SmartScroll Privacy Policy

Last updated: July 8, 2026

SmartScroll is a learning app for students, set up and managed by a parent or legal guardian. This policy explains, in plain language, exactly what we collect, why, how long we keep it, and how to delete it. It is written to match what our software actually does, not what a template says.

SmartScroll is operated by SmartScroll LLC (34 14th St, Wheatland, WY 82201; (704) 615-0231). Questions or privacy requests: admin@smartscroll.org.

The short version

• We collect as little as we can. For a student, that means a first name, an optional grade level, and learning progress (plus, only if a parent chooses to enter them, the student's report-card grades). Anything a student types in their own words about what is hard stays on their device and is never sent to us. Nothing else.
• Students do not have email addresses, passwords, or accounts with us. Only parents do.
• We do not sell personal information. We show no ads. There are no third party ad trackers.
• The AI tutor sends what a student types (and homework photos, if they use the photo solver) to Google's Gemini service to generate a reply. We do not store those messages or photos on our servers.
• Parents can see everything we hold about their student and delete any of it, or all of it, themselves, from the family page. Deletes are immediate and permanent.
• Data from inactive families is deleted automatically after 24 months.

What we collect, why, and for how long

From parents

Your email address. This is the only email address in our system. We use it to sign you in (we email you a one-time sign-in link instead of using passwords) and, if you subscribe, to send billing notices such as a failed payment or an upcoming renewal. It is kept until you delete your account or until the automatic inactivity purge removes it.

A consent record. When you link your child's device, we record that you consented: the time, a one-way hash of your IP address (we deliberately do not keep the IP address itself), and the first part of your browser's identification string. We keep this so we can show that a parent, not a child, approved the collection. It is deleted with your account.

Subscription state. If you subscribe, we store your plan (Good, Better, or Best) and billing period, its status, the billing period end date, and two Stripe identifiers (a customer ID and a subscription ID). See "Payments" below for what Stripe holds and we never do.

Your timezone and email preferences. When you are signed in, your browser's timezone is captured so the weekly progress email is sent at a sensible local time. If you unsubscribe from an email, we store that preference (separately for the weekly digest and the session-reminder emails) so we honor it. Both are kept until you delete your account.

Report-card grades you enter (optional). From your dashboard you may log a student's real report-card grade (a subject, a value such as "B+", and a date) so you can see progress before and after. This is entered by you, shown only to you, and kept as an append-only history until you delete the student or account. The student's device never sends or receives it (see below).

From students

First name only, and an optional grade level. By design, we cannot store more than that: our server keeps only the first word of whatever name is entered, capped at 24 characters, and the database refuses anything longer. No surname, no birthdate, no student email address, no photo, no free-form profile. If no name is given, we use "Student".

Learning progress. One progress record per student. It holds the data that powers the feed's adaptivity, the tutoring program, and the parent dashboard, in these categories:

• Practice and mastery: which questions were answered right or wrong, how many times each has been served, a per-skill mastery score (with attempt counts and timestamps), and the first-seen and first-mastered dates per skill.
• Game and streak state: experience points, coins, the daily streak and its date, cosmetic avatar accessories the student bought or selected, and streak-freeze and reward counters. These are scores and counters so the rewards and coin economy work, never messages.
• Usage counters: today's XP, an optional focus plan the student set, and a per-day count of tutor messages and photo solves used (numbers only, never the messages or photos).
• The Day-1 starting snapshot: a one-time record made when the student first maps their level: first name, grade, which subjects were mapped, placement scores, and the stated learning goal (with an optional upcoming-test date). Anything the student typed in their own words about what is hard, and any grades a student self-reports, stay only on that student's device and are never sent to us.
• Tutoring sessions and schedule: for the tutoring program, a record of each completed session (the skill, minutes on task, and the exit-ticket result, never the questions or answers), the weekly session schedule and its timezone, the current learning pathway, and a log of when the plan was re-shaped.

This is what powers the feed's adaptivity and the parent dashboard. On the parent dashboard we show a computed summary built from this record (progress by subject, skills mastered, where the student is stuck, recent session reports, and time on task); the raw progress record itself is not exposed.

A device sync credential. The student's device holds a random sync token that lets it save progress. We store only a one-way hash of it, so neither we nor anyone who obtained our database could impersonate the device.

Progress is kept until the parent deletes the student or the account, or until the automatic 24 month inactivity purge.

From everyone

IP addresses. We use the IP address on each request to enforce rate limits (so nobody can flood the tutor, guess link codes, or spam sign-in emails). These live in short-lived counters that expire on their own, the longest within about 48 hours. We never write raw IP addresses to our database or our logs; the one place an IP-derived value is stored, the parental consent record, holds only a one-way hash.

Aggregate analytics. We use Vercel Analytics (first party, cookie-free) to count product events such as "onboarding completed", "tutor message sent", or "photo solve started", with coarse labels like the subject ("math") or the plan ("monthly"). No names, no typed content, and no student identifiers are attached to these events. We also use Vercel Speed Insights, which measures page load performance. We run no advertising trackers and no cross-site tracking.

Server logs. Our servers write structured technical logs (which route failed, an HTTP status, a latency). They are built so that personal data never enters them: no emails, no names, no student text, no photos. Logs are hosted by Vercel and expire on Vercel's platform schedule.

What we never collect

No student email, password, phone number, birthdate, surname, or photo of the student. No contacts, no precise location, no microphone or camera access beyond the homework photo the student chooses to submit, no social features, no public profiles, no messaging between users, no advertising identifiers.

The AI tutor, photo solver, and teach-back (Google Gemini)

When a student uses the tutor, the photo solver, teach-back, or the study-plan matcher, the text they typed (and the homework photo, for the solver) is sent to Google's Gemini API to generate the response. What happens to that data:

• We do not store it. Chat history lives on the student's device and is sent along with each request; our servers keep no copy of tutor conversations, teach-back explanations, plan text, or homework photos. A photo exists on our server only for the seconds it takes to process that one request, and it never enters our logs.
• Google processes it under a paid API tier. We use Google's paid Gemini API tier, under which Google states it does not use API content to train its models. This is enforced in our code, not just in a document: in production, every AI route checks an operator-set flag (LLM_TIER) and refuses to call Gemini at all unless the deployment attests to the paid no-training tier. If the flag is absent, the AI features simply return their offline fallbacks. Setting this flag truthfully is a required step before AI features run in production.

• Safety filtering. Every tutor and teach-back reply passes Google's safety filters and then a second, independent safety check before the student sees it; flagged replies are replaced with a neutral fallback. That second check sends the draft reply text to Gemini's classifier under the same tier.
• Crisis messages. If a student's message matches signs of self-harm or crisis, the app does not send it to the AI at all; it immediately shows crisis resources (such as the 988 Suicide and Crisis Lifeline in the US). We do not store or report these messages.

Payments (Stripe)

Subscriptions are processed by Stripe. Checkout happens on Stripe's own payment page, so your card number, CVC, and billing address go directly to Stripe and never touch our servers, ever. What we store is only: your plan, its status, the current period end date, a Stripe customer ID, and a Stripe subscription ID. Stripe holds the payment details and invoice history under its own privacy policy, and you can manage or cancel your subscription in Stripe's billing portal from your family page.

Children's privacy (COPPA)

SmartScroll is designed for students roughly 11 to 14 and is built so that a parent or legal guardian controls the student's data from start to finish.

How consent actually works. A student's device works on its own with everything stored locally on that device. Nothing about the student reaches our servers until a parent links the device:

1. On the child's device, the student taps "Save your progress", which shows a 6-character code. The code, and the device's pending progress, are held for at most 15 minutes.
2. The parent signs in on their own device with their email (a one-time sign-in link that expires in 15 minutes and works exactly once).
3. Before anything is linked, the parent sees a consent screen stating exactly what will be collected (first name only, optional grade, learning progress), why, for how long, and how to delete it, with a checkbox: "I am this child's parent or legal guardian, and I consent to SmartScroll collecting this information for my child."
4. Only when the parent checks the box and confirms does our server create the student record. At that moment we record the consent: the timestamp, a one-way hash of the parent's IP address, and the browser identification string. The link cannot be completed without the explicit consent flag; the server rejects the request otherwise.

Parent rights, all self-serve on the family page:

• Review. The dashboard shows each linked student and a summary of their progress.
• Delete one student. A "Delete this student's data" button permanently removes the student record and all their progress from our servers, immediately, and tells you exactly how many records were removed. The child's device keeps its own local copy but stops syncing.
• Delete everything. A "Delete my account and all student data" button permanently removes the parent record, every student, all progress, and the subscription record, immediately, with the deletion counts shown to you. These are hard deletes, not deactivations.
• Stop collection without deleting. Deleting a student disconnects that device's sync; the device continues to work locally.

Automatic deletion. Every week, a scheduled job on our servers deletes:

• accounts whose students have all been inactive for 24 months (parents with no students are purged 24 months after account creation), and
• any expired sign-in links and device link codes. Link codes expire after 15 minutes and are also actively deleted whenever the linking routes run, because an expired code can still hold a child's pending progress. They are erased, not just disabled.

Your choices and rights

• Parents can review, delete, and disconnect their student's data at any time, directly, as described above. No support ticket is needed.
• You can also email admin@smartscroll.org with any privacy request, including access or deletion, and we will act on it.
• Depending on where you live, you may have additional rights under your state's privacy law. Contact us and we will honor the rights that apply to you.

How we protect it

All traffic to SmartScroll and between SmartScroll and every provider is encrypted in transit (TLS). Our database is encrypted at rest by our database provider. Sign-in links and sessions use signed, single-use, expiring tokens instead of passwords. Device credentials and the consent IP are stored only as one-way hashes. Access to production systems is restricted and protected with two-factor authentication. Our full written security program and retention schedule exist as standing internal documents.

Service providers

We use a small number of providers, each only to run the product:

We do not sell personal information, we do not share it for advertising, and no provider may use it for anything except providing its service to us.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the "Last updated" date, and for any material change affecting children's data we will notify parents by email and, where required, obtain new consent before the change applies to their student.

Contact

SmartScroll LLC

34 14th St, Wheatland, WY 82201

(704) 615-0231

admin@smartscroll.org

Terms of Service  ·  Disclaimer