Homeschool Sidekick Privacy Policy

• Your account — Your email address and password, managed by Supabase Auth. Your Sidekick account is the same account as Homestake, our other product, so the same sign-in works in both. We also record that you signed up through Sidekick.
• Your children — A first name or nickname for each child, and optionally a grade and the curriculum level they are working in. We also keep the color you pick for each child and your choices for them, such as whether they can snap their own pages. We don’t ask for a child’s last name, birthday, email address, home address, or a photo of the child.
• Child sign-ins — If you give a child a sign-in, the username and password you choose for them. Supabase Auth stores the password in scrambled (hashed) form, as it does for every account. We also keep a copy of the password that only our server can read, so that we can show it to you again if your child forgets it. Only adults in your family can see it, never the child. A child’s sign-in has no email address of its own: we never collect one for a child and never send email to a child.
• Pages — The photos you or your children upload, a resized copy we make for reading, and what we find on the page: the printed problems, your child’s written answers and work, each mark, the expected answer, a short note on the likely slip behind a missed problem, any mark you change, who uploaded the page (you or the child), and when.
• Progress and planning — Each child’s mastery of each skill and how it changed over time, daily totals, goals, your school terms, how many days a week you do math, your days off, the practice sheets we make, and how many pages your family had graded each month.
• Echo Spelling — For a child who plays: which words they spelled correctly or not, their most recent misspelling of a word, their level and placement, and game scores. This is tied to the child’s sign-in.
• A record of changes — When an adult changes photo retention or the school calendar, downloads the family’s data, or asks to delete it, we record who did it and when. These records hold settings and counts, not children’s names.
• Messages — Anything you write to us.

• Grading and records — To read and grade pages, keep each child’s record, and build reports, goals, pacing and practice sheets for you.
• Your account — To sign you in and send account emails, such as confirming your address, resetting your password, or confirming a new email address.
• Keeping the Service working — The few people who run Sidekick can look at a page and its marks when needed to fix a grading problem or answer your question.
• Checking printed problems — When a page comes from a workbook we recognize, we record how we read each printed problem, in a record shared across families. When several families’ reads agree, a misread can be caught and read again. This record holds only the printed problem text and our computed answers, never your child’s answers, handwriting, name or photo.

We don’t train AI models on your family’s pages, and the AI services we use are set up not to train on them either (see below). We don’t add your pages to the set we use to test grading accuracy without your permission.

• We do not sell your data or your children’s data to anyone.
• We do not show ads, and we do not use third-party analytics or advertising trackers.
• We do not share your data with third parties for advertising or marketing purposes.
• We do not use tracking cookies.
• We do not build profiles of you or your children for anything other than providing the Service.
• Nothing in Sidekick is public. There are no public profiles, no sharing links, and no way for children to message anyone.

We use the following services to operate Sidekick. Each receives only what it needs to do its job:

• OpenRouter and Google — To read a page, we send the resized copy of the photo, and the curriculum level if you set one, to a Google Gemini model through OpenRouter, a US-based routing service. To double-check an answer marked needs work, we may send a sharper copy of the same page. Every request is restricted to hosts that neither keep nor collect what they receive (OpenRouter’s zero-data-retention and no-data-collection settings). We never send your name, your child’s name, or your account details. The whole page is sent, so if a name is written on it, it is in the picture; nothing on the page needs a name for us to grade it. See OpenRouter’s privacy policy.
• Anthropic (Claude API) — For a page with problems marked needs work, we send the printed problems, your child’s answers, the expected answers and the curriculum level, so that Claude can write a one-sentence note on the likely slip for you. No photo and no names are sent. Anthropic does not use API inputs to train their models. See Anthropic’s privacy policy.
• Supabase — Provides sign-in, our database, and private storage for page photos.
• Fly.io — Runs our grading server, in its US East (Virginia) region. Pages pass through it while they are graded.
• Vercel — Hosts the Sidekick website and app.
• Resend — Delivers account emails to your address.
• Sentry — Error monitoring. When something breaks, a technical error report may be sent to Sentry so we can fix it. We configure it not to attach personal details such as IP addresses or cookies.

Sidekick does not send your family’s pages or data to DeepSeek or to any AI service located in China.

Sidekick does not take payment today, so we collect no payment information. We will update this policy before that changes.

• Adults in your family account can see and manage every child’s records.
• A child with a sign-in sees their own pages, progress, goals and practice sheets, and your family’s school calendar. They see a page’s results only after you release them, unless you turned on “Show results right away” for that child.
• Other families never see your family’s data.

Page photos are kept in private storage that only our server can open. When you look at a page, your browser gets a short-lived link to it.

You choose how long photos are kept in Settings: 30 days, 90 days (the default), or 1 year. After that, the photo and our resized copy are deleted. The marks, reports and progress stay. Deletion runs on a schedule several times a day, so a photo may last a few hours past its window.

Everything else we keep for as long as your family uses Sidekick, until you delete it.

Download. In Settings, under Your data, “Download your data” gives you a file with your children, pages, marks, mastery, goals, school terms and days off, practice sheets and monthly page counts, plus your most recent stored photos (up to 500). Child sign-in passwords are left out. Echo Spelling history is not in the download yet; write to us and we will send it.

Delete. In Settings, under Your data, “Delete this family” deletes your family’s Sidekick data 7 days after you ask. You can cancel until then. We delete your children’s profiles, every page and photo, the marks, reports, goals, calendar and practice sheets. Your children’s sign-ins are switched off for good and their names removed from them.

What stays after a family is deleted:

• Your own account, because it is also your Homestake account. To close it, write to us.
• A record that the deletion happened, with counts and no names, and the shared printed-problem record described above, which never held anything about your child.
• Echo Spelling history, which is tied to your child’s switched-off sign-in. Write to us and we will erase it too.
• Backups may retain data for a limited period after deletion.

Sidekick uses only the essential cookies Supabase Auth needs to keep you signed in. We do not use advertising cookies, analytics cookies, or any third-party tracking cookies. The app also saves a few preferences in your browser, such as light or dark mode, whether game sounds are on, and a paused spelling game. These stay on your device and are not sent to us.

• Data is stored in a hosted PostgreSQL database managed by Supabase, with row-level security so that each family’s adults can reach only their own family’s records.
• All communication between your browser and our servers occurs over HTTPS.
• Your password is hashed and managed by Supabase Auth, and we never have access to it. The one exception is the copy of a child’s password described above, kept so you can see it again.

Sidekick is a tool for parents, and many of the children whose work it grades are under 13. We take that seriously.

• Parents create, children don’t. Only an adult account holder can add a child or create a child’s sign-in. By adding your child and creating their sign-in, you consent on your child’s behalf to the collection and use of their information described in this policy.
• We collect only what the Service needs. From a child using their own sign-in, we collect the pages they photograph (if you allow it) and their spelling practice. We don’t ask a child for contact details, we don’t show children ads, and children can’t make anything public or message anyone.
• You stay in control. You can review everything we keep about your child in the app, correct it (for example their name, or any mark), stop further collection by switching off their sign-in or their ability to snap pages, download it, and delete it, as described above.
• Questions or requests. Write to us at hello@homeschoolsidekick.app about your child’s information. If you believe a child has an account that a parent did not create, tell us and we will delete it.

Homeschool Sidekick and Homestake are both run by Homestake Digital LLC and share one account system. If you also use Homestake, the Homestake Privacy Policy covers what you do there.

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

Sidekick is operated by Homestake Digital LLC. For questions or requests about this policy or your family’s data, write to us at hello@homeschoolsidekick.app.

See also our Terms of Service.