Privacy Policy

1. Controller

The service and the data described here are controlled by:

2. What we collect and why

We do not run advertising, we do not build advertising profiles, and we do not sell personal information or share it for cross-context behavioral advertising.

3. Children’s data and parent control

Children do not have accounts and cannot sign in. Every learner record belongs to an adult account holder who created it, and only that account holder (plus, where necessary, an audited administrator support session) can see it.

We ask you to keep learner information minimal: a first name or nickname is enough, and you never need to provide a full legal name, address, school identifier or date of birth. As the parent or guardian you can view, correct, export or delete any learner record at any time from within the app, and deleting your account deletes all learner records and uploads with it. These controls are designed with COPPA’s parent-control principles in mind; we make no claim of certification or regulatory approval.

4. AI processing and web research

To produce plans, HomeArc sends the relevant parts of your project — learner level, subjects, goals, calendar settings, your notes, and text extracted from your uploads — to OpenAI directly from our servers, using our own OpenAI API key, and performs web research through OpenAI’s web-search tool against publicly published grade-level expectations. Content taken from your uploads is treated strictly as evidence: instructions embedded in an uploaded file are never followed.

Because a full plan takes hours to build, those requests run as background jobs at OpenAI. That means the request we send and the response it produces are stored on OpenAI’s systems under our account until their retention period expires, so that our servers can collect the result later — they are not held only for the moment of the call. Shorter, interactive requests are sent with storage switched off. We keep our own copy of the finished lesson content in your project either way.

HomeArc pays for and controls the single OpenAI account used for every family; you never supply, choose or get billed for a model provider key, and your content is never sent under another family’s credentials.

We do not use your content to train our own models, and our account is configured so that OpenAI does not use it to train theirs. Model providers process it to return a response under their agreements with us. Details of that configuration are published in our data-processing notes.

5. Vendors we rely on

We use a small number of categories of processor:

• Application hosting and content delivery.
• Managed database, authentication and private file storage.
• OpenAI, L.L.C. — text generation, web-search grounded research and image generation, called directly from our servers.
• Transactional email delivery for sign-in and account emails.

These vendors act on our instructions and may process data in the United States and other countries.

6. How long we keep things

• Account, learner and project data: until you delete it or delete your account. A deleted plan moves to the trash and can be restored for 30 days; after that the plan, its learner records and its uploaded files are permanently deleted.
• Uploads and generated artifacts: until you remove them, or until the account is deleted.
• Security and rate-limit records: kept only as long as needed to enforce the limits and investigate abuse, and then purged. They contain hashes, not raw addresses.
• Support session audit records: retained for accountability.

7. Security

Data is stored in a managed database with row-level access rules so an account can only reach its own rows. Uploads and generated files are stored in private buckets and are served only through authenticated, short-lived download links. Administrator access to an account requires a time-boxed support session that is recorded, and is read-only by default. No system is perfectly secure, and we do not claim any certification.

8. Your choices and rights

You can export everything your account holds as a machine-readable file, and you can delete your account, from the Account page. You may also contact us to ask for access, correction, deletion, or a copy of your data.

Depending on where you live — for example California, Colorado, Connecticut, Virginia, Utah and other US states with comprehensive privacy laws — you may have specific rights to know, delete, correct and obtain a portable copy of your personal information, and to be free from discrimination for exercising them. We honor these requests regardless of where you live.

9. International users

HomeArc is operated from the United States and data is processed there and in other countries where our vendors operate. If you use the service from outside the United States, you understand that your information will be transferred to and processed in the United States.

10. Changes and contact

When this policy changes materially, the version label changes and you will be asked to review and accept the new version before you continue using the service. Questions or requests: michael.fink@ever-growing.de.