Primer Privacy Policy

This Privacy Policy explains what information Primer ("we," "us") collects from and about children and parents, how we use it, who we share it with, and the rights parents have under the Children's Online Privacy Protection Act (COPPA). Primer is intended to be set up and managed by a parent or legal guardian.

1. Operator & Contact

Primer is operated by Primer Institute. For any privacy request to review, export, or delete your child's data, or to revoke consent contact support@primer.institute.

2. Information We Collect

• About the child: first name, grade level, birthdate, interests, learning preferences and accommodations, therapy/support information you choose to provide, lesson responses and assessment results, chat messages in Curiosity and in-lesson help, and learning-activity/session timestamps.
• About the parent/guardian: name, email address, authentication credentials, billing details (processed by Stripe), and consent records.
• Technical: first-party session cookies and standard request logs. We do not use third-party advertising or analytics trackers.

3. How We Use Information

• To generate and adapt personalized lessons, practice, and assessments.
• To grade work and power Curiosity and in-lesson help.
• To enforce safety guardrails on student chat and notify parents of safety events.
• To produce progress reports for parents and to operate billing.

We do not sell child data, use it for advertising, marketing, or behavioral profiling, or use it to train third-party AI models.

4. Third Parties (Subprocessors)

We share the minimum data necessary with the service providers below. Each is contractually restricted to processing data only to provide their service to Primer and is prohibited from using child data for advertising or to train their own models.

• Supabase authentication and database hosting.
• Third-party AI providers (one or more frontier large-language-model and image-generation providers; we may change providers over time) lesson generation, grading, chat/help, embeddings, illustrations.
• YouTube / Google searching for and embedding age-appropriate educational videos (privacy-enhanced youtube-nocookie player). YouTube may serve ads and collects data subject to its own policies.
• Resend transactional and notification email.
• Stripe subscription billing and payment processing.
• Vercel application hosting and image asset storage.

A current list of providers is available on request at support@primer.institute.

5. Verifiable Parental Consent

We collect child information only after a parent/guardian creates the account, attests they are 18+ and the child's parent or legal guardian, and accepts the in-app AI & data disclosure during setup. We record a dated, versioned consent entry for each child. If we materially change what we collect, how we use it, or who we share it with, we will obtain new consent before the change applies.

6. Parental Rights

• Review all data from the parent dashboard.
• Export a child's full data as a JSON file from Settings → Privacy & Security → Export Data.
• Delete a child's data at any time from the same screen.
• Revoke consent and deactivate a child's account at any time.

7. Retention & Security

• Active-account data is retained while the account is active.
• Deleting a child removes their database records and generated image assets; full account deletion is completed within 30 days.
• Diagnostic AI logs are automatically purged after 30 days.
• Generated lesson illustrations are automatically purged after 90 days.
• Data is scoped per family and protected by role-based access; public database tables have row-level security enabled.

8. Schools & Changes

If a school or tutoring organization uses Primer, additional school-consent, FERPA, and data-processing terms apply and will be provided separately. We will post material changes to this policy and, where required, obtain renewed parental consent. Questions: support@primer.institute.