Privacy Policy

What we collect while you study here, who else it reaches, and how to get it back or have it deleted.

Last updated 27 July 2026

The short version

A summary, not a substitute. The numbered sections below are the policy.

We do not sell your data

No advertising networks, no tracking pixels, no third-party analytics. We run no ads, so there is no profile of you to sell.

Your work is read by AI

Tutor chat, teach-back, blurting and written-answer feedback send what you wrote to Google to generate a reply. Section 4 covers exactly what leaves.

Card details never reach us

Payments run through Stripe on their own hosted pages. We store whether you are subscribed, and a Stripe reference. Never a card number.

You can get it back, or get it gone

Ask for a copy of your data, a correction, or permanent deletion. Deletion is handled by a person and cannot be undone.

1Who we are

Sprouting From The STEM is an online learning platform. This policy explains what we collect when you use the website and the student, parent and instructor apps, why we collect it, and what you can ask us to do about it.

It covers our own services only. If you follow a link to somebody else's site, their policy applies there, not this one.

2What we collect

Almost all of it is something you typed, and the rest keeps the lights on.

Your account. Your name, your email address, and a password that is stored hashed, never as text we can read. If you sign in with Google or GitHub instead, we receive your name, email address and profile picture from them, and no password.
Your learning. The courses and lessons you open, the answers you submit, your scores, streaks and study plans, and your language and vocabulary practice.
What you write and upload. Notes, notebooks, mind maps, documents and any files you add to your workspace.
Your conversations with the tutors. Messages you send, the answers you give back when a tutor asks you to explain something, and the feedback it returned.
Billing. Whether you have an active subscription and a reference that identifies you to Stripe. Card numbers are entered on Stripe's own pages and never reach us.
Messages you send us. What you write in the contact form, and the address you ask us to reply to.
Technical records. The ordinary server logs our hosting provider keeps, including browser and device type and IP address, used to keep the service running and secure.

3How we use it

We use what we collect to:

run your account and keep you signed in;
save your progress so it is still there tomorrow;
decide what to show you next, and what to bring back for review;
generate tutoring, feedback and practice material;
take payment and manage subscriptions;
answer you when you contact us;
find bugs, prevent abuse and keep the platform secure.

We do not sell your personal data, we do not share it with advertising networks, and we do not build an advertising profile of you. We run no ads.

4AI features and your work

Tutoring, feedback and practice generation on this platform are produced by an AI model that we do not run ourselves, so using those features means sending your work to somebody else to process. This section is the part of the policy most worth reading.

Which features. Chatting with a tutor, explaining a topic back in your own words, writing out what you remember from memory, getting written answers marked, and generating practice material.

What is sent. The message or answer you submitted, and the lesson or exercise text it relates to, so the reply makes sense in context. It goes to Google's Gemini API, which returns the response you see.

What we do not do. We do not use your work to train AI models, and we do not publish it or show it to other learners. If you would rather a piece of writing were never processed this way, keep it out of the AI features and use your notes instead.

5Who else processes your data

We keep this list short on purpose. These three companies process data on our behalf so the platform can work, and each is bound to use it only for what we ask.

CompanySupabase

What it doesHosting, database, sign-in and file storage

What it receivesYour account and everything saved in it

CompanyGoogle (Gemini API)

What it doesGenerating tutor replies, feedback and practice material

What it receivesThe message or answer you submit, and the lesson text it relates to

CompanyStripe

What it doesSubscriptions, one-off purchases and donations

What it receivesBilling details you enter on Stripe, and your subscription status

6Cookies and local storage

We use cookies to keep you signed in, and for nothing else. There is no cookie banner on this site because there is nothing on it to consent to.

Sign-in. A session cookie set by our authentication provider. Clear it and you are signed out.
Parent preview. A small cookie that remembers when a parent account is viewing the student experience.
On-device storage. Your browser holds preferences, drafts and downloaded course material so the app is usable offline and does not lose your place. That stays on your device and is cleared with your browser data.

There are no advertising cookies and no third-party analytics or tracking scripts.

7How long we keep it

We keep your account and your learning history for as long as your account is open, because that history is the product: progress, streaks and review scheduling all depend on it. When you ask us to delete your account we remove it and the work attached to it. Records we are required to keep for tax and accounting, such as proof of a payment, are kept for as long as the law requires and then deleted.

8Your rights and choices

You can ask us to:

give you a copy of the data we hold about you;
correct anything that is wrong;
delete your account and the work attached to it;
stop sending you email that is not about running your account.

Ask through our contact form and choose General. We may need to check you are who you say you are before we act, which usually means replying from the address on the account. Deletion is permanent and cannot be undone.

If you are in the UK or the European Economic Area, these are your rights under the UK GDPR and the GDPR, including access (Article 15), correction (Article 16) and erasure (Article 17), and you may complain to your national data protection authority. If you are in California, you have the right to know what we collect and to ask us to delete it, and we will not treat you differently for asking.

9Children and school use

The platform is built for grades 6 to 12 and introductory college, so some of the people using it are children. Accounts can be linked to a parent, who can see the learner's progress.

We do not knowingly collect more from a child than the account needs in order to work. If you are a parent or guardian and a child has created an account without your permission, contact us through the contact form and we will remove it.

10How we protect it

Traffic between you and us is encrypted in transit. Access to the database is governed by per-row rules, so an account can only read its own data, and access by our team is limited to the people who need it. Passwords are stored hashed and cannot be read by us or recovered. No online service can promise perfect security, and we will not pretend otherwise, but if a breach affects you we will tell you.

11Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects what we do with your data, we will say so directly rather than relying on you noticing a new date.

12Contact us

Questions about this policy, or about anything we hold on you, go through our contact form. Choose General and a person will read it.

Want your data, or want it gone?

Send the request through the contact form and choose General. Tell us which account it concerns and what you want done with it.

Make a request