Privacy Policy

1. Who we are and what this covers

Homebook, LLC is an Arkansas company that makes school records software for microschools and private schools, at gethomebook.com and app.gethomebook.com, and in the Homebook School phone app.

Contact: Homebook, LLC, 95 Paiger Ln, Greenbrier, AR 72058, (501) 514-5811, privacy@gethomebook.com. Sam Bartolotta answers all privacy questions and requests from parents, students and schools.

This policy covers the Homebook app and the records schools keep in it (sections 1 to 12) and our public website (section 13). Because Homebook is used by schools, almost everything in it is about a child, so this whole policy is written with children in mind.

2. What we collect

2.1 From adults who use Homebook. School staff and parents: name, email address, password (stored only as a secure hash, so nobody can read it), role at the school, and messages you send in Homebook. Parents who ask to connect to a child also give their relationship to the child and, if they choose, a phone number.

2.2 School records your school enters. Student names, grade levels, dates of birth, student numbers, home address, attendance and check-in and check-out times (including who picked a child up), grades, assignments and assessments, report cards and transcripts, discipline and incident notes, support plans, goals and services, health, allergy, medication and emergency details, office (nurse) visits, who may pick a child up, documents the school uploads, tuition and lunch records, messages between the school and families, and family contact information. Parents can also send the school updates or pickup requests, which the school reviews.

2.3 From students who have a login. A school may give a student a login so the student can see their own work. For that login we collect: the school-issued email address (entered by the school), the student’s name and a password the student types when setting up the login (the password is stored only as a secure hash), sign-in times, the student’s choice on the privacy notice (section 4.5), and any note the student chooses to send to the school office (“Tell the office”). These are the only fields a student account asks for. We also collect the technical information in section 2.7 and, where the school has turned it on and the student or parent has agreed, the College & Career information in section 11. Student accounts cannot make anything public: notes go only to the school office, and nothing a student enters is shown to other students or on the internet. Student logins work in a web browser only, not in the phone app.

2.4 College & Career. If the school turns it on (the school buys seats, or lets families buy it): quiz answers, results and saved scholarships. See section 11.

2.5 Student photographs. Only if the school adds one. See section 12.

2.6 Payments. If your school turns on online payments (tuition, lunch and fees), we record the amount, date and status of each payment for the school’s ledger. Card numbers and bank details go only to Stripe and never touch our servers. Stripe receives the student’s name on the payment line (for example “Tuition - [student name]” or “Lunch account - [student name]”) so the family and the school can recognize the charge.

2.7 Technical information. To keep Homebook secure and working, our hosting providers keep standard logs (IP address, browser type, time of each request) and our error monitor receives technical details when something breaks (section 6). Your sign-in keeps a session token on your device so you stay signed in. We use these only to run, secure and fix Homebook, never to follow anyone across other websites, build profiles or show ads. The Homebook app has no advertising or analytics trackers, our providers may use this information only to provide their service to us, and our error monitor is set not to store IP addresses. We do not rely on COPPA’s separate exception for persistent identifiers: everything we collect from students is collected under the school’s authorization or the consent described in section 4.

What we never ask for: Social Security numbers, bank account or card numbers, precise location, fingerprints, face scans, voice prints or any other biometric information. Homebook has no place for them. Please do not put them in uploaded documents or messages; if we find them, we tell the school so it can remove them.

3. How we use it

Only to provide Homebook to your school: showing records to the people your school allows, producing the reports, report cards and transcripts your school asks for, sending service emails and notifications (like message alerts, tuition reminders and password resets), keeping Homebook secure, and fixing problems.

We do not sell or rent personal information. We do not use student information for advertising of any kind, including targeted advertising. We do not build profiles of students for any purpose other than the school’s own use. We do not use student information or photos to train artificial intelligence. Where a state student online privacy law applies to your school or to us, we follow it.

Every school gets the federal student-records (FERPA) protections in our School Data Agreement (section 2.3), whether or not the law requires them for that school. Schools in Alabama also get the agreement’s Alabama add-on (Schedule 3), and their director accepts the agreement in Homebook before adding students or families.

4. Children and teens

4.1 Records about a child, and accounts used by a child. These are different, and we treat them differently. Student records are entered and controlled by the school (or the parent, for a homeschool). Families see them only after the school approves their family account for their child. Separately, a school may give a student their own login (section 2.3). The school creates it; there is no public sign-up for students. A student can see only their own record, grades, schoolwork and attendance, and can send a note to their own school’s office, which the school can switch off. A student cannot see another child or change anything.

4.2 Children under 13. When a school gives a login to a student under 13, the school authorizes that login on behalf of the child’s parent, for the school’s own educational use and benefit, as the federal Children’s Online Privacy Protection Act (COPPA) allows. So we use a child’s information only to run that school’s records, and for nothing else. Before a school’s student logins work, we check that it is a real school and that the person authorizing can act for it, we give the school a full description of what we collect from students and how we use it, and the school confirms its authorization in Homebook. We ask a child for nothing beyond what section 2.3 lists. A parent of a child under 13 can review the information we have collected from their child, have it deleted, and refuse further collection, and can ask the school to remove the child’s login at any time. See section 9.

4.3 Teens (13 to 16). Arkansas law (the Arkansas Children and Teens’ Online Privacy Protection Act) protects teens aged 13 to 16 in Arkansas. We give the same protection to every student that age, in every state. Where the law of a student’s own state gives more (for example, protection that reaches older ages), we follow that too. The first time a student aged 13 to 16 signs in, and whenever this policy changes in a way that matters, they see a short notice and tick “I agree” before using their login. The account setup screen also asks everyone to tick that they agree to this policy before the account is created. A teen who does not agree is signed out and we stop anything that needs their agreement. We keep only the small record needed to remember their choice and keep Homebook secure. The school’s own records continue. A teen, or the teen’s parent, can see, correct or delete what we collected from the teen. See section 9.

4.4 No targeted ads, no sale, no profiles. We never use anyone’s information for advertising, never show targeted advertising, never show ads from ad networks or advertisers (the one exception is the card described next), never let anyone else use students’ information for advertising, and never sell or rent children’s or teens’ information. The one promotion in Homebook is the optional Bright Pathway program card inside College & Career (section 11): it uses no student information, the school can turn it off, and it is never shown to students under 13. Outside your school, children’s and teens’ information goes only to the service providers in section 6 so they can run Homebook for us, and to others only when the law requires it (section 5).

4.5 Notices in the app. Parents see a short version of this policy the first time they sign in, and again when it changes in a way that matters, and tick that they have read it. Families who never sign in get the same notice by email from their school. Students with logins see a version written for their age.

5. Who can see your information

• Other schools: never. Every school’s records are separated at the database level. No other school on Homebook can see them.
• Your school’s staff, according to the roles your school’s leaders assign. For example, teachers see their own students, and office staff see what the office needs.
• Families, only for the children the school has approved their account for, and only after approval.
• Students with logins, only their own grades, schoolwork, attendance and notes.
• Homebook. Sam Bartolotta, and the tools Homebook uses to build and fix the service (including the AI assistant listed in section 6), access school records only to support your school, keep Homebook running, or fix a problem, and for no other purpose.
• Others, only if the law requires it, for example a valid court order. We would tell the school unless the law forbids it.

6. Companies that help us run Homebook

These companies work for us. They receive information only as needed to provide their service, and we require them to protect it.

In categories: we share school records with hosting, database and engineering providers; names, contact details and message previews with email and notification providers; and billing and tuition, lunch and fee payment details with Stripe. When a parent or school buys College & Career, the payer’s billing details go to Bright Pathway through its Stripe account, because Bright Pathway is the seller. We do not share children’s or teens’ information with advertisers, data brokers, Bright Pathway, colleges or anyone else, except when the law requires it (section 5).

7. Security

Information is encrypted in transit (TLS) and at rest (AES-256). Passwords are stored only as secure hashes. Documents and photos sit in private storage and are shown only through short-lived links. Each school’s records are kept apart by database rules, and we test those rules before every release and check them automatically every day. We keep a written information security program for children’s information, with a named person responsible (Sam Bartolotta), a yearly risk review, regular testing and monitoring, and checks on the companies we use. No system is perfectly secure, but our first defense is simple: we hold as little sensitive information as we can.

We keep encrypted backup copies of our data with Google Workspace so that we can recover from equipment failure. These copies are encrypted before they leave our systems. Google cannot read them, and backup copies are deleted within 30 days.

8. How long we keep information (our retention policy)

We keep student information only to run your school’s Homebook, and only as long as your school needs it for that. Then we delete it. This is our written retention policy for children’s information.

An unpaid balance holds back only the billing record. While a family still owes the school money, we keep the tuition, lunch and fee records and these parent or guardian details: contact details, home address, staff-family discount setting, family login, link to the student and their record of reading our notice, so the school can finish billing. A balance never keeps the child’s own information longer: the student login, health and safety details, photo, pickup list, messages, notes, College & Career entries and discipline records are deleted on the dates above whether or not anything is owed. Once the balance is paid, those parent or guardian details are deleted on the normal 1-year date, or within a few days if that date has already passed. A family login stays only if it is still linked to another child or is also a staff account. A school may also ask in writing to keep a record longer for a stated educational or legal reason, with a fixed end date; that never overrides the rights in section 9.

A school can download everything at any time (one full export file plus CSV tables) and can delete records sooner. When a school deletes a student, the record is fully erased from Homebook within 30 days.

9. Your rights and how to ask

What you can ask for.

• A copy. A parent can get a copy of the information we collected from their child, and a student can get a copy of what we collected from them (their login details, notes and College & Career entries). We send it without waiting for anyone’s approval. Copies of school records go through the school, which helps prepare them so other children’s information is protected. If the school has not answered within 21 days, we prepare the copy the law requires ourselves, with other students’ information removed.
• A correction. If something is wrong, tell us. School records are checked and corrected by the school. If you show us that information is wrong and it is not corrected, we make sure it is.
• Deletion of what you or your child entered. A parent or student can delete what they entered for optional features (College & Career) themselves in Settings. A parent or the student (at any age) can ask us to delete the student’s login account, sign-in records and the notes the student sent to the office. The login is switched off right away. We tell the school, then delete them within 30 days, unless a law requires a note to be kept.
• Stop collection. A parent can refuse further collection from their child. As soon as we confirm who is asking, we switch off the child’s login and stop using what we collected from the child for anything except completing the request, without waiting for the school, and we tell the school. Anyone can turn off College & Career for themselves or their child at any time.
• Student photos. A family or the school can ask for a student’s photo to be removed at any time. We tell the school and delete it.
• Records school staff entered. Attendance, grades, schoolwork, discipline and support notes, health details, the pickup list, tuition, transcripts and messages with the school are records the school’s staff created, which the school relies on to keep children safe and to meet its own obligations. Requests to change or delete them go to the school, which decides. Homebook does not delete them except on the school’s instruction or where the law requires it. Rights the law gives parents and students directly, for the information collected from the student, are not limited by this.

How to ask. In the app: open Settings at the top of your family or student page, then Privacy & choices, and use the privacy request box just below it; by email to privacy@gethomebook.com; or through your school office. Each way is explained at gethomebook.com/privacy/requests. Tell us the student’s name and school. You do not need to give a reason, and we will never ask for your password.

What happens. We confirm right away that we received it, confirm who you are within 2 business days (if you asked from your own Homebook login, that is already done; otherwise we check with the school, so a stranger cannot see or delete a child’s information), and finish within 30 days. The school sees every request about its students. Asking to delete something will not shut off your access if Homebook can still work without it. We keep a short record of each request for 3 years, without the child’s records in it. Full steps: gethomebook.com/privacy/requests.

10. If something goes wrong

If we discover a security breach affecting your school’s information, we tell your school immediately, with the facts we have, and keep updating it as we learn more about what happened, what information was involved and what we are doing about it. We help the school notify families as Arkansas law and any other applicable law requires, and if the school asks us in writing, we send those notices for it. Where more than one state’s breach-notice law applies, we follow the strictest deadline that applies.

11. College & Career, by Bright Pathway (optional add-on)

Some schools buy College & Career for students in grades 9 to 12. It gives a student a career quiz, a list of scholarships they can save and track, and college and financial-aid deadlines. It is part of Homebook and runs inside Homebook. The quiz questions and the scholarship and deadline lists come from Bright Pathway Future Ready Academy, an Arkansas company that Homebook partners with. Bright Pathway does not receive any student information from Homebook. Homebook does not report anything about students to Bright Pathway; Bright Pathway sees only the purchases made through its own Stripe account (described below).

How it is paid for. The school decides. Either the school buys seats for its students, or the school turns on “families pay” and a parent with an approved link to an eligible student can buy that one student’s year in the family portal. Students never see a buy button and are never charged. The money goes to Bright Pathway, which sells College & Career, through Stripe, Bright Pathway’s payment processor; Homebook does not collect or hold it. The person paying enters their payment and billing details (such as name, email address and card) on Stripe’s checkout page, and Bright Pathway receives those billing details from Stripe as the seller. Neither Homebook nor Bright Pathway sees or stores card numbers. To set up the checkout, Homebook sends Stripe only what was bought and how many, the payer’s email address, and a random reference number, never a student’s name or any other student information. Homebook keeps a record of each purchase (who paid, for which student, the amount and date, and any refund or dispute) so it can turn the student’s access on and off.

Who can use it. Only students at a school that turned it on (by buying seats or letting families buy it), in a grade the school turned on, with a date of birth on their school record, who are 13 or older. A student under 13 can use it only if the school first gives Homebook a written authorization for that student, for the school’s educational use only.

Agreeing to it. College & Career is optional. Before anything is saved:

• a student aged 13 or older reads a short notice and ticks “I agree” before starting; and
• a parent or guardian can say yes or no for their child aged 13 to 16 in Homebook, and can change that choice at any time in Settings.

If a parent says no, College & Career stays off for that child. If we change the notice in a way that matters, we ask again.

What we collect.

• The student’s quiz answers and the results worked out from them (career paths, career interest types, fields of study).
• The scholarships the student saves and the status they choose (for example “Working on it” or “Submitted”).
• A record of who entered each answer or change (the student, or a parent in Family mode), when, and which version of the notice and quiz they saw.

We do not ask about family income, citizenship, disability, health or religion, and there are no free-text boxes. We never copy the student’s date of birth into College & Career; we only check it.

Family mode. If a school does not give students their own login, an approved parent or guardian can take the quiz with their child and save scholarships, from the parent’s own Homebook login. Before anything is saved, the parent confirms they are the child’s parent or guardian and agrees for the child’s school. Those entries are marked “entered by a parent.”

Who sees it.

• The student sees everything they entered.
• The school’s director and counselor see the student’s results, saved scholarships and answers.
• Other school leaders and the student’s own teachers see a short summary (whether the quiz is done, the top career path and fields, and saved scholarships with deadlines), not the individual answers.
• An approved parent or guardian sees the results and saved scholarships. For students aged 13 to 16, parents see the individual answers only if the school turns that on. For students 17 and older, parents can see the answers.
• Outside the school, only Homebook and the service providers that help run and fix the service (section 6) can access it, and others only where the law requires (section 5).

What we never do. We never sell College & Career information, never use it for advertising or to build marketing profiles, and never send it to Bright Pathway, scholarship sponsors or colleges. Scholarship links only open the sponsor’s own website; anything a student types there is between the student and that website. College & Career may show a card about Bright Pathway’s full program with a school discount code. It is a plain link to Bright Pathway’s website: Homebook sends no information about the student, the school can switch the card off, and it is never shown to students under 13.

How long we keep it. While the student is enrolled and the school keeps College & Career. It is deleted 30 days after the student is withdrawn, or 30 days after the school stops College & Career, whichever comes first, so the school has time to ask for a copy. If a student or parent deletes it, it is deleted at once. If the school deletes the student, it goes with the rest of the student’s record: hidden at once, kept 30 days in the school’s “Recently deleted” list in case of a mistake, then erased (section 8).

Your rights. A student, or a student’s parent, can see their College & Career information, delete it, or turn College & Career off at any time in Settings, or ask the school office, or email privacy@gethomebook.com with the student’s name and school. Because this is information the student or parent entered, the student or parent decides; the school sees that it was deleted. We finish emailed requests within 30 days. Arkansas students aged 13 to 16 and their parents have these rights under the Arkansas Children and Teens’ Online Privacy Protection Act; we offer them to every student, in every state, and follow any state law that gives a student more.

12. Student photographs

A school may add a photo to a student’s profile so teachers and substitutes can match a name to a face and make sure they release a child to the right adult. A photo of a child is one of the most sensitive things we hold, so it follows stricter rules:

• Optional, always. No photo is ever required. A school or family can ask for one to be removed at any time, and it is deleted, not hidden.
• Never public. Photos are stored privately, never published on a website, never shown on a shared front-desk or kiosk screen, and never given a public link. Each view uses a short-lived link that expires.
• Only the people who already know the child: that school’s office staff, the teachers assigned to that student, and that student’s own approved family. No other family and no other school can see it.
• Uploaded by school staff, not by families, so the school controls what is on a student’s record.
• Never used to train anything, never sold, never used for advertising, and never used for facial recognition or any other biometric identification.
• Printed materials are the school’s responsibility. Homebook can print student cards with a photo and the emergency and health details staff need. Once printed, they are a paper record in the school’s hands, to be stored or destroyed as confidential student records.

Schools should follow their own photo consent practice and any law that applies to them before adding photos.

13. This website (gethomebook.com)

Everything above is about the Homebook app and school records. Our public website collects much less, and it is meant for adults. We do not knowingly collect information from children through it.

• No cookies, no ad trackers. gethomebook.com sets no cookies and uses no advertising or marketing trackers, so there is nothing to consent to. We count visits with Cloudflare Web Analytics, which does not use cookies, does not collect personal information or build a profile of you, and does not follow you to other sites. It applies to the public website only, never the Homebook app.
• The founding-school form. If you send it, we receive the school name, email address and (optional) phone number you type, plus your browser type. We save it in our database and email it to Sam through Resend so he can reply. It is used only to answer you about Homebook. It is never sold, never shared for marketing and never added to a marketing list; our database, hosting and email providers handle it only so we can receive and answer it. We delete it 2 years after our last contact, or sooner if you ask.
• The College & Career question form. On gethomebook.com/college-career a school can ask us about College & Career. We receive the school name, email address and (optional) phone number you type, plus your browser type. We save it in our database and email it to Sam through Resend so he can reply. It is used only to answer you, never sold, never shared for marketing and never added to a marketing list. We delete it 2 years after our last contact, or sooner if you ask.
• The “Request your state” form. On gethomebook.com/funding you can ask us to add your state. We receive the state you pick, the boxes you check and your browser type, plus anything optional you add: school name, role and email. Leave the email blank and we cannot reply, but your state is still counted. It is used only to decide which states to add next and, if you gave an email, to reply. Never sold, never shared for marketing and never added to a marketing list. Ask us and we will delete it.
• The School Finder. gethomebook.com/schools (Arkansas) and gethomebook.com/schools/alabama list schools, microschools, homeschool groups and church schools by town and county only, never a street address, personal phone number or personal email. If you use its “Add, fix or remove your school” form, we receive what you type (school name, town, type, grades, website, your role and your email) plus your browser type. We save it in our database and email it to Sam through Resend so a person can check it and reply. Your email is never shown on the site, never sold, never shared for marketing and never added to a marketing list. Removal requests are done within 2 business days. Ask us and we will delete your request.
• “Get new funding by email.” On gethomebook.com/funding you can ask us to email you new funding. We keep only your email address, your state, your school type, whether you signed up online or on a paper sheet at an event, and the dates you signed up, confirmed and were last emailed. We use it only to send that email, once a month and only when there is something new. Nothing else is sent until you confirm your address from the email we send you; an address that is never confirmed is deleted 14 days after our last email to it (asking again sends a new email and restarts the 14 days). Every email has a one-click unsubscribe link, and unsubscribing deletes your address from the list. It is never sold or shared, and never used for anything else. Our database (Supabase) and email (Resend) providers handle it only to store it and send the email. You can also ask us to delete it at any time.
• “My list” on the funding pages. Listings you save, their status and your notes are kept in your own browser (local storage), never sent to us, and you can clear them by removing them or clearing your browser’s site data. A share link you choose to make holds only which listings and their status, never your notes, and opening one sends none of it to us. The deadline calendar feed is the same for everyone and reads nothing about you.
• The Funding Helper chat. On our funding pages you can choose to chat with an AI helper run by ElevenLabs. Nothing connects to ElevenLabs until you start a chat. ElevenLabs then receives the messages you type and technical connection details, and keeps the conversation for 90 days. We read only a short report of questions it could not answer, with email addresses and phone numbers removed, to improve our guides. Please do not share personal information in the chat. Ask us and we will delete a conversation.
• “Something off?” reports. On a funding listing you can tell us something looks wrong. We keep what you pick, your note, the date and, only if you give one, your email address so we can reply; the email is deleted 30 days after you send the report. If you mark an AI helper answer as wrong, we keep that question and answer (with email addresses and phone numbers removed) and nothing else about you. To limit spam we keep a scrambled form of your IP address for 2 days, never the address itself. Reports are used only to fix the listings and the helper, and are never sold or shared. Our database (Supabase) and email (Resend) providers handle them only to store them and tell Sam.
• How-to videos use YouTube’s privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play; then YouTube’s own privacy policy applies to that video.
• Hosting. Vercel serves the site and keeps standard request logs (such as IP address and browser type) to keep it secure.

14. Changes and contact

If we change this policy, we post the new version here with a new effective date. If the change matters (for example, a new kind of information or a new use), we show the new notice in the app and email families who do not sign in, before the change applies to their information. For information collected from children under 13, a change that matters does not apply to a school’s students until the school has received the new notice and renewed its authorization in Homebook; if Arkansas law requires a teen’s or parent’s agreement, we ask for it first.

Questions or requests: Homebook, LLC, 95 Paiger Ln, Greenbrier, AR 72058, (501) 514-5811, privacy@gethomebook.com. For children’s privacy, put “Children’s privacy” in the subject line. Schools: our School Data Agreement sets out these promises as a contract.