Privacy Policy
Effective September 01, 2026
We built SkillFlow for kids, with parents in control. Here's what we collect, why, who sees it, and what you can do about it — in plain language.
Who is responsible for your data
SkillFlow is the data controller for the parent and child data described here.
SkillFlow is operated from Canada.
What we collect
Parents: name, email address, password (stored hashed), language and time zone, and the IP address and browser details of your sessions for security. While SkillFlow is in free early access we do not collect a billing address or any payment details, because there is nothing to pay.
Children: the first name or nickname you choose, username, PIN (stored hashed), grade or age range, the lessons they receive, their answers including handwritten work and drawings, results, progress and achievements.
Technical: server logs, error reports, and your cookie-consent choice.
Why we use it
To provide the service (generate lessons, track progress); to keep accounts secure and prevent abuse; to understand how the site is used (analytics, only with your consent); and to meet legal obligations. While SkillFlow is in free early access we process no payments, so no billing data is involved.
Children's data
Children never create accounts themselves. A parent or guardian creates every child profile and confirms, at that moment, that they consent to us processing the child's learning data. We collect only what the lessons need — no surname, address, school or location.
To generate and review lessons, a child's first name, age range and lesson work (including photos of handwritten answers) are sent to our AI providers listed below. Under our agreements with them this data is used only to produce the lesson or review and not to train their models.
We never show advertising to children, never sell or share children's data for advertising, and never run analytics on children's pages. Parents can view, export or delete a child's data at any time from the app.
We design SkillFlow to meet the US Children's Online Privacy Protection Act (COPPA), Canada's PIPEDA and Québec's Law 25, and the GDPR / UK GDPR rules on children's data. If you believe we hold a child's data without a parent's consent, email us and we will delete it.
How long we keep data
Account and child data stay while your account exists. When you delete a child profile or your account, that data is removed within 30 days and from backups within 90 days. While SkillFlow is in free early access there are no billing records to keep. Server logs are kept for 30 days.
Your rights
You can access, correct, export and delete your data and your children's data yourself from the account page. You can also object to or restrict processing, withdraw consent, and complain to your data-protection authority. Residents of the EU/UK (GDPR), California (CCPA/CPRA), Canada (PIPEDA) and Québec (Law 25) have specific rights under those laws; email us to exercise any of them and we will respond within 30 days.
Security
Data is encrypted in transit, passwords and PINs are hashed, and access to production systems is limited to the operator. We collect no payment details at all while SkillFlow is in free early access.
Changes to this policy
The effective date at the top shows the current version. For material changes we will email you before they take effect.
Contact
Questions? Email support@skillflow.academy.