Privacy Policy

Upcome (“we,” “our,” or “us”) is an AI-powered learning platform for children ages 5–14. This Privacy Policy explains what information we collect, how we use it, and the choices parents and guardians have. Protecting children’s privacy is the foundation of our product — not an afterthought.

Upcome is designed to comply with the U.S. Children’s Online Privacy Protection Act (COPPA), and we apply its principles to all families worldwide, alongside the EU General Data Protection Regulation (GDPR) and applicable U.S. state privacy laws where they apply.

From parents and guardians (account holders):

• Email address, used for login, password resets, receipts, and the weekly parent report.
• Payment information, processed securely by our payment provider Lemon Squeezy. We never see or store full card numbers.
• Support messages you send us, kept so we can resolve your request.

From children (only through a parent-managed profile):

• First name or nickname and age/grade, so lessons match the right level.
• Learning activity: answers given, XP earned, badges, streaks, and session history.
• Parent-approved creations such as worksheet results shared to the parent dashboard.

We do not collect children’s email addresses, last names, phone numbers, home addresses, photographs, voice recordings, or precise geolocation.

Collected automatically:

• Privacy-first analytics via Plausible (no cookies, no cross-site tracking, no advertising identifiers).
• Basic technical data needed to run the service: device type, browser, and error logs.
• A strictly-necessary session cookie that keeps you logged in. We use no advertising or tracking cookies.

• Deliver the service: adaptive lessons, AI hints from Nova, gamification (XP, badges, streaks), and parent dashboards.
• Personalize difficulty based on the child’s own progress — never for advertising.
• Send the weekly parent report and transactional emails (verification, password reset, receipts).
• Process payments and prevent fraud via Lemon Squeezy.
• Monitor reliability and fix bugs using de-identified technical logs.
• Meet legal obligations, including responding to verifiable parental requests.

A child may only use Upcome under a parent or guardian’s account, and creating a child profile counts as verifiable parental consent. Consent is granted during signup and reconfirmed at purchase. Parents may at any time:

• Review all personal information collected from their child via the parent dashboard.
• Request correction or deletion of their child’s information by emailing [email protected].
• Withdraw consent and close the account — we then delete the child’s personal information (see Section 7).
• Refuse further collection while keeping already-collected data only as needed to provide the service.

If we learn that a child’s account was created without parental consent, we suspend it and delete the child’s personal information promptly.

Nova’s hints and explanations are generated by third-party AI providers (including Anthropic) acting solely as our processors. A question and the child’s answer may be sent to generate a hint; providers process it only to return the hint and do not use it for advertising. AI output is a study aid, not a certified curriculum — parents and teachers should treat it as guidance alongside formal instruction.

We do not sell children’s personal information — ever. We share data only with:

• Service providers who run parts of the service under contract: cloud hosting, Lemon Squeezy (payments), Amazon SES (transactional email), and Plausible (privacy-first analytics).
• Schools, only the progress data the school’s own dashboard needs, under the school’s agreement with us.
• Authorities, only when required by law or to protect a child’s safety.

If Upcome is acquired or merged, families will be notified before any change of control affects their data, and COPPA protections continue to apply.

We protect data with encryption in transit (TLS), encrypted backups, least-privilege access, and separation between parent account data and child learning data. No system is perfectly secure, so we monitor for incidents and will notify affected parents promptly if a breach involves their family’s data.

We keep learning data only while the account is active so progress and reports work. When an account is closed — or when a parent requests deletion — we delete the child’s personal information within 30 days, except for records we must keep briefly for tax, fraud-prevention, or legal compliance, which are never used for marketing or personalization.

Parents may access, correct, export, or delete their family’s data at any time via the parent dashboard or by emailing [email protected]. Where GDPR or U.S. state laws (such as the CCPA/CPRA) apply, you additionally have the rights those laws grant — including the right to know, opt out of any sale or sharing (we do neither), limit sensitive-data use, and appeal a decision on your request. We never discriminate for exercising your rights.

If we change this policy materially, we will notify account holders by email and in the app at least 14 days before the change takes effect, and we will obtain fresh parental consent where COPPA requires it. Continued use after the effective date constitutes acceptance.

Upcome, data privacy inquiries: [email protected]. Parents with deletion or access requests receive a substantive response within 7 days.