← Back

Privacy Policy

SkillLoop is built for teenagers, so we treat privacy as a core product requirement, not fine print. This policy explains what we collect, why, and the choices families have.

1. What we collect

• Account information: name, email, and password (passwords are stored securely hashed — we cannot see them).
• Onboarding responses: answers to the intake questionnaire, including age range, skill self-assessments, and optional information about school supports (IEP/504) and current services. "Prefer not to say" is always an option for sensitive questions.
• Learning activity: which lessons and assignments are completed, quiz results, written reflections, stars earned, and the calendar days the platform was used.
• Payment status: subscription plan and status from our payment processor. We never receive or store full card numbers.

2. How we use it

• To run the platform: save progress, award stars, and personalize starting difficulty.
• To support care coordination: where a family participates through a care team, activity records (such as days of engagement and completed assignments) may be shared with that family's authorized clinical team, including for insurance documentation the family has consented to.
• To improve lessons and fix problems.

We do not sell personal information. We do not show third-party advertising.

3. Children's privacy (COPPA)

SkillLoop serves teens, including users under 13 in some school or clinic settings. Where required, we obtain verifiable parental consent before collecting personal information from children, collect only what is needed to run the service, and give parents the right to review and request deletion of their child's information.

4. Student records (FERPA)

When SkillLoop is used through a school under an institutional agreement, student data is handled as directed by the school consistent with FERPA, and used only for the educational purposes in that agreement.

5. Health-related information

Some information families choose to share (for example, existing services or supports) may be health-related. Where SkillLoop activity is used by an authorized clinical team for care or insurance purposes, that data is handled under the safeguards required for protected health information, is encrypted in transit and at rest, and access is limited to the family's own care team.

6. Where data lives and who processes it

• Database and authentication: Supabase (data encrypted in transit and at rest, access controlled per-user).
• Payments: Stripe.
• Hosting: Netlify.

7. Retention and deletion

We keep account data while the account is active. Families can request a copy of their data or full deletion at any time by contacting us; deletion removes the account, progress, reflections, and onboarding responses, subject to any records we are legally required to retain.

8. Your choices

• Skip any sensitive onboarding question using "prefer not to say."
• Request access, correction, or deletion of your data.
• Cancel a subscription at any time.

9. Contact

Privacy questions or requests: help@skillloop.org