Our Privacy Philosophy

LearnerX is a tutoring service for children, and we never lose sight of that. Everything we build — every feature, every system, every decision about data — starts with one question: is this safe for families?

We follow three principles:

• Collect the minimum. If we don't need it, we don't ask for it.
• Parents are in control. You decide what your child can access, and you can see everything we store.
• No surprises. We don't sell data, we don't run ads, and we don't track your family across the web.

What We Collect (and What We Don't)

We believe in being specific, so here's a clear breakdown:

Children's Privacy

This is the section we care about most. LearnerX is built for children, and protecting them is non-negotiable.

Student Data & Education Privacy

LearnerX is an educational product — your child's learning data deserves the same protections that apply in traditional school settings. Even though FERPA (the Family Educational Rights and Privacy Act) technically applies to schools receiving federal funding, we voluntarily align with its principles because it's the right standard for any product handling student information.

Our FERPA-Aligned Commitments

• Education records belong to families. Parents have full access to, and control over, all of their child's learning data — including session transcripts, progress reports, and any assessments generated by LearnerX.
• Student data is used solely for education. Your child's information is used exclusively to provide and improve the tutoring experience. It is never used for advertising, behavioral profiling, building marketing profiles, or any other commercial purpose unrelated to learning.
• No sale or redisclosure. We never sell, rent, lease, or trade student data to any third party. Period. Student information is not disclosed to anyone outside your family account without explicit parental consent, unless required by law.
• Data minimization for learning. We collect only what's necessary to deliver effective tutoring. We don't gather social media profiles, contact lists, browsing history, or any data unrelated to your child's educational experience.
• Deletion upon request. When you delete a child's profile or close your family account, all associated student data — including learning records, session history, and progress data — is permanently and irreversibly deleted within 30 days.

State Student Data Privacy Laws

Beyond federal standards, we comply with state student data privacy laws that apply to products designed and marketed for K–12 education, including:

• California (SOPIPA). We do not use student data for targeted advertising, build advertising profiles, sell student information, or use collected data outside of the educational context — as required by the Student Online Personal Information Protection Act.
• New York (Education Law 2-d). We maintain the data security and privacy protections required for student data and teacher/principal data under New York Education Law Section 2-d and its implementing regulations.
• Other states. We monitor and comply with student data privacy laws across all U.S. states, including those in Colorado, Connecticut, Illinois, Virginia, and others that have enacted student privacy protections.

Voice & Session Data

LearnerX's tutoring includes voice-based conversations. We know this raises questions — especially when children are involved — so here's exactly how it works:

• Voice audio is processed in real time to enable the tutoring conversation. Audio is streamed, not stored as permanent recordings.
• Session transcripts (text versions of what was said) are generated so parents can review what happened during each session.
• Transcripts and session summaries are retained for 7 days, then automatically and permanently deleted. This gives parents time to review sessions without data lingering indefinitely.
• All session data is encrypted both in transit and at rest. We use end-to-end encryption wherever technically feasible, meaning even we cannot read the content of your child's sessions in most cases.
• Voice data is never used to train AI models. Your child's voice and words are not added to any training dataset — by us or by our AI partners.

How AI Works in LearnerX

We use artificial intelligence to power the tutoring experience. We want to be straightforward about who our technology partners are and what role each plays:

Important: We have data processing agreements with each of these partners. None of them are permitted to use your family's data for their own purposes, including training their AI models. Your child's interactions stay within LearnerX's ecosystem.

How Long We Keep Your Data

We don't keep things longer than we need to. Here's a clear breakdown:

Payment Processing

We use Stripe to handle all payments. This means:

• We never see, store, or have access to your credit card number
• All payment information goes directly to Stripe's secure systems
• We only receive confirmation of your subscription status and billing cycle
• Stripe is PCI Level 1 certified — the highest level of payment security

Your payment data and your child's tutoring data are completely separate systems. Stripe knows you're a subscriber; they know nothing about your family's learning activity.

Third Parties

Here's the complete list of third parties that interact with your data. There are no hidden partners:

• Anthropic (Claude) — Content and curriculum AI
• xAI (Grok) — Voice tutoring AI
• LiveKit — Real-time voice infrastructure
• Stripe — Payment processing
• Neon — Encrypted database hosting
• Cloudflare — Temporary file storage and security

That's it. We explicitly do not use:

• ✕ Google Analytics or any analytics platform
• ✕ Facebook, Meta, or any social media trackers
• ✕ Advertising networks or retargeting tools
• ✕ Data brokers or aggregators
• ✕ Any service that profiles children for marketing

Your Rights

Regardless of where you live, we give every family the same strong set of rights over their data:

• Access. View all data we have about your family, anytime, from your parent dashboard.
• Export. Download your family's data in standard formats. Your data is portable.
• Correction. Update or correct any information directly in the app.
• Deletion. Delete individual child profiles or your entire family account. Deletion is real and permanent.
• Restriction. Pause your account without losing data, or limit what data is collected.
• Object. If you disagree with how we handle something, tell us. We'll listen.

Security

We take the security of your family's data seriously. Here's how we protect it:

• Encryption in transit: All connections use HTTPS/TLS. Data moving between your device and our servers is always encrypted.
• Encryption at rest: Data stored in our database is encrypted. We pursue zero-knowledge encryption wherever technically feasible, meaning even our own team cannot read the contents.
• Password security: Passwords are hashed using bcrypt. We never store passwords in plain text.
• Access controls: Our team operates on a strict least-privilege basis. Only the people who need access to specific systems have it.
• Infrastructure: We use established, security-audited hosting providers with SOC 2 compliance.

No system is perfectly invulnerable, and we won't pretend otherwise. But we will always be honest with you about what we do to protect your data, and we will notify you promptly if a security incident ever affects your account.

Changes to This Policy

If we update this policy, here's how we'll handle it:

• We'll notify you by email before any significant changes take effect
• Major changes will include 30 days' notice so you can review them
• The "last updated" date at the top will always reflect the current version
• We'll never quietly weaken your privacy protections

Our core commitments — protecting children's data, never selling information, keeping parents in control — are not subject to change.