Children's Privacy (COPPA Compliance)
Lumastery is designed for use by children under the direction of their parents or guardians. We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verifiable parental consent.
- A parent or guardian must create the account and add children.
- Parents must provide explicit consent before any child data is collected.
- We collect only the minimum information necessary: first name, date of birth, and learning progress data.
- We do not collect email addresses, phone numbers, or physical addresses from children.
- We do not serve behavioral advertising to children.
- Children cannot make their information publicly available.
Information We Collect
From Parents
- Email address (for account authentication)
- First name
- Payment information (processed by Stripe; we do not store card numbers)
From Children (with parental consent)
- First name
- Date of birth (used to determine grade-appropriate content)
- Learning progress data: exercise responses, accuracy, skills mastered, session history
How We Use Information
- To provide adaptive, age-appropriate math instruction
- To generate progress reports for parents
- To improve our curriculum and teaching algorithms
- To process payments and manage subscriptions
We do not sell, rent, or share personal information with third parties for marketing purposes.
Data Sharing
We share data only with the service providers necessary to operate Lumastery:
- Supabase — database hosting and authentication
- Stripe — payment processing
- Anthropic — AI-generated exercise content (no child personal data is sent; only skill metadata)
Parental Rights
As a parent or guardian, you have the right to:
- Review your child's data at any time via the parent dashboard
- Export all data collected about your child (available in Settings)
- Delete your child's profile and all associated data
- Withdraw consent by deleting your child's profile, which permanently removes all their data
Data Security
We use industry-standard security measures including encrypted connections (TLS), row-level security policies in our database, and secure authentication. Access to child data is restricted to the authenticated parent who created the child's profile.
Data Retention
We retain child data only as long as the child's profile exists. When a parent deletes a child's profile, all associated data (exercise responses, progress, assessment results, and session history) is permanently deleted.
Contact Us
If you have questions about this privacy policy or want to exercise your parental rights, contact us at privacy@lumastery.com.