How we handle your data, and your child's.

01Overview

This Privacy Policy describes how ScribeFoundry (“ScribeFoundry,” “we,” “us,” or “our”) collects, uses, stores, and protects personal information through the ScribeFoundry platform (the “Platform”).

The short version:

• We collect only what we need to operate the Platform and serve your student well
• We do not sell, rent, or trade personal information, ever, for any reason
• We do not use personal information for advertising or marketing to third parties
• Student work belongs to the student and is never used to train AI models, either ours or anyone else's
• Custodians can see metadata about their student's work, but cannot read drafts
• You can request deletion of your data at any time

The long version, with the details that matter, follows below.

02What we collect

Account information

When a Custodian creates an account, we collect the Custodian's name, email address, and optionally a phone number and organization type. When a Custodian adds a student, we collect the student's display name, username, birthdate (required for COPPA compliance and never displayed publicly), guardian email, reading level set by the Custodian, and optionally a primary curriculum name.

When a Standalone student account is created, the student provides the same fields for themselves.

Profile and portfolio content

Students may customize their profile with a bio, a display name, a chosen curated avatar (minors) or a photo (adults only), a header image, and a color theme. Students publish essays and speeches to their personal subdomain, and those published pieces are public by design.

Writing and coaching content

We store every draft, every published piece, every coaching session, and every interaction between the student and the AI coach. This includes the student's questions to the coach, the coach's responses, and the revisions the student makes along the way. This record forms the Process Log that is a core feature of the Platform.

Technical information

We collect basic technical information automatically when you use the Platform: IP address, browser type, device information, pages visited, and times of visits. This information is used to operate the Platform, diagnose issues, and prevent abuse.

Billing information

Payment information is handled entirely by our payment processor (Stripe). We do not store credit card numbers or banking information on our servers. We receive confirmation of successful payments and limited metadata such as the last four digits of the card and the subscription status.

03How we use data

We use the information we collect to:

• Operate the Platform: authenticate users, render portfolios, generate coaching responses, process payments, and send necessary notifications
• Communicate with Custodians and students about account status, service changes, and critical security issues
• Provide the Custodian dashboard features (engagement metrics, coach summary reports, piece status)
• Investigate and respond to reports of content policy violations
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service
• Improve the Platform based on aggregate usage patterns (how often a feature is used, where users encounter errors, etc.)

04AI coaching and Anthropic

AI coaching and third-party processing. When your student interacts with the Socratic coach, their question, their current draft, and related context are transmitted to Anthropic's Claude API to generate the coach's response. Anthropic processes this data as our subprocessor under their Commercial Terms. Under those terms, Anthropic does not use our customers' data to train their AI models and retains API content for up to 30 days for abuse-detection purposes before deletion. Anthropic's Commercial Terms and Privacy Policy are available at anthropic.com.

05Subprocessors

We use a small number of carefully chosen third-party services (subprocessors) to operate the Platform. Each subprocessor receives only the data necessary to perform its role, and each is bound by contractual or regulatory data protection obligations.

• Anthropic (AI coaching). Receives student coach inputs, current draft content, and related context to generate coach responses. Processes under Anthropic Commercial Terms.
• Clerk (authentication). Manages account login, password storage, and session security. Receives email, name, username, and authentication credentials.
• Stripe (payments). Processes subscription billing. Receives payment method, billing address, and subscription metadata. We do not see or store full card numbers.
• Render (hosting). Hosts the Platform application and database. Receives and stores all Platform data.
• Cloudflare R2 (file storage). Stores avatar assets and header images.
• Twilio (SMS notifications). Sends SMS notifications to verified phone numbers for users who enable them. Receives the phone number and the notification text.

If this list changes, we will update this Privacy Policy and notify affected account holders.

06What we do not do

We do not:

• Sell, rent, trade, or otherwise commercialize personal information
• Share data with advertisers, data brokers, or marketing networks
• Use student writing or coaching content to train our own AI, or any third party's AI
• Currently use third-party analytics, advertising trackers, or behavioral profiling cookies
• Use student content for marketing or promotional purposes without explicit per-piece consent from the student and, for minors, the Custodian

If any of the above changes in the future, we will notify you in advance and update this Privacy Policy.

07Data retention and deletion

Active accounts

While your account is active, we retain your data for as long as necessary to provide the Platform and fulfill the purposes described in this policy.

Dormant accounts

If a subscription lapses or an account is otherwise inactive, we move the account into a dormantstate. Pieces, coach history, process logs, and profile information are preserved. The student's subdomain displays an inactive notice. Data is not automatically deleted from dormant accounts.

User-initiated deletion

You may request deletion of your data at any time by contacting us through the form on the About page. Upon verified request, we will delete your personal data from our active systems within 30 days. Some information may be retained in encrypted backups for up to 90 additional days before being purged.

Legally required retention

We may retain certain information longer where required by law (e.g., tax records for billing transactions, records relevant to pending legal claims). Such retention is limited to the minimum period legally required.

08Children and COPPA

ScribeFoundry serves students under the age of 13 through Custodian-managed accounts only. We take our obligations under the Children's Online Privacy Protection Act (“COPPA”) seriously.

Parental consent

By creating a Custodian account and adding a student under the age of 13, the Custodian represents that they are the parent or legal guardian of the student, or that they have obtained verifiable parental consent from the student's parent or legal guardian.

Information collected from children

For student accounts belonging to users under 13, we collect only the information necessary to operate the Platform: display name, username, birthdate (for age verification), and the writing and coaching content the student creates. We do not request additional personal information from children, and we do not enable photo uploads for minor accounts.

Annual re-consent

Each year, we email the guardian email on file for any active minor account to re-confirm parental consent. If we do not receive a response to the annual re-consent email, we attempt contact a second time after 45 days. If we have not received a response within 90 days of the initial notice, and two contact attempts have both failed, we initiate a deletion process. The account is placed in a 30-day pre-deletion hold with a final notification sent to the guardian email, after which the account and all associated data are deleted.

Parental rights

Parents and legal guardians have the right to review the personal information collected from their child, to request deletion of that information, and to refuse further collection. To exercise any of these rights, contact us through the form on the About page.

Safety protocol

If published content on a student portfolio indicates that a student may be in immediate physical danger, we may contact the guardian email on file directly, outside of the normal moderation review process, and may take immediate action to remove the content pending further investigation.

09Your rights

Depending on where you live, you may have certain rights regarding your personal information. These include the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your personal information, subject to the exceptions described above
• Export your data in a portable format
• Object to certain uses of your information
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us through the form on the About page. We will respond within 30 days. If you are a resident of California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you may have additional rights under state law.

10Security

We take reasonable administrative, technical, and physical measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. These measures include encrypted connections (HTTPS/TLS), encrypted data at rest, authentication through Clerk, access controls limiting staff access to the minimum necessary, and regular review of our security practices.

No security system is perfect. If we experience a data breach affecting your personal information, we will notify affected users as promptly as required by applicable law.

11Changes and contact

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify account holders by email or through the Platform at least 30 days before the changes take effect. The “Last updated” date at the top of this page always reflects the most recent version.

Contact us

For questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, use the contact form on the About page. For formal legal notices, write to us at: