Privacy Policy

Last updated: 2026-07-31.

1. What we collect

Account holders (parents, 13+ students, teachers): email address, optional display name, hashed password, OAuth provider IDs if used, billing identifiers managed by Stripe and RevenueCat (we do not store card numbers).

Student profiles (under 13): display name, grade level, and an avatar/mascot selection from our built-in set. No email, no last name, no contact info, no demographics, no photos.

Usage data: which questions were attempted, which answers selected, mastery levels, streak data, sticker and badge unlocks, last study date.

Push notifications (optional): if you enable notifications in the mobile app, we store a device push token issued through Expo’s push service and your notification preference. The token is tied to the parent account, not to any student profile. Turning notifications off deactivates the token immediately and stops all sends; token records are deleted when your account is deleted.

Automatic data: like most online services, our infrastructure automatically records certain technical information when the service is used, including IP address, device type, operating system and browser version, and timestamped request logs. Crash reports include similar device details. We use this information only for security, debugging, and keeping the service running. It is never used to build profiles of students or for advertising.

2. How we use it

To operate the study experience (serve questions, track progress, award stickers and badges), to process payments via Stripe and RevenueCat, to send transactional email via Resend (signup confirmation, password reset, magic link), to send optional push notifications you can turn off at any time, and to improve the service in aggregate. We do not sell or rent personal information.

3. Children’s privacy

BookBright is COPPA compliant. We never collect personal information directly from children under 13. Student profiles under 13 store only a display name, grade level, and avatar selection. See our COPPA notice for full details, including parental rights to review, delete, or refuse continued collection.

4. Sharing

We share data only with service providers required to run the service: Supabase (database and authentication), Stripe and RevenueCat (payments and entitlements), Apple and Google (in-app purchases made through the App Store or Google Play, under their own terms), Resend (transactional email), Expo (push notification delivery), Vercel (hosting), Sentry (crash and error reporting, so we can find and fix bugs), and PostHog (product analytics for our website). Each operates under their own privacy commitments and processes data only on our behalf.

Crash reports and analytics events are configured to exclude student names, email addresses, and study content. We do not permit any provider to use this data for advertising or to track our users across other apps or websites.

5. Storage and retention

Data is stored on Supabase infrastructure (US region). Account data is retained while the account is active and deleted within 30 days of account deletion. Anonymized aggregate data may be retained for product improvement.

6. Security

Passwords are hashed. Data in transit is encrypted via TLS. Database access is gated by row-level security policies that prevent users from seeing other accounts’ data. No system is perfectly secure; we will notify affected users promptly if a breach affects their data.

7. Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing contact@bookbright.app. Step-by-step deletion instructions (single student profile or whole account, in-app or by email) are on our Data Deletion page. California, Colorado, Connecticut, Virginia, and EU residents have additional rights under their respective privacy laws; we honor those rights regardless of jurisdiction.

8. Cookies and similar technologies

We use cookies for authentication (HTTP-only, SameSite=Lax, Secure in production) and to remember the selected student profile. Our analytics provider (PostHog) stores a randomly generated identifier in your browser so we can count visits and understand which features are used. That identifier is not used for advertising, does not follow you across other websites, and is not linked to a student’s identity. We do not use third-party advertising cookies.

9. Changes

Material changes to this policy will be communicated by email at least 30 days before they take effect. If a change materially affects how we handle children’s personal information, we will also obtain new parental consent as required by COPPA before the change applies to existing student profiles.

10. Contact

BookBright is operated by Next Chapter Education LLC. Privacy questions or requests: contact@bookbright.app, or write to Next Chapter Education LLC, 5456 Cattle Dr., Missoula, MT 59808. Phone: (502) 264-9015.