Privacy notice
This notice is an outline written by the school and has not been reviewed by an attorney. It describes how the school is built to treat data and what we intend to promise. It takes effect only when a reviewed version is posted with an effective date and the operator’s contact details.
- In one paragraph
- What we collect from the parent
- What we collect from each student
- What we never collect
- How we use it
- Service providers
- No tracking, no advertising, no sale
- Children under 13: the direct notice and parental consent
- Parental rights: review, export, delete, withdraw
- Retention policy
- The AI tutor and human oversight
- Security
- Florida and other state rights
- Changes, effective date and contact
1. In one paragraph
The parent holds the account with an email address. Each student is an opaque id with a grade and, if the parent chooses, a first name or nickname; the school never asks for a child’s full name, birthdate, address, photograph or email. There are no advertisements, no analytics trackers, no third-party scripts and no sale of data. Learning activity is kept so the school can teach and so the family has the records Florida asks for; it is deleted on request or on the schedule below. Payment is handled by Stripe and the school never sees a card number.
2. What we collect from the parent
- Email address
- Your sign-in identity, proved by a one-time code through Cloudflare Access. Used to find your family account and to send account and billing notices.
- Consent records
- The version of the terms and of this notice you accepted, when, and your confirmation that you are the parent or legal guardian; later, the id of the checkout that completed the card verification for children under 13.
- Billing
- Your Stripe customer id and subscription status, seats and billing period. Card details, billing address and invoices live at Stripe, not with us.
- Settings and household
- Your family’s chore list and the scores you enter; the never-publish list for the school paper.
3. What we collect from each student
- An opaque id
- A random code such as s_1a2b3c4d. It is the only key used in every record, log and provider request.
- Grade
- Kindergarten to 12, to choose the plan and price the seat.
- Optional label
- A first name or nickname the parent may enter so the home screen reads naturally. Never required.
- PIN hash, and optionally a sign-in email hash
- The PIN is stored as a salted hash. If a parent links an email address for the student to sign in with, we store only a keyed hash of the address, never the address itself; the address must also be allowed by the school’s sign-in gate (Cloudflare Access), which proves it with a one-time code and holds its own record of sign-ins under Cloudflare’s terms.
- Learning activity
- Lessons opened, practice answers and timing, diagnostic results, mastery estimates, daily plan state, chore self-checks and scores, work samples the parent logs.
- Tutor conversations
- The text of each exchange with the AI tutor, kept for the parent to read and for human review of the tutor.
- School paper
- Articles, revisions and a pen name or initial byline approved by the parent; a full name is refused by design.
4. What we never collect
A child’s full name, birthdate, home address, telephone number, photograph, voice, location, biometric or government identifier, or social media handle. No device fingerprinting, no advertising identifiers, no cookies other than the short-lived profile session cookie set when a profile is opened.
5. How we use it
- To teach: build each student’s daily plan, place them, choose practice, run the tutor and spaced review.
- To keep records: the Florida home education activity log, work samples, portfolio export and annual evaluation pack, which the parent downloads.
- To report to the parent: progress, chores, the weekly report.
- To improve the school in aggregate: which lessons are hard, which items are flawed. Aggregate figures never identify a student.
- To bill the family and to answer support questions.
We do not use student data for advertising, for marketing to the student, or to build a profile of the child for any purpose other than teaching that child.
6. Service providers
| Provider | What it receives | Why |
|---|---|---|
| Cloudflare | The sign-in email, the one-time code exchange, and ordinary web traffic | Sign-in gate and the connection to the site |
| Stripe | The parent’s email, billing address and card, the family id, the number of seats and the plan | Payments, invoices, the billing portal. Never a student’s id, grade or label |
| The AI model provider | Lesson text, the student’s answers and tutor messages tied to the opaque id | The tutor and lesson generation. Never a name, grade, label or email |
| The hosting server | The database and backups, encrypted at rest | Running the school |
Each provider is bound by its own terms and, where the children’s privacy rule requires it, by written assurances that it keeps the data confidential and secure and uses it only to provide the service to us. We plan no other disclosure of a child’s data to any third party, and this notice will be updated before any such disclosure is ever made, with a separate consent from the parent.
7. No tracking, no advertising, no sale
The site loads nothing from any other domain: fonts, images and scripts are served by the school. There are no analytics trackers, advertising pixels or social media buttons. The public school paper counts page views per day without addresses. We do not sell, rent or trade any personal data, and we do not share it for advertising.
8. Children under 13: the direct notice and parental consent
The federal Children’s Online Privacy Protection Rule (16 CFR part 312, as amended in 2025) applies to the school for any student under 13, because the program is directed to children and keeps a persistent identifier and activity records for each student profile. This section is our direct notice to the parent; the parent reads it at signup before any student profile can be used.
- What we collect from a child and how it is used
- Sections 3 and 5 above.
- How consent is given
- At signup the parent confirms they are the parent or legal guardian and accepts this notice. For a child under 13 the consent is verified by the one-time enrollment charge at checkout: a monetary transaction on a card or other payment system that notifies the account holder of each discrete transaction, one of the methods listed in 16 CFR 312.5(b). A card on file with no charge does not qualify, so the charge is not waived. A student profile for a child under 13 cannot be opened until that record exists.
- Consent without disclosure
- The parent may consent to the collection and use described here without consenting to any disclosure to third parties beyond the service providers in section 6; we plan no such disclosure and will ask separately if that ever changes.
- Review, delete, refuse
- Section 9. The parent may review the child’s data, have it deleted, refuse further collection, and withdraw consent at any time.
- Operator
- Rushmore Academy, Florida. Postal address, telephone and email will be stated here before this notice takes effect; the rule requires them.
The two founding students of the pilot year are 13 and older; the obligations above begin with the first family that enrolls a younger child.
9. Parental rights: review, export, delete, withdraw
- Review and export. From the family home a parent sees every student’s activity and can download the portfolio export and the records pack at any time.
- Delete. A parent may delete a student profile or the whole family account. Deletion removes the student’s learning records, chore records, sign-in link and the profile itself from the live database; backups age out on the schedule in section 10. Published school paper articles are retracted on request and then answer 410.
- Withdraw consent or refuse further collection. Tell us, or delete the profile; the student can no longer use the service.
- Correct. A parent can change a student’s grade or label at any time and may ask us to correct any record.
Requests are honoured for the account holder, verified by a sign-in with the account email. We answer within 30 days and usually much sooner.
10. Retention policy
This is the written retention policy the children’s privacy rule requires. Data is kept only as long as reasonably necessary for the purpose it was collected for, then deleted.
| Data | Kept | Why |
|---|---|---|
| Student learning records (activity log, work samples, mastery, diagnostics) | While the account is active, then two years after the family leaves | Florida home education law expects the parent to keep a portfolio for two years; the parent may delete sooner |
| Tutor conversation logs | 12 months, then deleted | Parent review and quality checks of the tutor |
| Web server access logs (addresses and paths, no account data) | No more than 90 days | Security |
| Parent email, consent records, billing status | While the account exists, then 7 years for billing and consent records only | Tax and record-keeping law; proof of consent |
| Backups | Rolled over within 35 days of the live deletion | Disaster recovery |
11. The AI tutor and human oversight
The tutor is a large language model run by a third-party provider. It receives the lesson text and the student’s messages under the opaque id and nothing that identifies the child. A human at the school reviews tutor conversations for quality and safety; a parent can read every conversation and turn the tutor off for a student. The tutor never grades written work unless the parent turns that on, never contacts a student outside a lesson, and never publishes anything.
12. Security
Sign-in is by one-time code with no passwords to steal. The application and database run under their own isolated account on the server; every page carries a strict content security policy; PINs and student sign-in addresses are stored only as salted or keyed hashes; state-changing requests are checked for origin; the school never sees a card number. The school will maintain a written information security program with a named coordinator, an annual risk assessment, encrypted backups and written assurances from its service providers, as the children’s privacy rule requires.
13. Florida and other state rights
The Florida Digital Bill of Rights (s. 501.702 and following) applies to controllers above a revenue threshold that the school does not meet; we nevertheless follow its principles of minimisation and purpose limitation. Families in other states may have rights under their own laws; we honour the rights in section 9 for every family regardless of state.
14. Changes, effective date and contact
We will not collect or use a child’s data in a materially different way without first updating this notice and obtaining the parent’s consent again. The version and date at the top change with every revision; the account holder is emailed about material changes.
Operator: Rushmore Academy, Florida. Contact details (postal address, telephone and email) will be stated here before this notice takes effect.