Roots & Wings ("we," "us") is created for and used by parents and guardians on behalf of their household, including their children. This policy explains what we collect from the parent who holds the account and about the children in that household, why, and what rights you and your children have over that information.

Information we collect

Account & household data.Your email and password are managed by our authentication provider (Supabase) — we never see or store your password ourselves. We also store your display name, birthdate (used only to confirm you're 18 or older when you sign up), and household settings.

Children's profiles.Each child profile (name, grade, birthdate, subjects, interests, strengths, growth areas, learning style) is entered by you and used only to generate and personalize that child's lessons and activities. It is never shown to other families.

Photos you upload.If you add photos to a Travel Journal print order, they're stored in a private cloud storage location — not a public one. They're only ever displayed to you through temporary links that expire after an hour, generated fresh each time you view your own order. Removing a photo deletes the underlying file immediately, not just its reference in your order.

Gratitude reflections & Community sharing. Your children's gratitude reflections stay private to your household by default. If you choose to share one to Community, it's posted under your own name — never your child's.

State / country.We ask which U.S. state (or country, if you're outside the U.S.) your family is in so lessons can be aligned to the academic standard that state or country actually uses, rather than a generic national framework. This is never shown to other families.

Location. Your ZIP code is only collected if you opt in to Community, and is only ever used to compute a rounded distance range to other opted-in families — never shown as an exact address or ZIP code.

Student Portal PIN.A child's Student Portal PIN is stored only as a salted one-way hash — a form no one, including us, can read back into the original PIN.

Print orders. If you order a printed workbook or journal, shipping and payment details are stored to fulfill that order and are not used for any other purpose.

AI processing.Lesson, activity, and print content is generated using Anthropic's Claude API. Community posts are also reviewed by AI for moderation before they're visible to other families.

Basic technical data. Like any website, our hosting provider logs standard technical information (such as IP address and browser type) for security and reliability.

Site analytics.We use a cookieless analytics tool to understand aggregate traffic to the marketing site (like which pages are visited and how many people sign up) — it doesn't use cookies, doesn't track you across other sites, and doesn't identify individual visitors or children.

How we use information

To personalize lessons, activities, and print content for each child; to run your household account and the optional Community features you opt into; to moderate Community content for safety; and to fulfill print orders. We don't sell your data, we don't use your family's information to train AI models, and we don't use children's information for behavioral advertising.

Children's privacy (COPPA)

Roots & Wings is designed to be used by a parent or guardian on behalf of their children — not signed up for directly by a child.

Only adults create accounts.Signing up requires confirming you're 18 or older; children never create their own account or log in independently of a parent enabling that access.

Parents stay in control.All information about a child is entered by their parent, who reviews and approves generated lesson content before their child ever sees it, and can review, edit, or permanently delete that child's information at any time from Settings.

Deleting an account deletes everything. Deleting your household account permanently removes every child profile and all associated data — lessons, gratitude entries, print orders, uploaded photos — everywhere, immediately.

We do not knowingly collect information directly from a child independent of their parent's account, and we never sell a child's information.

A note on FERPA

FERPA governs student education records held by schools and school districts that receive federal funding. Because Roots & Wings is used directly by families rather than by a school, it likely does not directly apply to us — but this should be confirmed with counsel, particularly if any school or district ever uses Roots & Wings on behalf of their students.

How we share information

We never sell your information. We share it only with service providers acting on our behalf, under obligations to protect it: Supabase (hosting, authentication, database, and file storage) and Anthropic (AI processing), plus a print fulfillment partner for physical orders. Other families only ever see what you explicitly choose to share — your display name, a Community post or comment you wrote, or a rounded distance bucket — never a child's name or anything you haven't chosen to post. We may also disclose information if required by law or to protect someone's safety.

Data retention & deletion

We keep your information while your account is active. You can permanently delete your account at any time from Settings — this immediately and irreversibly removes your household, every child profile, and all associated lesson, gratitude, and print history, including uploaded photos.

Security

Authentication is handled by Supabase using industry-standard practices; we never store your password ourselves. Student Portal PINs are stored as salted one-way hashes and lock out after repeated incorrect attempts. Uploaded child photos are stored privately and served only through temporary, expiring links. All traffic to this site is encrypted.

Your rights and choices

Everyone.Regardless of where you live, you can access, correct, or delete your (and your children's) information at any time from Settings, or by contacting us, and you can opt out of Community and location sharing at any time.

California residents.Under the CCPA/CPRA, you have the right to know what we collect, delete it, correct it, opt out of the sale or sharing of it (we don't sell or share data as those laws define it), limit use of sensitive information, and not be discriminated against for exercising these rights. Separately, because Roots & Wings processes information about K-12 students, we don't use a child's information to build advertising profiles or for targeted advertising, and we don't sell it — consistent with California's SOPIPA requirements for operators of school-related sites and services.

Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws. You have the right to access, correct, delete, and obtain a portable copy of your data, and to opt out of targeted advertising, sale, and profiling — we don't do any of these. To exercise these rights, contact us using the information below; we won't discriminate against you for doing so.

Every other U.S. state.Even where a state doesn't yet have a comprehensive privacy law of its own, we apply these same access, correction, and deletion rights to every user, regardless of state.

Outside the United States. If applicable law — such as the EU or UK GDPR — grants you additional rights (access, correction, erasure, restriction, portability, or objection), we honor them for any user, regardless of location.

Changes to this policy

We may update this policy as the platform develops. We'll note meaningful changes here.

Contact us

To exercise any of the rights described above, or with questions about this policy, contact us at privacy@rootsandwings.com.