Privacy Policy

HomeStudyPath is operated by Campsite Prep LLC, doing business as HomeStudyPath, a limited liability company based in Arizona, United States. You can reach us at privacy@homestudypath.com with any questions about this policy or about the data we hold.

We collect only what the app needs to function. That means:

• Account information. Your name, email address, and a hashed password when you create a parent account. The state you homeschool in (used to show the right features for your state, e.g. instructional-hours tracking or Arizona ESA tools).
• Family content. The information you enter about your homeschool: your family's name, each child's display name and grade level, lesson plans, grades, reading log, portfolio file uploads, field-trip records, and chore lists.
• Co-parent accounts. If you invite a second adult to share the family, their name and email address are stored in the same way as the primary account.
• Student logins. If you give your child a separate kid-portal login, only their display name and a hashed credential are stored. In the kid portal a child can check off lessons, log reading time, and suggest a book to add to their reading log; these become part of your family's records, and a book a child suggests waits for a parent to confirm it.
• Photos of schoolwork (optional, off by default). If a parent turns on photo uploads in Settings, a student can add a photo of their schoolwork from the kid portal. Before the photo leaves the device it is resized and re-saved, which removes its location and camera details. It is stored privately in that child's portfolio, marked as added by the child, and only the adults in the family can view it. A child can remove their own photo within 24 hours; a parent can delete it at any time.
• Book lookups. When you or your student scan a book's barcode or type its ISBN, our server looks up the title, author, and page count from Open Library (openlibrary.org, run by the nonprofit Internet Archive). Only the ISBN is sent: no names or account details, and your device never connects to Open Library directly. Scanning uses your device's camera only while the scanner is open, and the camera image never leaves your device.
• Billing. When you start a paid subscription, our payment processor (Stripe) handles your card details directly. We receive only a customer ID, subscription status, and your billing address state (used to surface Arizona ESA tooling and report tax where required). We never see or store your full card number.
• Usage data. We record an aggregate page-view count by path (e.g. "10 people loaded /pricing today") and a small audit log of actions your family takes inside the app, so you can see your own change history. We use no advertising trackers and build no behavioural profiles. Our hosting provider, Cloudflare, supplies a privacy-first, cookieless Web Analytics measurement of page loads; it sets no cookies, does not track you across other websites, and collects no advertising identifiers. We use no other third-party analytics, and our web fonts are self-hosted (no external font CDN), so no third-party request is made from the children's portal.
• Push notifications (optional). If a chore-reminder notification is turned on for a device, that device's browser registers a push endpoint with its platform's push relay (operated by Apple, Google, or Mozilla, depending on the browser). Notifications transit the relay end-to-end encrypted (the relay cannot read their content), and turning reminders off removes the registration.

We deliberately do not collect: location, contacts, photos other than the portfolio uploads you (or, if you allow it, your student) choose to add, device fingerprints, advertising identifiers, or behavioural profiles.

We use what we collect to:

• Provide the planner, library, progress, portfolio, expense tracker, and other features of the app.
• Send transactional email (verify-your-email, password reset, co-parent invites, support replies, subscription receipts, weekly digests you opt into).
• Send occasional product news to active account holders (current trials and subscribers). Every one includes an unsubscribe link, and you can turn them off in Settings.
• Bill you for a paid subscription if you start one after your free trial.
• Diagnose problems you report, or that we detect automatically (such as a technical error), with strictly minimal access (we never browse your account for fun). If an error occurs on a parent's account, we may see which family it happened to, so we can follow up. This is never possible from anything a child does in their own kid-portal session: a child's activity is never linkable to them in any internal error or operational log.
• Generate the aggregate counts that show us how many people visit our public pages.
• Review support messages, individually and in aggregate, to answer you, spot common questions and problems, and improve HomeStudyPath.

We do not use your family's data for advertising, sell it, share it with data brokers, or use it to train any machine-learning model. Your educational records belong to you.

HomeStudyPath is a tool for parents and guardians who homeschool their own children. Children under 13 do not create their own accounts; the parent or legal guardian creates a kid-portal login for each child as part of their family's account.

When you add a student under 13, you are acknowledging that you are the parent or legal guardian and that you consent on behalf of that child to the collection and use described in this policy. We collect only the minimum information needed to provide the kid portal: display name, grade level, and (optionally) a login the parent sets up, plus any photos of schoolwork the parent allows the child to add. The child's data is never shared outside the family account, never used for marketing, and never sold or shared with third parties beyond the sub-processors listed below.

If you are an institution or school that wants to use HomeStudyPath in a classroom setting, please contact us first: additional COPPA / FERPA agreements may be required.

We use the following service providers to deliver the app. Each receives only the data needed for its specific function. All three are bound by their own privacy commitments; we link to each below.

Open Library, used for book lookups, is not a sub-processor: it receives only a book's ISBN from our server, never any personal information.

We never share your data with any other third party for any reason except when we are legally required to (e.g. a valid subpoena), in which case we will notify you in advance unless legally prohibited from doing so.

We keep your data while your account is active. When your account changes state:

• Trial ends and you never subscribed. Your account moves to read-only mode for 90 days so you can sign in, review, and export everything. After the 90-day window we permanently delete the family's records.
• Your paid subscription ends (you cancel, or a payment can't be collected and the subscription is canceled). Your account stays read-only (view and export) for 6 months (180 days) after the subscription ends, and you can re-subscribe at any point in that window to restore full access. After the 6 months we permanently delete the family's records. If you cancel, the window starts at the end of the billing period you already paid for.
• You delete the family yourself, at any time. The account owner can close the family from Settings → Billing → Close this family, whether the account is on a trial, subscribed, or in a read-only window. Permanent deletion from our live systems happens immediately. You can also ask us to do it by emailing privacy@homestudypath.com from the owner's email address. We may retain a small amount of billing-record information for tax purposes (Stripe handles this). We also keep support correspondence (messages you send us, our replies, and any images we send you) after you close your account, because we may need it to handle refunds, billing disputes, or legal claims, and to understand common questions and improve the product.
• Legal hold. In the rare case that we are legally required to preserve a family's records (for example, because of pending litigation), those records are exempt from deletion, including self-service closing, for as long as the obligation lasts.
• Activity log entries are pruned after 18 months on active accounts as a data-minimisation default. The full log is available via the JSON export anytime before that.

Backups. Deletion removes your records from our live systems immediately. Copies may persist for a limited time in our encrypted, access-restricted backups (nightly backups are kept for 14 days, and monthly disaster-recovery archives for up to 12 months) before being automatically purged. Backups are used only for disaster recovery; we do not restore deleted accounts or records from them.

You can export every record in your account at any time, from Reports → "Export your family's data." Choose JSON or CSV for the records, Print / PDF for a paper-friendly copy, or a Full backup ZIP that bundles the records together with every uploaded portfolio file and expense receipt. This is your data; you take it with you.

You can, at any time, from inside your account:

• Access your data via the dashboard, reports, and exports.
• Correct any field via the in-app forms (Settings, Students, Subjects, etc.).
• Export everything as JSON, CSV, a printable PDF, or a full backup ZIP (Reports → Export your family's data).
• Delete your family's account and everything in it, at any time, except support correspondence, which we keep as described under retention (account owner: Settings → Billing → Close this family).

If you are in a jurisdiction with additional statutory rights (e.g. California CCPA, EU GDPR), you may have additional rights including specific access requests, restriction of processing, and complaint to a supervisory authority. Email privacy@homestudypath.com to exercise any of these rights. We respond within 30 days.

We follow privacy-by-design and security-by-default practices:

• All traffic is encrypted in transit (HTTPS / TLS).
• Passwords are hashed with PBKDF2-HMAC-SHA256 at 600,000 iterations. We cannot see your password.
• Sessions are tracked via opaque tokens stored in a session store; a single active session per user.
• Your child's name never appears in a URL, server log, or analytics call. Portfolio file keys are opaque IDs, never names.
• Server logs intentionally avoid capturing personal information, only operational shape ("a request happened, it succeeded"). The one deliberate exception: if a technical error occurs on a parent's account, the error log may reference which family it was, so we can follow up. This never happens for anything that occurs in a child's own kid-portal session.
• An audit log inside the app records every change with the actor and timestamp; you can review this from the Activity page.

If a security incident affects your family's data, we will notify affected accounts without undue delay, consistent with applicable law.

We use a single strictly-necessary cookie to maintain your sign-in session (HttpOnly, Secure, SameSite=None). We do not use advertising cookies, analytics cookies, social-media cookies, or any other tracking mechanism. We don't show a cookie banner because we don't set anything that requires consent under common cookie laws, but you can disable cookies in your browser; you just won't be able to sign in if you do.

The app also uses your browser's local storage for non-tracking conveniences: unsent form drafts, a remembered student username on a kid's device, and display preferences like text size. That data stays on the device, is never transmitted to us or anyone else, and clears when you clear your browser data.

HomeStudyPath is hosted on Cloudflare's global edge network. Your data may be stored or processed in any of Cloudflare's data centers, which includes locations outside your country of residence. Cloudflare maintains its own commitments to international data transfer compliance.

HomeStudyPath markets to United States homeschool families as the primary audience. International families are welcome to use the app (we support an "I'm not located in the USA" state-of-instruction option), but the legal framework of the policy is United States law.

We may update this policy as the app changes. Material changes will be announced via email and via the in-app dashboard, and we may require you to review and acknowledge the new policy before continuing. The version you accepted is recorded on your account so we can detect a change. Non-material changes (typo fixes, link updates, clarifications) may be made without notice.

Send privacy questions, data requests, or complaints to privacy@homestudypath.com. For general support or product questions, use support@homestudypath.com instead.