Privacy Policy
Effective September 01, 2026
We built SkillFlow for kids, with parents in control. Here's what we collect, why, who sees it, and what you can do about it — in plain language.
Who is responsible for your data
SkillFlow is the data controller for the parent and child data described here.
SkillFlow is operated from Canada.
What we collect
Parents: name, email address, password (stored hashed), language and time zone, and the IP address and browser details of your sessions for security. While SkillFlow is in free early access we do not collect a billing address or any payment details, because there is nothing to pay.
Children: the first name or nickname you choose, username, PIN (stored hashed), grade or age range, the lessons they receive, their answers including handwritten work and drawings, results, progress and achievements.
Technical: server logs, error reports, and your cookie-consent choice.
Sign-up source: when you create an account, we record which website or link brought you to SkillFlow (the campaign tags in the link and the name of the referring site) and keep it with your account, without using your IP address or fingerprinting your device.
Why we use it
To provide the service (generate lessons, track progress); to keep accounts secure and prevent abuse; to understand how the site is used (analytics, only with your consent); and to meet legal obligations. While SkillFlow is in free early access we process no payments, so no billing data is involved.
Children's data
Children never create accounts themselves. A parent or guardian creates every child profile and confirms, at that moment, that they consent to us processing the child's learning data. We collect only what the lessons need — no surname, address, school or location.
To generate and review lessons, a child's first name, age range and lesson work (including photos of handwritten answers) are sent to our AI providers listed below. Under our agreements with them this data is used only to produce the lesson or review and not to train their models.
We never show advertising to children, never sell or share children's data for advertising, and never run analytics on children's pages. Parents can view, export or delete a child's data at any time from the app.
We design SkillFlow to meet the US Children's Online Privacy Protection Act (COPPA), Canada's PIPEDA and Québec's Law 25, and the GDPR / UK GDPR rules on children's data. If you believe we hold a child's data without a parent's consent, email us and we will delete it.
Family members (shared access)
The account owner — the parent who created the account and pays for it — can invite one other parent or legal guardian (a co-parent) by email. A co-parent gets their own login and can see and manage the same children's profiles, lessons, results, reports and rewards. The owner remains the account holder and billing contact and decides who has access: they can withdraw an invitation or remove a co-parent at any time, and a co-parent can leave at any time. Removal or leaving ends access immediately.
Before access is shared, both the owner and the co-parent confirm that the co-parent is a parent or legal guardian of the children. To protect the children's data, we store the email address the invitation was sent to, when and from which IP address it was accepted, and an access log of each invitation, join, removal and departure, with IP addresses.
Each adult's own profile stays their own. The owner and the co-parent see each other's name and email address in Family members, but not each other's other profile details, and a co-parent never sees the owner's billing or payment information. A co-parent's data export includes their own profile and the shared children's data, not the owner's profile or billing records.
If a co-parent deletes their account, only their login and profile are deleted; the children's data stays in the family account. The access log is kept while the owner's account exists and is deleted together with it.
How long we keep data
Account and child data stay while your account exists. When you delete a child profile or your account, that data is removed within 30 days and from backups within 90 days. While SkillFlow is in free early access there are no billing records to keep. Server logs are kept for 30 days.
Your rights
You can access, correct, export and delete your data and your children's data yourself from the account page. You can also object to or restrict processing, withdraw consent, and complain to your data-protection authority. Residents of the EU/UK (GDPR), California (CCPA/CPRA), Canada (PIPEDA) and Québec (Law 25) have specific rights under those laws; email us to exercise any of them and we will respond within 30 days.
Security
Data is encrypted in transit, passwords and PINs are hashed, and access to production systems is limited to the operator. We collect no payment details at all while SkillFlow is in free early access.
SkillFlow's database and stored files — including children's handwritten work — are kept on our own server in Québec, Canada. Cloudflare carries the encrypted connection between your browser and that server and controls who can reach it.
Changes to this policy
The effective date at the top shows the current version. For material changes we will email you before they take effect.
Contact
Questions? Email support@skillflow.academy.