Privacy Policy

HomeStudyPath is operated by Campsite Prep LLC, doing business as HomeStudyPath, a limited liability company based in Arizona, United States. You can reach us at privacy@homestudypath.com with any questions about this policy or about the data we hold.

We collect only what the app needs to function. That means:

• Account information. Your name, email address, and a hashed password when you create a parent account. The state you homeschool in (used to show the right features for your state, e.g. instructional-hours tracking or Arizona ESA tools).
• Family content. The information you enter about your homeschool: your family's name, each child's display name and grade level, lesson plans, grades, reading log, portfolio file uploads, field-trip records, and chore lists.
• Co-parent accounts. If you invite a second adult to share the family, their name and email address are stored in the same way as the primary account.
• Student logins. If you give your child a separate kid-portal login, only their display name and a hashed credential are stored. The kid portal does not collect any personal information directly from the child.
• Billing. When you start a paid subscription, our payment processor (Stripe) handles your card details directly. We receive only a customer ID, subscription status, and your billing address state (used to surface Arizona ESA tooling and report tax where required). We never see or store your full card number.
• Usage data. We record an aggregate page-view count by path (e.g. "10 people loaded /pricing today") and a small audit log of actions your family takes inside the app, so you can see your own change history. We use no advertising trackers and build no behavioural profiles. Our hosting provider, Cloudflare, supplies a privacy-first, cookieless Web Analytics measurement of page loads; it sets no cookies, does not track you across other websites, and collects no advertising identifiers. We use no other third-party analytics, and our web fonts are self-hosted (no external font CDN), so no third-party request is made from the children's portal.
• Push notifications (optional). If a chore-reminder notification is turned on for a device, that device's browser registers a push endpoint with its platform's push relay (operated by Apple, Google, or Mozilla, depending on the browser). Notifications transit the relay end-to-end encrypted — the relay cannot read their content — and turning reminders off removes the registration.

We deliberately do not collect: location, contacts, photos outside the portfolio uploads you choose, device fingerprints, advertising identifiers, or behavioural profiles.

We use what we collect to:

• Provide the planner, library, progress, portfolio, expense tracker, and other features of the app.
• Send transactional email (verify-your-email, password reset, co-parent invites, support replies, subscription receipts, weekly digests you opt into).
• Bill you for a paid subscription if you start one after your free trial.
• Diagnose problems you report, with strictly minimal access (we never browse your account for fun).
• Generate the aggregate counts that show us how many people visit our public pages.

We do not use your family's data for advertising, sell it, share it with data brokers, or use it to train any machine-learning model. Your educational records belong to you.

HomeStudyPath is a tool for parents and guardians who homeschool their own children. Children under 13 do not create their own accounts; the parent or legal guardian creates a kid-portal login for each child as part of their family's account.

When you add a student under 13, you are acknowledging that you are the parent or legal guardian and that you consent on behalf of that child to the collection and use described in this policy. We collect only the minimum information needed to provide the kid portal — display name, grade level, and (optionally) a login the parent sets up. The child's data is never shared outside the family account, never used for marketing, and never sold or shared with third parties beyond the sub-processors listed below.

If you are an institution or school that wants to use HomeStudyPath in a classroom setting, please contact us first — additional COPPA / FERPA agreements may be required.

We use the following service providers to deliver the app. Each receives only the data needed for its specific function. All three are bound by their own privacy commitments; we link to each below.

We never share your data with any other third party for any reason except when we are legally required to (e.g. a valid subpoena), in which case we will notify you in advance unless legally prohibited from doing so.

We keep your data while your account is active. When your account changes state:

• Trial expires without subscribing. Your account moves to read-only mode for 90 days so you can sign in, review, and export everything. After the 90-day window we permanently delete the family's records.
• You cancel a paid subscription. Same 90-day read-only window starts at the end of your current billing period, then permanent deletion.
• You delete the family yourself (from Settings). Permanent deletion happens immediately. We may retain a small amount of billing-record information for tax purposes (Stripe handles this).
• Activity log entries are pruned after 18 months on active accounts as a data-minimisation default. The full log is available via the JSON export anytime before that.

Backups. Deletion removes your records from our live systems immediately. Copies may persist for a limited time in our encrypted, access-restricted backups — nightly backups are kept for 14 days, and monthly disaster-recovery archives for up to 12 months — before being automatically purged. Backups are used only for disaster recovery; we do not restore deleted accounts or records from them.

You can export every record in your account at any time, from Reports → "Export your family's data." Choose JSON or CSV for the records, Print / PDF for a paper-friendly copy, or a Full backup ZIP that bundles the records together with every uploaded portfolio file and expense receipt. This is your data; you take it with you.

You can, at any time, from inside your account:

• Access your data via the dashboard, reports, and exports.
• Correct any field via the in-app forms (Settings, Students, Subjects, etc.).
• Export everything as JSON, CSV, a printable PDF, or a full backup ZIP (Reports → Export your family's data).
• Delete your family's account (Settings → Billing → Close family account).

If you are in a jurisdiction with additional statutory rights (e.g. California CCPA, EU GDPR), you may have additional rights including specific access requests, restriction of processing, and complaint to a supervisory authority. Email privacy@homestudypath.com to exercise any of these rights. We respond within 30 days.

We follow privacy-by-design and security-by-default practices:

• All traffic is encrypted in transit (HTTPS / TLS).
• Passwords are hashed with PBKDF2-HMAC-SHA256 at 600,000 iterations. We cannot see your password.
• Sessions are tracked via opaque tokens stored in a session store; a single active session per user.
• Your child's name never appears in a URL, server log, or analytics call. Portfolio file keys are opaque IDs, never names.
• Server logs intentionally avoid capturing personal information — only operational shape ("a request happened, it succeeded").
• An audit log inside the app records every change with the actor and timestamp; you can review this from the Activity page.

If a security incident affects your family's data, we will notify affected accounts without undue delay, consistent with applicable law.

We use a single strictly-necessary cookie to maintain your sign-in session (HttpOnly, Secure, SameSite=None). We do not use advertising cookies, analytics cookies, social-media cookies, or any other tracking mechanism. We don't show a cookie banner because we don't set anything that requires consent under common cookie laws — but you can disable cookies in your browser; you just won't be able to sign in if you do.

The app also uses your browser's local storage for non-tracking conveniences — unsent form drafts, a remembered student username on a kid's device, and display preferences like text size. That data stays on the device, is never transmitted to us or anyone else, and clears when you clear your browser data.

HomeStudyPath is hosted on Cloudflare's global edge network. Your data may be stored or processed in any of Cloudflare's data centers, which includes locations outside your country of residence. Cloudflare maintains its own commitments to international data transfer compliance.

HomeStudyPath markets to United States homeschool families as the primary audience. International families are welcome to use the app (we support an "I'm not located in the USA" state-of-instruction option), but the legal framework of the policy is United States law.

We may update this policy as the app changes. Material changes will be announced via email and via the in-app dashboard, and we may require you to review and acknowledge the new policy before continuing. The version you accepted is recorded on your account so we can detect a change. Non-material changes (typo fixes, link updates, clarifications) may be made without notice.

Send privacy questions, data requests, or complaints to privacy@homestudypath.com. For general support or product questions, use support@homestudypath.com instead.