whether a scheduled tutoring session was seen and completed, whether a notification was delivered, and whether a technical error occurred. Events can include only coarse categories chosen by our software, such as platform, device class, grade band, subject, app version, plan, result, and bucketed duration or count. The server rejects unknown event names or fields. We do not attach names, emails, typed content, homework photos, exact answers, account or student IDs, advertising identifiers, raw IP addresses, or precise timestamps from the device.

To estimate active use and sessions without identifying a student, the device creates random installation and session keys. The installation key rotates every 30 days, and the server stores only one-way hashes of both keys. Raw pseudonymous events are deleted after 90 days. Daily aggregate counts, which contain no installation or session key, are kept for 25 months so we can compare product reliability and broad usage over time. These analytics are used only to operate, secure, and improve SmartScroll. They are not used for advertising, cross-site tracking, profiling a child for sale, or making automated decisions about a student.

Parent-facing marketing website analytics. The public pages written for adults (such as the parent, pricing, comparison, and purchase-confirmation pages) offer a cookie choice before loading any third-party measurement tool. If an adult visitor accepts, we use Google Analytics, Google Ads, and Meta to measure page visits and adult actions such as starting a trial or completing a purchase. These tools may receive the page visited, campaign parameters included in the link, browser/device information, and purchase-event value and currency. When an accepted campaign link includes a Google or Meta click identifier, we may keep that identifier on the responsible adult's account for up to 90 days so a later provider-verified trial or first payment can be attributed to the campaign. We use it only for advertising measurement and delivery to the provider that issued it. We do not send student names, learning activity, tutor messages, homework photos, learner identifiers, or parent email addresses in these conversion events. Declining means the tools do not load and campaign click identifiers are not retained. This marketing measurement never runs in the native learning app, on learner routes, or on the signed-in family dashboard. A visitor can clear the site's browser data to reset the choice, choose Decline when the notice returns, or contact us to revoke the choice and remove retained campaign attribution.

For an explicitly consenting, signed-in adult browser, we may also retain the Google Analytics browser identifier issued by the configured Google tag, including for visits without campaign parameters. We bind it privately to that browser's authenticated adult context and a verified Stripe checkout so our server can report an eligible trial and first positive payment to Google Analytics. We do not send the account identifier, email, learner information, or authentication binding to Google, and do not place Google identifiers in Stripe metadata or general product analytics. Browser context is eligible for 30 days; expired identifiers and associated snapshots are physically removed by scheduled cleanup (normally within the following week, within our 90-day retention ceiling). A signed browser safety marker lasts up to 90 days to prevent reuse after an account switch; the checkout-binding cookie lasts up to 24 hours and is cleared at logout. Google Tag Manager may manage these consent-gated tags. Revocation invalidates retained contexts and unsent conversions; it cannot recall a request already transmitted to a provider. These implementation details do not themselves constitute legal approval of the measurement purposes. If a visitor accepts before signing in, a first-party HttpOnly safety cookie records that fresh choice for up to 30 minutes before the Google cookie is created; it contains no Google or account identifier. Signing in can consume that earlier choice to associate the consented browser with the responsible adult before checkout. Existing unowned Google cookies are not adopted by this handoff, and logout clears the temporary safety cookie.

Privacy-preserving iPhone install attribution. The iPhone app supports Apple’s AdAttributionKit/SKAdNetwork so an advertising network can receive delayed, aggregate reports that an advertisement led to an installation. Apple limits the postback to prevent it from identifying a person or device. SmartScroll does not receive an advertising identifier, does not install Meta’s app-events SDK, does not request Apple’s App Tracking Transparency permission, and does not send learner activity or parent account data to Meta from the app.

Server logs. Our servers write structured technical logs (which route failed, an HTTP status, a latency). They are built so that personal data never enters them: no emails, no names, no student text, no photos. Logs are hosted by Vercel and expire on Vercel's platform schedule.

Optional adult confirmation for website analytics. For new analytics choices, we ask visitors to confirm that they are a parent or legal guardian aged 18 or older before selecting Allow analytics. The checkbox starts unchecked. Declining does not affect access to SmartScroll. We store this confirmation separately in the browser until it is declined or the site's browser data is cleared. It is a self-declaration, not verified identity or permission to collect a child's data, and it does not change any student profile or override a known learner context. We also honor Global Privacy Control by keeping these optional browser tools off.

What we never collect

No student email, password, phone number, birthdate, surname, or photo of the student. No contacts, no precise location, no microphone or camera access beyond the homework photo the student chooses to submit, no social features, no public profiles, no messaging between users, no advertising identifiers.

The AI tutor, photo solver, and teach-back (Google Gemini)

When a student uses the tutor, the photo solver, teach-back, or the study-plan matcher, the text they typed (and the homework photo, for the solver) is sent to Google's Gemini API to generate the response. What happens to that data:

• We do not store it. Chat history lives on the student's device and is sent along with each request; our servers keep no copy of tutor conversations, teach-back explanations, plan text, or homework photos. A photo exists on our server only for the seconds it takes to process that one request, and it never enters our logs.
• Google processes it under a paid API tier. We use Google's paid Gemini API tier, under which Google states it does not use API content to train its models. This is enforced in our code, not just in a document: in production, every AI route checks an operator-set flag (LLM_TIER) and refuses to call Gemini at all unless the deployment attests to the paid no-training tier. If the flag is absent, the AI features simply return their offline fallbacks. Setting this flag truthfully is a required step before AI features run in production.

• Safety filtering. Every tutor and teach-back reply passes Google's safety filters and then a second, independent safety check before the student sees it; flagged replies are replaced with a neutral fallback. That second check sends the draft reply text to Gemini's classifier under the same tier.
• Crisis messages. If a student's message matches signs of self-harm or crisis, the app does not send it to the AI at all; it immediately shows crisis resources (such as the 988 Suicide and Crisis Lifeline in the US). We do not store or report these messages.

Payments

On the web, subscriptions are processed by Stripe. Checkout happens on Stripe's own payment page, so your card number, CVC, and billing address go directly to Stripe and never touch our servers, ever. We store your plan, its status, the current period end date, a Stripe customer ID, and a Stripe subscription ID. Stripe holds the payment details and invoice history under its own privacy policy, and you can manage or cancel your subscription in Stripe's billing portal from your family page.

Private billing measurement. To distinguish subscription starts, later payments and adjustments, we keep provider-verified payment/refund amounts and currency, occurrence dates, and one-way subscription and transaction references linked privately to the responsible adult. These reconciliation associations are deleted by scheduled cleanup after the 90-day raw-data window, or when that adult account is deleted. Authorized marketing reports receive only aggregate outcomes for groups of at least 25 adults, separated by currency, never these private associations. Where you accepted adult marketing attribution, the private report association may also retain bounded campaign/ad/creative labels and identifiers; removing that attribution clears those campaign associations. Revoking optional marketing attribution does not delete the billing state needed to manage your subscription. Student learning content is not included, and disabled measurement destinations do not receive these records.

In the mobile apps, subscriptions are purchased through the Apple App Store (iOS) or Google Play (Android). Your payment details go to Apple or Google, never to us, and you manage or cancel the subscription in your Apple or Google account. We use RevenueCat to confirm and track the subscription's status. RevenueCat receives an app user identifier tied to your account and the store's purchase and device metadata; it does not receive your card details. What we store is the same as on the web: your plan, its status, and the store transaction reference.

Children's privacy (COPPA)

SmartScroll is designed for students roughly 11 to 14 and is built so that a parent or legal guardian controls the student's data from start to finish.

How consent actually works. A student's device works on its own with everything stored locally on that device. Nothing about the student reaches our servers until a parent links the device:

1. On the child's device, the student taps "Save your progress", which shows a 6-character code. The code, and the device's pending progress, are held for at most 15 minutes.
2. The parent signs in on their own device with their email (a one-time sign-in link that expires in 15 minutes and works exactly once).
3. Before anything is linked, the parent sees a consent screen stating exactly what will be collected (first name only, optional grade, learning progress), why, for how long, and how to delete it, with a checkbox: "I am this child's parent or legal guardian, and I consent to SmartScroll collecting this information for my child."
4. Only when the parent checks the box and confirms does our server create the student record. At that moment we record the consent: the timestamp, a one-way hash of the parent's IP address, and the browser identification string. The link cannot be completed without the explicit consent flag; the server rejects the request otherwise.

Parent rights, all self-serve on the family page:

• Review. The dashboard shows each linked student and a summary of their progress.
• Delete one student. A "Delete this student's data" button permanently removes the student record and all their progress from our servers, immediately, and tells you exactly how many records were removed. The child's device keeps its own local copy but stops syncing.
• Delete everything. A "Delete my account and all student data" button permanently removes the parent record, every student, all progress, and the subscription record, immediately, with the deletion counts shown to you. These are hard deletes, not deactivations.
• Stop collection without deleting. Deleting a student disconnects that device's sync; the device continues to work locally.

Automatic deletion. Every week, a scheduled job on our servers deletes:

• accounts whose students have all been inactive for 24 months (parents with no students are purged 24 months after account creation), and
• any expired sign-in links and device link codes. Link codes expire after 15 minutes and are also actively deleted whenever the linking routes run, because an expired code can still hold a child's pending progress. They are erased, not just disabled.

Your choices and rights

• Parents can review, delete, and disconnect their student's data at any time, directly, as described above. No support ticket is needed.
• You can also email admin@smartscroll.org with any privacy request, including access or deletion, and we will act on it.
• Depending on where you live, you may have additional rights under your state's privacy law. Contact us and we will honor the rights that apply to you.

How we protect it

All traffic to SmartScroll and between SmartScroll and every provider is encrypted in transit (TLS). Our database is encrypted at rest by our database provider. Sign-in links and sessions use signed, single-use, expiring tokens instead of passwords. Device credentials and the consent IP are stored only as one-way hashes. Access to production systems is restricted and protected with two-factor authentication. Our full written security program and retention schedule exist as standing internal documents.

Service providers

We use a small number of providers, each only to run the product:

We do not sell personal information. We do not share student information for advertising. Marketing-site providers may process the limited adult website measurements described above only after consent and only to provide measurement or advertising services to us. Apple may provide advertising networks with privacy-preserving aggregate install reports that do not identify a person or device.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the "Last updated" date, and for any material change affecting children's data we will notify parents by email and, where required, obtain new consent before the change applies to their student.

Contact

SmartScroll LLC

34 14th St, Wheatland, WY 82201

(704) 615-0231

admin@smartscroll.org

Terms of Service  ·  Disclaimer