Privacy Policy

Version: 2026-11-06

This Privacy Policy explains how Focus on Foundations (“Focus on Foundations,” “we,” “us,” or “our”) collects, uses, discloses, and protects information through our website, family account and learning services, lessons and prototypes, private documents, user-facing AI agent, and QRAG question-answering service (collectively, the “Services”).

1. Scope of the Alpha

The current alpha is offered directly to families in the United States. It is not a school-directed service, and we do not currently contract with schools or act on behalf of schools. A parent or legal guardian must manage any use by a child under 13. A person 13 or older may create an individual account for themselves. Independent accounts are not available for children under 13.

This 2026-11-06 update adds the agent, private document processing and retention, lesson and prototype records, and model-choice disclosures. It corrects account age limits, deletion details, and version acceptance. The 2026-10-27 update added family-wide document access and chosen AI-tool disclosures. The 2026-10-22 update says that people we invite to test the Services can also send feedback reports from the main site, with an option to open a private GitHub issue. The 2026-10-09 update brought the Policy in line with how the Services work now by naming providers, records, retention gaps, and deletion limits. The 2026-08-18 update added KWS Parent Verification, AgeGraph, and AI-assisted review of uploaded signed forms.

2. Information We Collect

The information we collect depends on which Service you use.

Adult and guardian accounts

Individual accounts are available from age 13. A person under 18 must have the permission and supervision of a parent or legal guardian. When an individual account holder or guardian creates or uses an account, we collect:

Account and authentication information, including the email address, account identifier, and authentication status. Passwords are processed by our authentication provider; Focus on Foundations does not receive the account password in readable form.
Profile information, such as a display name.
Family membership and account-management records.
Records of agreement to our Terms of Service and Privacy Policy, including the version and date or time of consent. New acceptances identify each document version and the time of acceptance. We keep the current acceptance and up to 20 recent acceptance-history entries. Older records may identify only a shared consent version, not the exact document dates.

Guardian-created child accounts and learning data

A child under 13 cannot self-register. An authenticated parent or legal guardian creates and manages the child account after email-plus consent (a direct-notice email, a confirmation-code response, and a follow-up email that consent can be revoked). For a guardian-created child account, we collect:

A guardian-owned plus-address email, such as youremail+kidname@whatevermail.com, used as the child’s sign-in address and routed to the guardian’s inbox.
The child’s display name, account identifier, authentication status, and family relationship.
Learning activity and progress, including answers, attempts, assignments, app settings, and related educational interactions. Lessons and prototypes can record results by session, times, the content and version used, and links to skills in the knowledge map. We use those records to show progress and estimate the learner’s position in that map.
Learning data files, including SQLite files created by learning applications and stored for account synchronization.
Consent provenance, including the consenting guardian’s account identifier, the consent statement or version, and the date or time consent was recorded.

Please choose a child display name that does not reveal more personal information than is needed to use the Service.

Private documents

We collect the files you upload, their original and display names, folders, file types, sizes, checksums, upload times, and the accounts that upload or change them. We keep malware-scan results and processing status. For supported formats, we extract and store text and document structure so you and the agent can find and read the content. Some formats, including images, are stored without text extraction. A supported format can still fail to convert.

Uploads first go to restricted storage for a malware check at AWS. Files that pass can be read and processed. We delete uploaded bytes identified as infected. We keep the scan result until the document record is deleted. If a scan cannot support a format, the owner may be able to download it with a warning. The agent and other family members cannot read that unscanned file. Text extraction runs in our AWS environment. Extraction itself does not send the document to an AI provider.

A guardian may upload their own or their child's school documents that they have authority to provide. All guardians in the same family can see and act on private documents across that family. This includes documents in another guardian's space. Family membership is an access permission, not a promise of separate storage from other guardians. A tutor grant does not include access to this private document space.

Agent conversations

The agent is available to eligible guardian and individual accounts. A child account has no direct agent entry. We save conversation titles, messages, answers, tool calls and results, previews, confirmations, notices, timestamps, and attachments. Tool results and answers may include text from documents or child learning records. Conversations belong to the account that starts them. Sharing a family does not automatically share conversation history.

The agent can read permitted catalog items, learning results, knowledge-map positions, and document text to answer your request. It shows a preview and waits for your confirmation before it changes supported records. Saving messages and operational records happens as part of providing the conversation; it does not wait for that action preview. We record who authorized a change and which conversation produced it.

We also keep your personal-information notice preference and your child-data notice preference. We keep up to 20 recent child-data acknowledgements with the notice version, time, and whether you asked us to remember the choice. These records remain until account deletion. A one-turn allowance expires after about 10 minutes if unused and is consumed when the turn is authorized.

Learner Gallery

Math Quiz has a Gallery in which a learner earns pictures by practicing. For a learner’s Gallery we collect and store:

The title and the description of each picture request. A child can write these as free text.
The saved prompts and the prompt of each picture.
The pictures, the learner’s albums, and the records of the pictures the learner has earned. A guardian adds the pictures; a child cannot upload or generate a picture.

Please make sure that a title, a description, or a picture does not reveal more personal information than is needed.

A guardian can copy pictures to another child in the same family. A learner who is signed in to a child account or an individual account can send an earned picture to a sibling, or to another learner account — including an account in another family — by entering that account’s exact sign-in email address. The picture goes with its title, description, and prompt. If the receiving account is a child account, the picture first waits for a guardian of that child. Only a guardian of the receiving child can approve or decline it. While it waits, the child cannot see or download it. The guardian sees the picture, its title, description, and prompt, and the display name of a sender in the same family. For a sender in another family the guardian sees no name, email address, or account identifier. If the guardian declines, we delete the picture with its title, description, and prompt. We do not tell the sender what the guardian chose. A picture sent to an individual account, which has no guardian, arrives directly.

AI picture generation for the Gallery is available only where the service is configured. A child cannot start it. Section 4 says what is sent when a guardian uses it. Uploading or viewing an existing Gallery picture does not itself send it for AI generation.

Parent verification and tutor-disclosure consent

If a guardian invites a tutor who can see a child’s display name, we collect a stronger verification record before that disclosure. The record includes the verification method, status, and time, and the exact consent text and version the guardian accepted. Depending on the method the guardian chooses, it also includes:

KWS Parent Verification. We send KWS the guardian’s verified email address, an opaque correlation token, and a country and language setting (United States and English by default). KWS emails the guardian and uses Stripe to make a refundable $0.05 credit- or debit-card charge to check adult status. We keep a KWS transaction identifier as evidence. We do not receive or store the card number.
Focus on Foundations Stripe fee. Stripe’s hosted Checkout processes a non-refundable $0.50 payment. We keep Stripe session or payment identifiers and the amount. We do not receive or store the card number.
Signed form. The guardian physically prints a generated form, signs the paper with a pen, and uploads a scan or photograph. We store that document privately. Typed, pasted, digital, certificate-based, and on-device signatures are not accepted for this method. We send the uploaded form and protected reference fields to OpenAI for an AI assessment of whether the upload visibly appears to be a complete wet-signed form and whether its fields match. Those materials can include the guardian’s email and signature, selected child display names, tutor email, consent text, and verification identifiers. A clear AI-approved form may complete verification automatically within minutes. Any form the AI does not approve, cannot read, or cannot assess is kept in the authorized human-review queue; it is not automatically rejected. A person in our small group of authorized reviewers then decides by hand. That review is not immediate.

We do not send child names, child identifiers, tutor email addresses, family identifiers, or account identifiers to KWS or Stripe. KWS verifies adult status. It does not verify that the person is the parent of a specific child. The guardian’s attestation and verified Focus on Foundations account remain our record of that authority.

QRAG service data

QRAG answers questions about curated source collections. QRAG search and answers need a signed-in account with a verified email address. A guardian-created child account cannot use QRAG. QRAG does not use family records, child records, or learning data to answer a question. For QRAG we collect:

Questions and other text submitted to QRAG, the generated answer, the source passages used, the model used, and supporting service metadata. We keep a copy of each exchange and a record of each answer job, as Section 6 describes.
The conversations that you save to your history. “Temporary chat” does not save a conversation to your history. It does not stop the exchange copy, the job record, or the sending to AI providers.
An email address that you type to send an answer by email, and your choice about our update list.
Records of AI use and spending, described below.

To find and write an answer, QRAG sends the question, earlier messages of the same conversation, and source passages to AI providers. Section 4 names them. The request does not include your name, your email address, or your account identifier, but it includes everything you type. Do not submit sensitive personal information in a QRAG question.

When you send an answer by email, we send the questions and answers to the address you typed. We record that address, in readable and in hashed form, and your update-list choice in a log file. When you send an answer by email or download it, a copy of those questions and answers also goes to our contact mailbox.

AI use, AI credits, and donations

For an account that uses AI features, including QRAG and the agent, we keep records of AI use and spending: counts of use, the cost of each answer, amounts held while an answer is written, the balance of the starter allowance and of purchased AI credits, limits, the verified email address used for spending notices, and records of the source transcripts that the account downloaded.

Where donations or AI-credit purchases are offered, Stripe’s hosted Checkout takes the payment. A donation does not need an account. We keep an order record with the purpose, the amount, Stripe identifiers, and the receipt time and version. We read the payer’s name and email address from Stripe to send the receipt, and we do not keep that email address in the order record. We do not receive or store the card number.

Access requests

A person without an account can ask to join the alpha or ask for special access to QRAG. The form to join the alpha collects an email address, a name, a message, and a social-media link if one is given. The special-access form collects an email address and a message. Each request is sent to our contact mailbox. To limit repeated requests, we keep a hashed form of the sender’s IP address for about one day. If we grant special access, we keep the email address on our special-access list with a short note.

Feedback reports

Some people whom we invite to test the Services can send us feedback reports from the website, including the main site, focusonfoundations.org. Feedback is off for every other account. A feedback report holds the name or label you give or your account name, your text, the page address, the release of the site, the account or browser session, a screenshot, and any files you attach. The screenshot shows the whole visible browser tab, so it can show personal information that is on your screen. When you choose a GitHub issue, we also open an item in our private project tracker at GitHub, Inc. It holds your text, the kind and area of the report, the page path and the release. It does not hold your name, email address, screenshot or files, which stay in our storage at Amazon Web Services. Authorized reviewers read the reports to find and fix problems. They use AI tools to summarize reports and to propose fixes, so the text and the screenshots of a report can go to the AI companies that provide those tools.

Usage, device, and security data

We and our service providers collect operational data needed to deliver and protect the Services. This may include IP address where applicable, browser and device information, pages or features used, timestamps, request and error metadata, authentication events, security events, and similar usage and security logs. We may use cookies, browser storage, and comparable technologies for authentication, session continuity, consent state, preferences, and security.

Our current programs are written not to put the text of a question, an answer, or an email into a log. A service that is set to record full requests for troubleshooting can still do so. Such a log then holds that content together with the IP address and browser details.

To limit use, we keep counters for each account and a keyed, hashed form of the IP address that changes each hour. If a page meets an error, it sends a report with the page address and browser details to our contact mailbox. If a page marks an input as suspicious, it sends the text of that input to our contact mailbox.

3. How We Use Information

We use information to:

Create, authenticate, and administer adult, guardian, and child accounts.
Provide learning activities, lessons, prototypes, and the Gallery, save and synchronize progress, and let guardians manage family data.
Store, scan, and extract text from private documents. Provide agent conversations and carry out the actions you confirm.
Complete parent verification when a guardian chooses to authorize a tutor relationship, and keep the resulting consent evidence.
Operate QRAG, answer submitted questions, administer AI allowances, credits, and spending limits, and provide optional email features.
Take donations and AI-credit payments and send receipts.
Review access requests and feedback reports.
Communicate about accounts, verification, support, privacy requests, and material Service changes.
Maintain, debug, understand, and improve the Services, including internal product research and review of saved QRAG exchanges. We may publish de-identified or aggregated findings that cannot reasonably identify a child.
Detect abuse, protect users and the Services, enforce our terms, and comply with legal obligations.

We do not sell personal information. We do not use personal information for targeted or cross-context behavioral advertising. We do not market to children. Focus on Foundations does not independently share identifiable child information with third parties beyond the service processing described in this Policy. A parent or legal guardian may separately start, scope, and revoke a tutor relationship after a stronger verification step; in that case we disclose to that tutor the tutor relationship, the child’s display name, and the child’s learning progress, assignments, settings, and saved files, as Section 5 describes. A learner can choose to send an earned Gallery picture to another learner, as Section 5 describes. If we intend to share identifiable child information with other third parties — for example with research organizations or partner nonprofits — we would request additional consent for that.

4. How We Disclose Information

We disclose information only as needed for the purposes described in this Policy:

Hosting and service providers. We use service providers to authenticate accounts, run our APIs, store account, family, consent, and application records, store user files and signed-form uploads, deliver the website, and send transactional email. Our hosting provider is Amazon Web Services (AWS). AWS runs our sign-in, programs, databases, file storage, website delivery, firewall, email sending, and logs. It therefore stores or carries the records described in this Policy, including child records, learner files, Gallery pictures, signed-form uploads, QRAG exchanges, and the full text of the emails we send.
Kids Web Services (KWS). If a guardian chooses KWS Parent Verification, we send KWS the guardian’s verified email address, an opaque correlation token, and a country and language setting. KWS, operated by Kids Web Services Ltd in the Epic Games family of companies, emails the guardian, checks adult status with a credit or debit card through Stripe (a refundable $0.05 charge), and returns the result to us. After the guardian interacts with KWS, KWS’s privacy policy governs the card check and KWS’s own records. Child names, child identifiers, tutor email addresses, family identifiers, and account identifiers are not sent to KWS.

If verification succeeds, KWS stores a hashed version of the guardian’s email and verification status in AgeGraph, a network KWS uses so the same adult may not have to verify again for other apps that use KWS. AgeGraph is controlled by KWS, not by Focus on Foundations. Deleting a Focus on Foundations account does not delete the AgeGraph record. A guardian can ask KWS to remove them from AgeGraph by emailing privacy@kidswebservices.com or using the opt-out link in KWS’s verification email. KWS’s other service providers are listed in KWS’s public register.
Stripe. Stripe is used in three ways. If a guardian chooses KWS Parent Verification, Stripe processes KWS’s refundable $0.05 card check; that card data is provided to Stripe by KWS, not by us. If a guardian chooses the optional Focus on Foundations parental-verification fee, Stripe’s hosted Checkout processes the $0.50 payment and receives the amount, a verification identifier, and the guardian’s payment and contact data required for Checkout. If a person makes a donation or buys AI credits, Stripe’s hosted Checkout takes the payment; we send Stripe the amount, the product name, an order identifier, the purpose, and, for a signed-in account, the account’s verified email address, and the payer gives card, name, and email details to Stripe on Stripe’s page. Child names, child identifiers, tutor email addresses, and account identifiers are not sent to Stripe by us.
Signed-form AI and human reviewers. If a guardian chooses the print-and-sign method, we send the uploaded form and the matching consent reference fields to OpenAI for the limited AI assessment described above. We configure the API request not to store the model response for later retrieval. That setting does not decide what else OpenAI keeps; OpenAI’s own terms apply. If AI does not approve the form or the assessment fails, authorized Focus on Foundations reviewers — a small group of named people — may open the uploaded document to approve or reject it by hand. The document is not sent to KWS or Stripe.
AI providers for QRAG. Search sends each question to OpenAI to create the numeric representation used to find source passages. The source index is stored at AWS. To write an answer, QRAG sends the question, up to 12 earlier messages of the same conversation, source passages, and, for some collections, a longer reference text to a model provider, including OpenAI or Anthropic, or through OpenRouter. Available models depend on the service configuration and your account's access. OpenRouter passes the request to the company that runs the selected model. These requests do not deliberately add your name, email address, or account identifier, but they include what you type. The AI providers page lists the models and their data handling levels.
AI providers for the Focus on Foundations agent and other AI tools. Using these tools is your choice. The agent uses the selected model from the providers listed on the AI providers page, including OpenAI, Anthropic, and OpenRouter. Through OpenRouter, the company that runs the selected model also receives the request. Available models depend on the service configuration and your account's access. It sends your request, relevant earlier messages, account context, and the results of permitted tool reads. These can include learning results, knowledge-map positions, document names and text, display names, and account references. Basic family context includes account references and roles even before the child-data acknowledgement. Child names and child learning-record results wait for that acknowledgement. It can search and read permitted documents in response to your request, not only files that you attach. It does not send the whole private document store with every request. Before a turn uses a child's learning records or documents, the guardian must allow that use or have a current remembered choice. Section 5 explains this choice.

Before we send a message that seems to include personal information, such as a name, email address, phone number, or street address, we show a notice and ask whether to continue. This detection is limited. It cannot identify every personal detail or guarantee that uploaded documents and tool results contain none. You can turn the notice off and back on under AI and your data in your account.

Apart from the guardian-chosen signed-form assessment described above, the agent sends child learning-record results only when a parent or legal guardian allows that use as Section 5 describes. The basic account references and roles described here can be sent earlier. Material you type or attach can also contain child information.
AI providers for Gallery pictures. Our program can make a Gallery picture with an AI image model when a guardian chooses Generate for a request. A child cannot start it. Where this feature is enabled, each time a guardian chooses Generate we send OpenRouter, and the image company that runs the chosen model, the prompt for the picture and up to four reference pictures from the learner’s Gallery. The prompt holds the saved prompt text, the title and the description of the request (which a child may have written), and the names of the reference pictures. The reference pictures go as links; a link to a private picture works for 15 minutes and contains the learner’s account identifier and the file path. The image models come from the OpenAI GPT Image, Qwen Image, ByteDance Seedream, and Google Gemini image families. Quiz answers and attempt histories are not part of that request. Those companies handle what they receive under their own terms, and deleting an account would not remove a copy held by them.
Other hosts that your browser contacts. Some pages load fonts, scripts, or a picture from outside hosts. Each of these hosts sees the visitor’s IP address and browser details and the address of our site, but not the full page address. We send no account data, answers, or learning records to them. The hosts are Google Fonts (all pages), cdnjs run by Cloudflare (Math Quiz and Gallery), jsDelivr (Math Quiz), Plotly (Math Quiz graphs), unpkg (one transcript page), and the Webflow file host (one logo picture). Google Fonts, cdnjs, jsDelivr, and Plotly are also loaded by pages that a child uses.
Our contact mailbox. Access requests, copies of shared or downloaded answers, error and security reports, and service notices are sent by email to contact@focusonfoundations.org. The provider that hosts that mailbox stores these emails under its own terms.
GitHub (feedback reports only). When an invited tester sends a feedback report as a GitHub issue, we open an item in our private project tracker at GitHub, Inc. The item holds the text of the report, its kind and area, the page path and the release of the site. It does not hold the tester's name, email address, account identifier, screenshot or files. No item is opened for a report from a child account.
Other learners, at a learner’s direction. When a guardian copies a Gallery picture to another child, or a learner sends an earned picture to another learner account, that account receives the picture with its title, description, and prompt. A child account receives a picture that a learner sent only after a guardian of that child approves it.
Legal and safety needs. We may disclose information when reasonably necessary to comply with law or legal process, protect rights or safety, investigate fraud or abuse, or secure the Services.
Organizational changes. If Focus on Foundations is involved in a merger, financing, reorganization, or transfer of Services, information may be transferred subject to this Policy and applicable law.
At your direction. We may disclose information when an adult user or guardian directs us to do so, including the tutor disclosure described in this Policy.

Model choice and provider data handling

The Services offer models from OpenAI, Anthropic, and OpenRouter. Available choices depend on the feature, the account, and the service configuration. The AI providers page shows model prices, data handling levels, policy check dates, and links to provider terms and data policies. Model menus and information tips also show the levels. Your account's AI and your data section links to this page. The agent shows a chooser when more than one model is available. Choosing and using a model means accepting the provider terms and data policy disclosed for it. We pass on those disclosures. We do not control a provider's practices, and remain responsible for our own legal obligations.

The three labels, from most to least privacy-protective, are:

Zero data retention (ZDR). The provider states that it does not routinely retain request or answer content after processing and does not use it to train models. Stated safety and legal exceptions still apply. This label is about request content. It does not promise deletion of billing or usage metadata, or of your records at Focus on Foundations.
No training. The provider states that it does not use request or answer content to train models. It may retain that content under its policy. Some providers state a period, such as up to 30 days for abuse checks. Others do not state a retention period.
May keep and train. The provider may retain request or answer content and use it to train models. The provider's disclosed policy determines that use.

As of November 6, 2026:

OpenAI API. OpenAI states that it does not use API inputs and outputs for training by default. Abuse-monitoring logs can contain content and are normally kept for up to 30 days, with legal and service-specific exceptions. ZDR requires OpenAI's approval. Focus on Foundations has requested it but has not received approval. Our OpenAI answer calls, agent steps, and signed-form review set store: false to turn off saved response storage for later retrieval. Turning response storage off does not itself remove abuse-monitoring retention. See OpenAI's API data controls.
Anthropic API. Anthropic states that it does not train on commercial API inputs and outputs by default. It normally deletes them within 30 days. The site offers Claude Sonnet 5.5 and Claude Opus 5.5. Sonnet 5.5 is in the default list for guardian and individual accounts with AI access. Opus 5.5 requires special access. Neither is a Covered Model that requires 30-day retention. Legal requirements, usage-policy enforcement, and services with separate retention can still affect how long Anthropic keeps data. ZDR requires a separate arrangement. No such arrangement is in place for Focus on Foundations. See Anthropic's training policy, retention policy, and API retention arrangements.
OpenRouter. OpenRouter and the company serving a model each have data policies. Each QRAG answer and agent-step request uses the routing rule for the selected model's disclosed level. For ZDR, we set provider.zdr: true. For No training, we set provider.data_collection: "deny". For May keep and train, we set no data restriction on routing. There is no blanket no-training restriction across all models. A model without a recorded OpenRouter data policy is refused before the request is sent. Choosing and using a model means accepting the provider terms and data policy shown for that choice.

The model policies recorded from OpenRouter's public lists on November 6, 2026, are:
- ZDR: DeepSeek V4 Flash, Kimi K2.6, GLM 5.2, and Nemotron 3 Super.
- No training: Qwen 3.7 Max and Qwen 3.7 Plus. Alibaba is their only listed serving provider. Its retention period is not stated.
The registry supports May keep and train, but no model currently listed on the site has that level. ZDR does not change how Focus on Foundations saves your conversations. OpenRouter states that ZDR prevents routine content storage, with a safety and legal exception for suspected child sexual abuse material. Its ZDR routing can also allow safety-retention endpoints unless the account or guardrail explicitly requires ZDR only. See the AI providers page, OpenRouter's ZDR policy, and provider policies.
Inworld. We use Inworld to record lesson voices ahead of time. We send lesson scripts, not account data, child learning records, or agent conversations. Playing those saved clips does not send the learner's words to Inworld.

These are provider statements and the current site settings, not a promise that Focus on Foundations can control a provider. Deleting a site account or conversation does not itself delete a provider's copy. The providers page gives the recorded policy and check date for each provider. Provider policies and available models can change.

We give information to a provider only so that it can perform its service for us. We do not allow providers to use child information for advertising or marketing. Each provider handles what it receives under its own terms and legal obligations. KWS acts as our service provider when we send the guardian email and KWS sends the verification email. For the card check, AgeGraph, and related verification records, KWS acts as an independent organization under its own privacy policy.

5. Children’s Privacy: Direct Notice to Parents and Legal Guardians

This section gives parents and legal guardians direct notice of our practices for children under 13. Our privacy commitments are subject to any legal obligations required by court orders or government authorities.

How a child account is created

A child under 13 may not create an account independently. A parent or legal guardian must first create and authenticate a guardian account, including email-plus consent. The parent or legal guardian then creates the child account, supplies the guardian-controlled plus email address and child display name, and affirmatively agrees to the child-consent statement bound to that standing consent. We record the consent provenance described above.

New child consents use version 2026-11-06. Existing consents under version 2026-08-16 remain valid. Guardians must accept the new Terms and Privacy Policy versions to keep using their accounts. The agent separately asks for permission before it uses child learning records and documents, each time or under a remembered choice that the guardian can turn off.

What we collect from a child

Through the child account and learning applications, we collect the child’s guardian-controlled plus email address, display name, persistent account identifier, learning activity and progress, assignments and settings, SQLite learning files, Gallery request titles and descriptions, Gallery prompts and pictures, lesson and prototype session results, knowledge-map positions, and usage or security data. A guardian can also upload documents about a child. We store those files, extracted text where supported, document details, and scan results as Section 2 describes. We do not require a child to provide more information than is reasonably necessary to participate in the available learning activities.

How we use and disclose child information

We use child information to authenticate the child, provide and personalize learning activities, save and show progress, allow guardian oversight, maintain and secure the Services, and comply with law. We disclose it to our service providers only as needed to operate the account and learning Services, or when legal or safety needs require disclosure. We do not sell child information, use it for targeted advertising, or market to children. We do not send child information to KWS or Stripe.

Every guardian in a family can see and act on everything in that family — each child’s documents and learning records and the other guardians’ own documents and learning records — and can upload documents to a family member’s private document space.

AI providers. A child's learning records and documents go to an AI provider only when a parent or legal guardian uses the agent with them and allows it, each time or as a remembered choice that can be turned off under AI and your data. Before an agent turn sends a child’s learning records or documents, we tell the guardian the types of records that may be sent and ask them to confirm. Basic account references and family roles can go to the agent provider before this acknowledgement. Child names and the results of child learning-record reads wait for it. The guardian can allow one turn or choose not to be asked again. The guardian can turn the question back on at any time in their account under AI and your data. A changed notice requires a new acknowledgement. This choice is separate from the preview that authorizes a change to a record. Messages or attachments that a guardian supplies can themselves contain child information. The personal-information notice cannot detect it all. A child account cannot use QRAG or enter the agent directly. A guardian can continue using ordinary learning and document storage without allowing the agent to use the child’s records. If a guardian chooses signed-form tutor verification, the uploaded form and matching consent reference include the selected child display names and are sent to OpenAI for the limited AI assessment described above. Where AI picture generation for the Gallery is enabled, a guardian’s Generate request sends the title and description of a picture request, which a child may have written, and up to four pictures from the child’s Gallery to OpenRouter and an image company, as Section 4 describes.

Tutors. If a guardian later invites a tutor, we disclose to that tutor the tutor relationship, the selected child’s display name, and the child’s learning progress, assignments, settings, and saved files, and the tutor can set practice plans for that child the same way a guardian can. The saved files are the child’s learning data files and the Gallery pictures that are rewards for quizzes. The statement that a guardian accepts for a tutor says so. A tutor has no Gallery controls.

Other learners. A guardian can copy a Gallery picture to another child in the same family. A child can send an earned Gallery picture, with its title, description, and prompt, to a sibling or to another learner account — including an account in another family — by entering that account’s exact sign-in email address. The sending child’s guardian is not asked. A child who receives a picture gets it only after a guardian of that child approves it; until then it shows only in the guardian’s part of the Gallery, and a declined picture is deleted. A picture that was approved, or that was sent to an individual account, stays in the other account’s Gallery.

Outside hosts. When a child uses Math Quiz or the Gallery, the child’s browser also contacts Google Fonts, cdnjs, jsDelivr, and Plotly, which see the IP address and browser details, as Section 4 describes.

If we intend to share identifiable child information with other third parties — for example with research organizations or partner nonprofits — we would request additional consent for that.

Guardian choices and rights

A parent or legal guardian may:

Review the child information associated with the family account.
Correct the child’s display name or other editable account information.
Delete the child account and its saved learning data through family account controls.
Withdraw consent by deleting the child account.
Decline to send the child’s learning records to the agent, or turn the child-data question back on. This does not recall information already sent or erase saved conversation text.
Cancel a pending verification, revoke a later tutor relationship, or contact us to request access, correction, or deletion, or to ask questions about our child-data practices.

We may need to verify the requester’s identity and authority over the child account before fulfilling a request. A guardian may consent to our collection and use of child information without permitting disclosure beyond the disclosures that are integral to providing the Services, as described in this Policy.

6. Retention and Deletion

Adult account, family, child account, consent, and learning data in current records is retained while the relevant account remains active, until an authorized user uses self-service deletion, or until we perform alpha or Service cleanup. Current user files remain available while the account is active. During the alpha, we do not automatically delete account data merely because an account has been inactive.

Temporary child-consent confirmation challenges expire after about 10 minutes, and family invitations expire after 7 days. We enforce those expiration times when the records are used. Background deletion of expired temporary records is asynchronous, so an expired record may remain in storage for a limited time after it can no longer be used.

How long we keep other records

Private documents. Uploaded files, extracted text, document details, folders, and malware-scan results have no automatic expiry. We keep them until an authorized deletion or Service cleanup. An infected upload's bytes are deleted after the scan, but its document and scan record remain until deleted. Failed or unfinished uploads can remain in restricted storage until deletion or cleanup. Successful document deletion removes its stored file versions, extracted text, and document record, including its scan result. It does not erase copies in conversations or at AI providers.
Agent conversations. Conversations and their messages, tool results, previews, confirmations, and notices have no automatic expiry. We keep them until you delete the conversation, delete the account, or we perform Service cleanup. Deleting a conversation removes its turns and files uploaded specifically as that conversation's attachments. It does not delete independent documents used in it or undo actions you confirmed. Deleting an independent document does not erase its text from an earlier conversation. Child information copied into a guardian's conversation remains under that guardian's conversation retention until that conversation or account is deleted. The child's account deletion does not automatically remove the guardian's conversation.
Lesson and prototype records. Session results, learning observations, and saved progress have no automatic expiry. We keep them with the learner's records until deletion or Service cleanup. Knowledge-map positions are computed from learning records; keeping those records allows the positions to be shown again.
Learner files. We keep the current file and every earlier version of it, so that a file can be restored. Earlier versions are kept until the file or the account is deleted.
Gallery. Gallery requests, prompts, and pictures have no automatic expiry and are kept until the account is deleted. A request that is still waiting for its picture can be deleted earlier. A picture upload that was not completed can stay in a holding folder until we remove it.
Signed forms. Pending signed-form uploads expire after 30 days and are removed if the guardian account is deleted before approval.
QRAG exchanges. We keep a copy of each exchange (the question, the answer, the source passages, the model, and a short hashed form of the account identifier) and a record of each answer job (the question, the conversation, the result, and the account identifier). Our program sets no automatic expiry on them, and we have not set a fixed period yet. Saved conversations are kept until you delete them or the account. Deleting a saved conversation does not delete its exchange copy or its job record.
AI use and money records. Monthly use records and transcript download records expire after 400 days. The lifetime record of AI spending, AI credit and purchase records, payment order records, and account spending-operation records have no automatic expiry. Site-wide spending totals do not contain message or document text. Daily site totals and site-operation markers expire after 400 days; monthly site totals have no automatic expiry.
Access requests. Requests to join the alpha and special-access requests expire after 90 days. The special-access list has no automatic expiry.
Shared answers. The log of email addresses typed to send an answer has no automatic expiry.
Feedback reports. Feedback reports, with their screenshots and files, have no automatic expiry. Removing a report in our review tool takes it off the list; its screenshots and earlier versions stay in storage. Account deletion removes the account link, tester label, and saved feedback preferences from current records through a background cleanup. Report text, screenshots, attachments, and earlier stored versions can still contain personal information. This is not full content deletion.
Logs and limits. How long we keep security and operational logs depends on the service. Some logs are deleted automatically after a set period. Others have no automatic expiry yet, and we have not set a fixed period for them. The hourly IP-address counters that limit use expire after about 2 hours.

Other Service records are retained only as reasonably needed to provide and improve the applicable Service, maintain security, resolve support issues, and perform alpha operations.

Completed tutor-disclosure consent and the minimum verification evidence — the method, a KWS transaction identifier or Stripe payment identifier where used, and an approved signed form — remain after a tutor relationship is removed or an account is deleted, until a shorter approved schedule exists. We do not store card numbers.

What account deletion removes

Self-service account or child deletion starts removal of the applicable current records under our control. Some feature cleanup runs in the background and can be retried. After that cleanup succeeds, it removes the applicable current records under our control: the sign-in record, the profile, family and consent records of the account, learning data and settings, lesson and prototype records, the account’s private documents and extracted text with scan records, the account’s agent conversations and attachments, AI-data notice preferences and acknowledgements, the learner files with every earlier version, the Gallery records and pictures of the account, saved QRAG conversations, monthly AI use records, transcript download records, redeemed access-code markers, and pending signed-form uploads. Tutor relationships of the account are revoked.

What account deletion does not remove

Account deletion does not remove:

A marker that the account was deleted, kept so that the account cannot be used again.
AI spending records, AI credit and purchase records, and payment order records. The lifetime record of AI spending stays when a spending record exists; its notice email address is removed.
Copies of QRAG exchanges and answer job records.
The log of email addresses typed to send an answer, and the copies of shared or downloaded answers in our contact mailbox.
An entry on the special-access list, which is kept by email address. Account-specific search counters are removed. Shared and temporary network counters follow their own retention.
Access requests, which are not linked to an account, until they expire.
Feedback reports. Their content and files stay, subject to the limited background removal of account links and labels described above.
Text copied into another account’s agent conversations or separately saved documents.
Logs, until they expire.
The completed tutor-disclosure consent and verification evidence described above.
A Gallery picture that was copied or sent to another account. It stays in that account’s Gallery.
A learner file that a family keeps in its own separate local copy of Math Quiz and has paired with an account. Deletion removes the pairing, not that separate file.
Records in your own browser, such as device-mode practice records and preferences. You clear those in the browser.
Records that are not under our control, such as KWS’s AgeGraph record or other records KWS keeps under its own policy, Stripe’s payment records, and any copy held by an AI provider.

Limited information may remain temporarily in service-provider backups or point-in-time recovery until those provider-managed windows expire. We may also retain narrowly limited legal or security records when reasonably necessary or required by law. Backup and restricted records are not used to continue the deleted account or for marketing.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include managed authentication, access controls, encrypted network connections, storage protections, and logging or monitoring for security events. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security.

8. Your Privacy Rights and Choices

Depending on applicable law, an individual account holder or verified guardian may request access to, correction of, or deletion of personal information; obtain information about our collection and disclosure practices; or withdraw consent. Account and family controls provide self-service access to certain correction and deletion functions.

To make a request that cannot be completed through the account controls, contact us using the information below. This includes a request about records that account deletion does not remove. We handle such a request by hand, and we may not be able to find every record that is not linked to an account. We may verify identity and authority before acting. We will not discriminate against a user for exercising an applicable privacy right.

Requests about KWS’s AgeGraph or KWS’s copy of verification data should be sent to KWS at privacy@kidswebservices.com. We can help identify that path; we cannot delete KWS’s independent records ourselves.

9. United States Processing

The alpha is limited to United States families. Focus on Foundations stores and processes account, family, learning, and consent records in the United States. If information is submitted from outside the United States, it will be transferred to and processed in the United States.

Our hosting provider keeps our sign-in, data, and programs in the United States. Website files are delivered through a content-delivery network that has locations in many countries.

If a guardian uses KWS Parent Verification, KWS and its service providers may process the guardian’s email and verification data in the United Kingdom, the European Union, the United States, and other countries where they operate. If a guardian chooses signed-form verification, OpenAI and its service providers may process the uploaded form and matching consent reference fields in the United States and other locations where they operate.

For AI features, OpenAI, OpenRouter, Anthropic when used, and the companies that run the models process the submitted content where they operate. We do not set or limit that location. Stripe processes payment data where it operates. The outside hosts named in Section 4 receive browser requests where they operate.

10. Third-Party Links

The Services may link to third-party websites or media services, including KWS’s verification pages and email and Stripe’s payment pages. Their privacy practices are governed by their own policies, not this Policy.

11. Changes and Re-consent

Each Policy and Terms document has a date version. We may update this Policy as the alpha and our practices change. We post the revised Policy and update its date. A guardian or individual account holder must accept the new Terms and Privacy Policy versions to keep using the account. Choosing “Decline and sign out” signs you out. We provide additional notice of material changes. The request can appear at the next sign-in or page view, or while you are already signed in. The server blocks new agent and QRAG requests until the required acceptance is recorded. A child account does not complete this acceptance.

We record the accepted document versions and the time of acceptance as Section 2 describes. Earlier versions remain available at Legal versions. Account-holder acceptance does not replace the guardian-consent process for creating a child account. Existing 2026-08-16 child consents remain valid as described in Section 5. The guardian's choice to let the agent use child records remains separate from acceptance of these documents. We request further consent when required by law.

12. Contact Us

For privacy questions or requests, including requests concerning a child account, contact:

Focus on Foundations
Email: contact@focusonfoundations.org

This notice describes current implementation and practices for the alpha. It is not a representation that a lawyer or regulator has approved the Services or this Policy.

Math Quiz on this device