Privacy Policy
Loom Bunny helps parents create personalized homeschool learning materials. This Privacy Policy explains what information we collect, why we use it, when it may be shared with service providers, and the choices available to you.
On this page (Jump to section)▼
1. Overview & Applicability
This Privacy Policy applies to the Loom Bunny website, web applications, parent account dashboard, learning material generator, and related educational tools (collectively, the “Service”).
Loom Bunny is designed for use by parents, guardians, and homeschool educators (“parents” or “users”), not for independent use by children. Children do not create accounts, log in, or interact with the Service directly. All accounts, generation requests, and profile configurations are managed entirely by the parent or educator.
The Service is operated solely by adults for the purpose of creating homeschool materials. We minimize child-related data collection and do not offer child accounts.
2. Information We Collect
We collect only the categories of personal information necessary to deliver, manage, and personalize the homeschool creation services you request:
- Account Information: When you register for an account, we collect your parent email address and authentication identifiers. If you authenticate through a third-party login provider (such as Google OAuth), we receive standard identity tokens from that provider to establish your authenticated session.
- Child Profile Information Provided by a Parent: To personalize generated learning materials, parents may optionally enter limited profile details in their account dashboard. This may include a child's first name or nickname, grade level, approximate age band, reading level, learning format preferences, interests (such as dinosaurs, space, or robotics), and parent teaching notes. Parents maintain full control over what details they provide and can edit or remove them at any time.
- Content You Provide: We collect the educational topics, prompt instructions, pasted lesson text, curriculum notes, and uploaded source materials (such as curriculum page images or PDF excerpts) that you provide to generate worksheets, workbooks, stories, and unit studies.
- Generated Content & History: We store the printable learning resources generated for your account, including worksheets, teacher answer keys, reading passages, page layouts, preview images, and generation job records, so you can access and download them from your workspace.
- Feedback & Learning Preferences: When you rate generated outputs (e.g., “Loved it”, “Worked well”, “Didn't work”), select feedback reason chips, or submit qualitative feedback notes, we store this information in connection with your account to adapt future generation parameters.
- Billing & Transaction Information: Subscription payments and extra credit top-up purchases are processed directly by our payment processor, Stripe. We receive transaction confirmation details, plan tier status, customer IDs, and credit balances necessary to manage your account. We do not receive, process, or store full credit or debit card numbers on our servers.
- Technical & Log Information: When you access the Service, our servers automatically record standard technical log data, such as your IP address, browser type, operating system, request timestamps, referring URLs, rate-limiting counters, and diagnostic error logs necessary for system security and operational reliability.
3. How We Collect Information
We collect personal information from the following categories of sources:
- Directly from you: Information you voluntarily provide when creating an account, setting up child profiles, typing generation prompts, uploading lesson materials, submitting feedback, or updating account settings.
- Automatically through your use of the Service: Technical logs, job queue processing events, and session activity generated as you navigate the website and use generation features.
- From service providers: Transaction and subscription lifecycle status provided by Stripe upon payment completion.
4. How We Use Information
We use collected information strictly for operational and educational purposes, including to:
- Create, authenticate, and manage your parent account and billing status.
- Generate requested homeschool learning materials, worksheets, stories, unit studies, and answer keys.
- Personalize learning content around parent-specified grade levels, themes, and learning preferences.
- Enable viewing, regeneration, and PDF download of your family's generated learning resources.
- Process subscription renewals, allocate monthly credit balances, and fulfill top-up purchases.
- Process parent feedback and adapt future generation parameters to better fit your child's needs.
- Detect, investigate, and prevent fraud, abuse, automated scraping, or security incidents.
- Diagnose technical issues, maintain server performance, and ensure platform reliability.
- Comply with applicable legal, accounting, and regulatory obligations.
5. AI and Content Processing
When you initiate a material generation request, your prompt instructions, grade context, selected learning preferences, and relevant source text excerpts are processed using third-party artificial intelligence model providers via API (such as OpenRouter and foundational language/image model providers).
We limit the information transmitted to model providers to what is reasonably necessary to construct the requested educational activity and answer key. Data sent through these generation APIs is transmitted solely to perform the requested content generation.
6. Service Providers & Third-Party Disclosures
We share personal information with third-party service providers only as necessary to provide, support, and secure the Service. These service providers include:
- Database, Authentication & Storage Providers: We use Supabase to host our database, manage user authentication, and provide private cloud storage for uploaded source materials and generated printable PDFs.
- Payment Processors: We use Stripe to handle credit card processing, recurring subscription billing, and customer portal management.
- AI Model Providers: We use model routing providers (such as OpenRouter) and underlying language/vision model providers to process generation prompts and return educational content.
- Hosting & Cloud Infrastructure: We use cloud hosting platforms (such as Render) and background job queue infrastructure (Redis/Valkey) to run our web servers and generation workers.
We may also disclose information in the following limited circumstances:
- Legal Requirements: If required to do so by law, subpoena, court order, or governmental authority, or where necessary to protect our legal rights, property, or safety.
- Business Transfers: In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
7. Advertising & Sale of Information
We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising, targeted advertising, or commercial marketing.
We do not use child-related profile details, prompt text, or generated homeschool materials for advertising purposes.
9. Do Not Track and Browser Signals
Some web browsers offer a “Do Not Track” (“DNT”) setting. Because there is currently no universal industry standard for interpreting or responding to DNT signals, our Service does not currently change its operational behavior in response to browser DNT signals.
We do not track users across third-party websites or services over time, nor do we permit third parties to conduct cross-site tracking of our users.
10. Data Retention & Minimization
We retain personal information for as long as your account remains active and as reasonably necessary to provide the Service, maintain required business and accounting records, protect against security incidents, resolve disputes, and comply with legal obligations.
Child-related information is maintained based on data minimization principles: we collect only high-level preferences and nicknames necessary to customize homeschool materials. Generated PDFs and uploaded source documents remain available in your private account workspace until you delete them or request account closure.
11. Deletion, Correction and Account Controls
Parents have active control over their family information directly within the application:
- Review & Edit Child Profiles: You can view, modify, or update child nicknames, grade levels, reading preferences, and interest tags anytime in your Account Settings → Child Settings.
- Delete Child Profiles: You can remove any saved child profile and its associated preference records directly from your account settings.
- Delete Creations: You can delete specific creations and generated learning materials from your dashboard workspace.
- Subscription Management: You can modify or cancel your active subscription at any time through the parent Billing & Credits portal.
- Account Closure & Permanent Deletion: You can permanently delete your account and all associated family data directly in your Account Settings → Danger Zone. Deletion cancels active subscriptions, removes child profiles and learning memory, and permanently clears your files and creations.
12. Security Safeguards
We implement administrative, technical, and organizational safeguards designed to protect your personal information against unauthorized access, loss, alteration, or misuse. These measures include:
- Database Row-Level Security (RLS) policies ensuring that users can only access their own family data and creations.
- Private, access-controlled cloud storage buckets for uploaded curriculum pages and generated PDF documents.
- Authenticated, short-lived signed URLs for downloading printable materials.
- Encrypted data transmission in transit using HTTPS/TLS.
- Role-restricted administrative access and rate-limiting safeguards to prevent unauthorized enumeration and automated abuse.
Please note that while we implement standard industry safeguards, no method of transmission over the internet or electronic storage is completely secure, and absolute security cannot be guaranteed.
13. Children's Privacy
Loom Bunny is designed for use by parents, guardians, and homeschool educators, not for independent use by children. Children do not register, create accounts, or directly access the Service.
Any child-related information provided on the platform is entered exclusively by the parent or guardian to customize printable homeschool activities. We practice child data minimization and do not ask for or collect child legal surnames, dates of birth, social security numbers, physical home addresses, biometric information, or school administrative identifiers.
If we discover that a child under 13 has submitted personal information directly to the Service without verified parental consent, we will promptly delete that information from our systems. Parents who believe their child has provided information directly may contact us to request immediate deletion.
14. U.S. State Privacy Rights
Depending on your state of residence and subject to applicable state privacy laws (such as consumer privacy statutes in California, Virginia, Colorado, Connecticut, Utah, and other applicable jurisdictions), you may have specific rights regarding your personal information, which may include:
- Right to Know / Access: The right to confirm whether we process your personal information and request details regarding the categories and specific pieces of information collected.
- Right to Correct: The right to request correction of inaccurate personal information.
- Right to Delete: The right to request deletion of personal information collected from you, subject to legal exceptions.
- Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.
California Disclosures (CalOPPA Notice)
Under the California Online Privacy Protection Act (CalOPPA):
- We disclose the categories of personal information collected in Section 2 of this policy.
- We describe the categories of third-party service providers with whom information is shared in Section 6.
- Users can review and change their personal information by visiting their account settings.
- Our Do Not Track policy is described in Section 9.
- We do not sell personal information or share personal information for cross-context behavioral advertising.
To exercise any applicable privacy rights, parents may use the in-app controls described in Section 11 or submit an inquiry through our authenticated support channels.
15. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect changes in our product features, operational practices, service providers, or legal requirements.
When we make updates, we will revise the “Last updated” date at the top of this policy. For material changes, we may also provide notice on our website or through an in-app dashboard notification. We encourage parents to review this policy periodically.
16. Contact & Inquiries
If you have questions, feedback, or privacy requests regarding this policy or your family's data, you can contact us through your authenticated parent dashboard settings or submit an inquiry via our official support channels.
You can review, update, or remove child profiles and learning preferences at any time directly in your account under Settings → Child Profile.