Rooted

1. Information We Collect

We collect information you provide directly to us when you create an account, including your family name, email address, and password. We also collect information about your children (first names and avatar colors only, entered by you as a parent or guardian) and the educational content you log within the app — lessons, books, memories, reflections, and photos. We do not collect sensitive personal information such as Social Security numbers, financial data, or government IDs.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve Rooted. This includes generating your family's progress reports, displaying your garden growth, and personalizing your experience based on your state. We do not sell your personal information to third parties. We do not use your data for advertising purposes.

3. Children's Privacy (COPPA)

Rooted is designed for use by parents and guardians to track their children's education. We are committed to complying with the Children's Online Privacy Protection Act (COPPA).

For each child, we collect a first name and avatar color, both entered by a parent or guardian. We do not collect contact information for children and never share children's data with anyone outside your account.
If you use the transcript feature to generate official homeschool transcripts, you may also choose to enter the child's full name, date of birth, graduation year, school name, and related academic details. This data is used solely to render the transcript document for your own use and is never shared, sold, or used for any other purpose.
Photos uploaded by parents may contain children. These photos are uploaded entirely at the parent's discretion, stored privately within the parent's account, never used for advertising, and never shared with any third party. Parents may delete any photo at any time from within the app.
We do not knowingly collect personal information directly from children under 13. All data about children is entered and controlled exclusively by the parent or guardian account holder.
Parents and guardians may review, update, or permanently delete all information about their children at any time through the Settings page or by contacting us at hello@rootedhomeschoolapp.com.

4. Cookies and Local Storage

Rooted uses browser local storage and session storage to manage your login session and remember your preferences (such as which resources you've viewed). We do not use third-party tracking cookies, advertising pixels, or analytics services that share your data with external companies. Our use of local storage is limited to making the app work for you.

5. Data Storage and Security

Your data is stored securely using Supabase, a trusted database platform with industry-standard encryption at rest and in transit. We use row-level security policies on our database so your family's lessons, memories, and account data are accessible only to you.

Photos and media you upload are stored in private cloud storage. Photo URLs require authentication and expire on a rolling basis — they cannot be viewed by anyone outside the app without a fresh, time-limited token issued for that specific request.

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of discovering the breach via the email address associated with your account.

6. Data Retention and Deletion

You may export all your data or permanently delete your account and all associated data at any time directly from the Settings page within the app. Account deletion takes effect immediately when you confirm in Settings. Some information may be retained in encrypted backups for up to 90 days after deletion, after which it is permanently purged. If you have questions or run into any issues, contact us at hello@rootedhomeschoolapp.com.

7. Third-Party Services

We use the following third-party services to operate Rooted. Each has its own privacy policy, and we share only the minimum data necessary for each service to function:

Supabase — database, authentication, and file storage
Vercel — application hosting, deployment, and basic performance analytics (page load times)
Stripe — payment processing for Pro subscriptions. Stripe handles all payment data directly; we never store your full card number or payment credentials.
Resend — sending transactional emails (welcome, receipts, account notifications)
PostHog — product analytics (anonymous usage data such as page views and clicks) so we can understand how families use Rooted and improve the experience. PostHog does not access your photos, memory content, or children's information.
Google Analytics — aggregate usage statistics. Google Analytics does not access your photos, memory content, or children's information.

None of our analytics or third-party services are used for advertising. We do not sell, share, or rent your personal information to anyone, ever.

8. California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to Know: You may request a copy of the personal information we have collected about you.
Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
Right to Opt Out of Sale: We do not sell your personal information to third parties, and we never will.

To exercise any of these rights, contact us at hello@rootedhomeschoolapp.com. We will respond within 45 days.

9. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at hello@rootedhomeschoolapp.com. We are a small, family-run company and will respond personally to every inquiry.