Privacy Policy

Version: 2026-11-03

Draft: pending review by a lawyer.

My Family School is run by [name to come] ("we" or "us"). This policy explains what we collect about you and your child, why, who helps us handle it, where it goes, how long we keep it, and what you can do about it. It's written for parents and legal guardians, because you create the account and make these choices for your child.

We follow British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). [name to come] is responsible for the personal information described here. For questions or requests, write to [email address to come].

The short version

• Only a parent or legal guardian who is an adult (the age of majority where you live) can create an account. Children never sign up.
• Your child's profile is a first name or nickname, a grade, the curriculum you choose, a favourite theme and the teacher you pick. No last name, birthday, photo or address.
• In class, your child talks with an AI teacher. Their voice goes live to LiveKit and to our voice provider: xAI, or Alibaba Cloud in Singapore, whichever runs the class. On classes run with Anthropic's Claude, xAI turns your child's speech into text and the teacher's answers into speech, and Claude reads the text and writes the answers. This can happen outside Canada, including in the United States and Singapore.
• We don't record the sound of classes or keep full transcripts. xAI, Alibaba Cloud and Anthropic, our AI providers, say they keep what they receive for up to 30 days.
• We keep your child's progress, answers and a few of their own words, for your reports.
• If your child says something that suggests they may be unsafe, we keep the words said around that moment so a person on our team can follow up.
• If you buy class hours, Stripe takes the payment. We never see your card number; we keep what you bought, what you paid, and the card's brand and last four digits. If you turn on automatic top-up, Stripe keeps your card for it, and we keep your settings and what you agreed to, and when.
• No ads. We don't sell or rent personal information, and we don't use it to train AI.
• Our database is in Canada. You can see, correct, copy and delete your family's information, with a few exceptions explained below.

What we collect

About you

• Your account: your email address and password, to sign you in.
• Your consent answers: what you agreed to or stopped (the terms, this policy, the parent or guardian declaration, and voice classes for each child), which version, and when.
• Account records: which invitation you joined with and, if we ever pause your family's classes, when, why and any note our staff add.
• Class time: if we count class time, what your family was given (class hours you bought, and time from our team) and what each class used. Families who joined before packs may also have had a free trial, a plan's months or extra time they bought; for those who had a free trial, we keep a scrambled (hashed) form of the email address, so that each address had one.
• Payments: if you buy class hours, your customer number at Stripe and, for each payment, what it bought, what you paid (with any tax) and when, the card's brand and last four digits, refunds and chargebacks, the class time it gave, and its receipt at Stripe. We also keep the card's fingerprint: a code Stripe makes from the card number, which can't be turned back into it, so we can recognise a card that was used before, for example in a chargeback. For families who joined before packs, we also keep each monthly plan and how it stands (active, ending, a payment that didn't go through, ended). Your card number, name and billing address stay with Stripe.
• Automatic top-up: if you turn it on, your settings (when to buy, which pack, and the monthly limit in US dollars); each time a parent turned it on, changed it or turned it off, who and when, with the words agreed to; and each automatic top-up: when, what it bought, and whether it was paid or why it failed (for example, a declined card). The card you save for it stays at Stripe: we keep only Stripe's reference to it, its brand and last four digits.
• Your language: the language you choose for your family pages, English or Simplified Chinese, so they show in it on every device you sign in on.
• Your time zone: the time zone your family's days follow (your browser's when you join, until you choose another), so that your children's class days, daily limits and weeks follow your clock.
• Your family's holidays: the days off you give all your children at once.
• Technical records: when you use the site, our hosting and sign-in providers record things like the time, the page asked for, your browser type and your IP address.

About your child

• Profile: the first name or nickname you enter, the grade, the curriculum you choose for them (the United States' Common Core and NGSS, Canada's British Columbia curriculum, or Cambridge International), a favourite theme and the AI teacher you choose, and where each subject starts (a grade and a unit), if you choose.
• Learning plan: what you choose for your child's weeks: how many days a week they aim to have class and on which days, their daily limit for class time, the subjects you want more or fewer lessons of, whether they pick their own lessons, which grades of each subject they can browse and any other curricula you open for them to browse, whether they take a lesson that also comes as a picture book from the book or on the board, their monthly limit of class hours if you set one, and the changes you make to a week, such as days off; the extra minutes you give them for a day, with when; and the units and lessons you mark as already known, with when.
• Their own choices: what you allow your child to change themselves (where each subject starts, their teacher, and picture book or board, their favourite theme and their name), and each change they make on their own page: what it was before and after, when, and whether you undid it. You see these on your family page.
• Progress: where they are in each lesson, their answers, the hints they needed and the time spent, so they can stop and continue another day (within 30 days, as "How long we keep it" explains).
• Their own words: some of what your child says is saved as the AI heard it: ideas they explained, short reasons, answers to open questions, their guess at the start of a lesson and a one-sentence summary at the end.
• Reports: after each lesson your child finishes, how they did against the lesson's goals, misunderstandings the teacher noticed, how long the class ran and how much each of them talked, hints used, how many times your child sounded discouraged, what to work on next, and the number of safety moments, if any.
• Class records: when each class started and ended, how long your child and the teacher talked, how the class ended, which lesson, teacher and software versions were used, and the face your child picks when asked how class was (happy, okay or tired), if they pick one. For each class we also keep how long the voice service and the classroom service ran, how much the voice service counted (numbers only, never words), what that cost us and, if your child walked away, how long they were gone before the class ended.
• Safety records: see "When a child may be unsafe" below.

What you send us

• Messages: what you write in our contact form: your email address, your name if you give it, the topic and the message, and your family account if you were signed in.
• Problems with a class: if you tell us about one from a class's report, the kind of problem and what you wrote, with your account's email, and which class and lesson it was about.
• The waitlist: if you join it, your email address, your child's grade, your province or territory (or, outside Canada, your country), the curriculum you'd like your child to follow, and when you agreed to be emailed and to which words.

What we don't collect

We don't record the sound of classes, turn on the camera, keep full transcripts, ask where you live, or use advertising or analytics tools. (If you buy class hours, Stripe's checkout asks for your billing address, which Stripe uses to work out any tax; we don't keep it.) The only cookies we set keep you signed in and remember, for up to a year, the language you chose for the site on that device.

How a voice class works

When your child starts a class, their browser joins a private online classroom run by LiveKit, and our AI teacher program joins it. Your child's voice travels, encrypted, from the microphone to LiveKit and on to a voice model, which listens, turns speech into text and answers in the teacher's voice. This happens live, as your child speaks. The voice model is xAI's Grok or Alibaba Cloud's Qwen, run in Singapore. Or a class runs in three parts: xAI's speech recognition turns your child's speech into text, Anthropic's Claude reads it and writes the teacher's answer, and xAI's voice speaks it. Claude gets your child's words as text, never their voice. We choose which way our classes run, and each class keeps the one it started with.

To teach, the AI teacher is given your child's first name or nickname, grade, favourite theme and chosen teacher, the lesson, and, when they continue a lesson, a short recap of where they left off, which can include a guess or an idea they said before.

The teacher is told never to ask for personal information such as an address, school, phone number or photos. Children sometimes share such things anyway, and whatever your child says in class reaches LiveKit and the class's AI providers.

When you play a teacher's voice sample while choosing a teacher, xAI makes it live. Your microphone isn't used.

Before a class, a short check runs in your child's browser: a bell checks the sound and, the first time on a device and about once a week after that, your child says hello to check the microphone. What the check hears isn't sent anywhere or kept. The browser keeps only when the microphone last passed the check, on that device, so it knows when to check again.

Why we use it

We use personal information only to:

1. run your family account, count its class time, write to you about it, and check that a parent has agreed to what classes need;
2. take payments for class hours, including automatic top-ups you turn on, give the class time they pay for, send receipts, and handle refunds and chargebacks;
3. teach classes, save progress and write your reports;
4. notice when a child may be unsafe, and respond;
5. answer your messages and, if you joined the waitlist, email you once when My Family School opens for your child's grade and where you live;
6. keep My Family School working and secure, for example by checking that the teacher arrived, how long classes ran and how much children got to talk;
7. meet our legal duties, such as keeping payment records for tax.

We don't show ads, sell or rent personal information, or use it to train AI models. If we want to use it for a new purpose, we'll ask you first.

Who helps us

These service providers handle information for us:

We also share information when the law requires it or a child's safety calls for it: for example, a report to child protection services, a call to 911 when a child may be in danger right now, or an answer to a court order.

If My Family School ever moves to another organization, your family's information would go with it only to keep running My Family School under this policy, and we'd tell you first.

What providers keep

We use these providers on their standard terms. We haven't made special arrangements with any of them, such as asking xAI, Alibaba Cloud or Anthropic to keep nothing ("zero data retention"). Their published policies say:

• xAI, the maker of the Grok voice model (its policies call the company SpaceXSI), stores the requests and responses our teacher program exchanges with it, encrypted, for 30 days to audit for abuse or misuse, then deletes them, unless it must keep them longer by law or to investigate misuse or safety concerns. For a voice class, these can include your child's voice and words. xAI says it doesn't train on this data without the customer's explicit permission. (xAI security FAQ)
• Alibaba Cloud (Model Studio, which runs the Qwen voice model) keeps the requests and responses of our teacher program, which for a voice class can include your child's voice and words, for no longer than 30 days, unless the law requires longer or it's needed for security. It says it doesn't use them to train or improve its models without the customer's separate consent. We use its international service in Singapore. (Alibaba Cloud Model Studio data retention)
• Anthropic, the maker of Claude, deletes the requests and responses our teacher program exchanges with it, which for a class run on Claude can include your child's words as text, within 30 days, unless it must keep them longer to enforce its usage policy (up to 2 years for content flagged as breaking it) or by law. Its commercial terms say it may not train models on our content. (Anthropic data retention, Anthropic commercial terms)
• LiveKit routes live audio over the shortest path and doesn't keep it. It keeps session analytics in the project's data region, which is the United States or the European Union. (LiveKit data residency)
• Supabase keeps our database, sign-in data and backups in its Canada (Central) region. It processes technical logs and service data outside that region, stores logs in the European Union, and has support staff around the world. (Supabase data residency FAQ)
• Vercel keeps request logs, such as the page, browser type and IP address, for between an hour and 30 days, depending on the plan. (Vercel runtime logs)
• Resend stores data in the United States and keeps email and log data for 30 days. (Resend GDPR)
• Stripe handles payment details for us as our agreement with it says, and also uses them for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy. It keeps personal information for as long as it provides its services and as the law requires records to be kept, and it may transfer it to other countries, including the United States and India. (Stripe privacy policy)

Outside Canada

Our database is in Canada. Parts of every class, some of the website's work, and payments are handled outside Canada by the providers above, which can include the United States and, for classes on Qwen, Singapore, and some technical logs are kept in the European Union. While information is in another country, that country's laws apply to it, and its courts, law enforcement and national security authorities may be able to obtain it.

When a child may be unsafe

If your child says something that suggests they may be hurt, in danger or bullied, the teacher answers with set, kind words: it thanks them, asks them to tell a grown-up they trust who's near them, and to call 911 if they're in danger right now. The screen then shows how to reach Kids Help Phone. The teacher is told not to mention that anything was flagged.

We then keep a safety record: when it happened, in which lesson, how urgent it seems, and what was said just before and after, up to 20 lines from your child and the teacher. We may also send our team an alert email through Resend, with your account email but without your child's name or words. Only our staff can open safety records on our staff pages, after a second sign-in step with an authenticator app, and each time they do, it's logged.

A person on our team reads the record and decides what to do. We may contact you. If we believe a child may need protection, BC law requires us to report it to child protection services, and we will. If contacting you first could put your child at risk, we may report without telling you. My Family School is not an emergency service: if a child is in danger, call 911.

How we protect it

• Our site uses HTTPS, and class audio is encrypted on its way between devices and providers.
• Our database provider encrypts stored data, and the database makes sure each family can reach only its own records.
• The grown-up pages (reports, settings, privacy choices and the account) need a 4-digit parent PIN on each device, so children using your account can't open them. We store the PIN only in a scrambled (hashed) form, and five wrong tries lock it for 15 minutes.
• Staff pages need a second sign-in step. Every change staff make there, and every time they open a safety record or a family's page, goes into a log that can't be changed. Changes you make to your children and your account (such as adding or removing a child, changing their settings, giving them more class time for a day, or deleting the account) go into the same log, without your children's names.
• Our own code keeps children's names and words out of its logs, and payment details too.
• You type your card number on Stripe's pages, never ours, so we never see or keep it. Buying class hours, saving a card and turning on or changing automatic top-up need the parent PIN.
• Each class gets its own key for saving progress, which stops working after a few hours.

No system is perfect. If a breach creates a real risk of significant harm to you or your child, we'll tell you as soon as we can and report it as the law requires.

How long we keep it

Consent answers, class records, class time records, payment records, the scrambled addresses, safety records, messages and waitlist entries don't have an automatic end date yet. When we set one, we'll add it here. If we use information to make a decision about your child, such as a report to child protection services, the law requires us to keep it for at least a year.

Your choices

• See it. Your child's progress and reports are on your family pages, your family's class time, purchases, automatic top-up and each class's use (with a statement for each month) are on the class time pages, and your consent answers are on the Privacy and consents page.
• Correct it. In your child's settings you can change their name or nickname, grade, curriculum, favourite theme and teacher, and their learning plan: where each subject starts, what they already know, their days, daily limit and monthly limit, each subject's pace, whether they pick their own lessons and what they can browse, how they take a lesson that also comes as a picture book, the changes to their weeks, and what they may change themselves; and you can undo a change your child made, from your family page. Your family's time zone and holidays are on your account page. To correct anything else, email us.
• Stop voice classes. On the Privacy and consents page, for each child, at any time. It applies from the next class. What's already saved stays until you remove your child.
• Remove a child. In your child's settings. Their profile, progress and reports are deleted at once, apart from the backups and records described above.
• Get a copy. Download it at any time from your account page, as a file (JSON) with your account, your children (with their curriculum and any others you opened for them, their learning plans with the extra minutes you gave them and the changes you made to their weeks, and what you marked as already known), their lessons and reports, each class, your consent answers, any pause of your family's classes, your family's class time, your payments (and any monthly plans from before packs), your automatic top-up settings with what you agreed to and each top-up, what each child may change themselves and the changes they made, the language and time zone of your family pages, and your family's holidays. Each payment's receipt is linked from the class time page. Or ask us and we'll send it within 30 days.
• Delete your account. From your account page. Classes stop at once, and 7 days later we delete your account and your children's profiles, progress and reports, and your customer record at Stripe, with any card saved there for automatic top-up; until then you can change your mind. Automatic top-up stops at once, and a monthly plan from before packs stops renewing when you ask. Or ask us and we'll delete it within 30 days. A few records stay, as the table above explains.
• Leave the waitlist. Write to us at any time, and we'll take you off it and won't email you.
• Withdraw your agreement. You can withdraw your agreement to the terms or this policy at any time by emailing us. We'll stop classes, and delete your account if you ask.
• Ask or complain. Write to [email address to come] first. You can also contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

To protect your family, we may check that a request comes from the account holder, for example by replying to the account's email address.

Children

My Family School is made for children, and a parent or legal guardian makes every choice for them: creating the account, agreeing to the terms and this policy, and allowing voice classes. Children use My Family School while signed in on their parent's account. A parent PIN keeps them out of the grown-up pages; on shared devices, please also sign out.

Changes

If we change this policy in a way that matters, we'll give it a new version date, tell you what changed, and ask you to agree again before your children's next class. Fixing a typo doesn't change the date.

Contact

Write to [name to come] at [email address to come] or through our contact form, or by mail at [mailing address to come].