# Privacy Notice — Parent University

**Policy version: `privacy-notice-v1.0`** · Effective 2026-08-04

> **Status: final English text, awaiting translation.** Every fact is filled in.
> The text below is what a parent agrees to at signup, and the version string
> above is written into the consent ledger as proof of it, so this text is now
> frozen: a change of any kind — including a typo fix or a new contact address —
> means publishing `privacy-notice-v1.1`, not editing this file.
>
> **Remaining before V1-B launch:** human-reviewed translations in the other five
> launch languages, published together as this same version; and a stable public
> URL once a website exists (until then this file's git history is the immutable
> archive).
>
> **Scope:** this version describes the V1-B web product — account, children,
> timeline, checklists, reminders. It does **not** describe the chatbot or
> WhatsApp, because neither exists yet. Those ship at V1-C and need
> `privacy-notice-v1.1`, published before the first message is sent.

---

Parent University helps you understand and keep track of your child's school
years. To do that, we keep a small amount of information about your family. This
notice explains exactly what we keep, why, and what we will never ask you for.

We do not sell your information. We do not use it for advertising. We do not
allow advertising trackers in the app.

## What we ask you for

**About you**

- Your name, or whatever you would like us to call you.
- One way to reach you — an email address or a phone number. We use it to sign
  you in and, if you turn them on, to send reminders.
- The language you would like to use.
- Your time zone, so a reminder arrives in your morning and not in the middle of
  your night.

**About each child you add**

- Their name or nickname.
- Their grade this school year. We ask you to confirm it each new school year
  rather than moving them up automatically.
- Your state, and your school district or program site if you know it. This is
  how we show you dates and steps that are true where you live.
- Optional, and only if you want them: their school, what they are thinking
  about after high school, dates you want to remember, and which checklist steps
  you have finished.
- Optional: a single yes/no marker that your child has a learning difference or
  an IEP. If you turn it on, we store it scrambled, we never ask what the IEP
  says, and we never include it in our usage statistics.

**If a partner organization invited you,** we keep a code for that site — the
same code for every family invited there. It is not a code that identifies you.

Notifications and WhatsApp messages are off until you turn them on, and you can
turn them off at any time.

## What we will never ask you for

We do not ask for, and do not want:

- your child's date of birth
- Social Security numbers or any government ID number
- your income, or proof of it
- anything about immigration status
- housing or foster-care records
- health or developmental records, or the contents of an IEP
- pregnancy information
- photos or recordings of your child
- copies of your documents
- what happened after we pointed you somewhere

No screen, form, or message in Parent University asks for these. If you start to
tell us one of them anyway, we will say you do not need to share it here and
point you to someone who can actually help with it.

## Why we keep what we keep

Everything above has one job: to show you the right steps, dates, and contacts
for your child, in your language, where you live. We do not build profiles of
your family, and we do not analyze one family's information to serve another.

## How we measure whether the product works

We count a small number of events — finishing setup, opening the timeline,
finishing a checklist step, tapping through to a partner's contact, and asking a
question we have already answered. These counts are tied to an anonymous family
number, never to your name. They contain no text you have written and no
information about your child.

## Who else sees it

- The companies that run our database and send our sign-in codes and reminders,
  only so that those things work.
- A partner organization sees how many families at their site are using the
  product. They do not see your family's information.

That is the whole list. We do not share your information with anyone else unless
the law requires it, and we do not sell it, ever.

Your information is stored in the United States.

## On your device

So the app works when your connection does not, it keeps a copy of your family's
timeline and checklists on your phone or computer. Nothing from the list we say
we never collect is stored there either. Signing out or removing the app removes
that copy.

## Seeing, exporting, and deleting your information

You can see everything we hold about your family in the app, download a copy of
it, and delete it.

When you delete your account, we delete your family's information right away,
and your sign-in account within 30 days. Because deleting is permanent, we send
a one-time code to confirm it is really you first.

**One record survives.** We keep a record that someone consented on a date, and
later withdrew or deleted — which version of this notice, which channel, and
when. That record does not contain your name, your contact, or anything about
your children, and it cannot be traced back to you. We keep it because we may
have to prove that consent was properly obtained. We keep it for three years
from the date of the event, and then delete it.

## Children

Parent University is for parents and guardians. Children do not have accounts
and cannot sign in. Everything we know about your child is what you chose to
type, and it never includes their date of birth or any school record.

We are not your child's school, and we do not receive anything from your child's
school. Nothing you enter here goes to them, and nothing from their file comes
to us.

## Keeping your account safe

We do not use passwords. We send a one-time code to your email or phone each
time you sign in. If you lose access to every contact on your account, we cannot
recover it for you — we have no way to confirm who you are, and we would rather
tell you that plainly than let someone talk their way into your family's
account.

## What we are not

Parent University explains, prepares, reminds, and points you to people. It does
not decide whether you qualify for anything, does not check that your documents
are complete, does not submit anything for you, and does not give legal, tax,
immigration, or financial advice.

## When this notice changes

If we change what we collect or what we do with it, we publish a new version and
ask you to agree to it. Older versions stay available so you can see what you
agreed to and when.

## Questions

Email us at AllenSpringer@Pandotic.ai.

Parent University is a product of Pandotic AI, 564 Ridgewood Ave, Mill Valley,
CA 94941, United States.

---

## Notes for the team — not part of the published notice

**The version string is `privacy-notice-v1.0`.** It matches this document's own
version. Rules that make it trustworthy as legal proof:

1. **Published text is immutable.** Once a version is seeded and a single parent
   has consented, the text of that version is never edited — not for a typo. A
   change means `v1.1`. The ledger's `policy_version` is only proof if the text
   it names cannot move underneath it.
2. **All six languages are one version.** The English text and its five
   human-reviewed translations are published together as `privacy-notice-v1.0`.
   A parent consenting in Bengali consented to `privacy-notice-v1.0`; we must be
   able to produce the Bengali text of that version years later.
3. **One active policy per channel.** `signup` is the only channel at V1-B.
   `whatsapp` and `push` policies arrive with those channels and are separate
   rows with their own version strings.
4. **Never delete a policy row.** Superseded versions go `active = false` and
   stay. The consent ledger has a foreign key to `policy_version`, and no role
   holds DELETE on the table, so this is enforced, not just intended.

**Two consequences of immutability worth knowing now.**

- *The contact address is frozen into the text.* `AllenSpringer@Pandotic.ai`
  works today, but the day it stops being the right inbox, changing it costs a
  version bump. A `privacy@pandotic.ai` alias forwarding to the same inbox would
  behave identically now and never need one. Nothing is published yet, so this
  is still a free change.
- *The entity name must be the registered one.* If the entity that actually
  signs contracts is, say, "Pandotic, Inc." doing business as Pandotic AI, the
  notice should name it that way — the controller's legal identity is the one
  thing in here a regulator checks first.

**Retention — the database keeps these promises, as of
`20260804210000_retention_and_purge.sql`.** Three years on the consent ledger,
stamped per row by a trigger and purged daily. "One record survives" is enforced
too: the auth outbox drops completed jobs at 30 days, deletion requests at 90,
and the audit log's `actor_user_id` is nulled at 30 days on deletion rows, so
after the longest window the only trace of a deleted family is the pseudonymous
ledger row this notice describes. Windows and rationale: `supabase/README.md`.

**Seeding it.**

```sql
insert into private.consent_policies (policy_version, channel, active, effective_at)
values ('privacy-notice-v1.0', 'signup', true, '2026-08-04T00:00:00Z');
```

**Superseding it later.** One transaction — a partial unique index allows only
one active row per channel, so inserting the new version before deactivating the
old one fails:

```sql
begin;
update private.consent_policies set active = false
 where channel = 'signup' and active;
insert into private.consent_policies (policy_version, channel, active, effective_at)
values ('privacy-notice-v1.1', 'signup', true, now());
commit;
```