Version 2026-10-02 · Effective 2026-10-02
LearnPath Privacy Policy
Effective date: October 2, 2026 Version: 2026-10-02
This policy explains what Bluebird Tutor, LLC ("we"), the company behind LearnPath, collects when you use LearnPath (the "Service"), why we collect it, who else touches it, how long we keep it, and what you can ask us to do about it.
We have tried to write this in plain language and to be specific rather than vague. Where we say "we do not," we mean it as a commitment, not a marketing line.
1. The short version
- We collect your name, email, and everything you do in LearnPath as a learner or a teacher.
- We use it to run the Service: to score your work, show your teacher your progress, pick your next question, and give you feedback.
- We do not sell it. We do not use it for advertising. We do not use it to build advertising profiles.
- Six companies process data on our behalf: Supabase, Vercel, OpenAI, Anthropic, Sentry, and Stripe (for teachers' credit purchases and, if offered, independent subscriptions — never for a learner in a class). We name them in Section 5 and say exactly what each one sees.
- A teacher whose class you join can see your work in that class. That is the point of joining. A school can see it only if your account is a School Account (below).
- Other students cannot see your work, with one exception: during a teacher-run live classroom activity, classmates in the same session can see each other's progress and score for that activity. Everything else is enforced at the database level, not just in the interface.
- Your account is yours. You control your record and you come straight to us about it — unless it is a School Account, in which case the school controls the education record and you ask the school first.
Which applies to you
Every LearnPath account is a personal account you own. Joining a teacher's class shares your work with that teacher; it does not change who owns the account. An account is a School Account only if (a) a school or program has signed a written agreement with us covering it, or (b) you are under 18 and were enrolled by a teacher acting for a school. A learner under 18 whose parent or guardian accepted the Terms for them in LearnPath has a personal account, controlled by the learner and that parent or guardian. (Terms of Service, Section 2.)
| Personal account (adults — including adults in a teacher's class — and minors whose parent consented in LearnPath) | School Account | |
|---|---|---|
| Who controls your record | You | The school or program |
| Who to ask about your data | Us directly (Section 11) | The school first (Section 10) |
| FERPA applies | Not through us — no school is a party. If your teacher runs the class for a school or college, that school may still treat the class records as its own under FERPA (Section 10) | Yes |
| Billing information | Only if you buy something yourself — a teacher's credits or, if offered, an independent subscription; handled by Stripe (Section 5.5). Never for a learner in a class, and never from a learner under 18 — a parent or guardian is the buyer | None — the school is billed, if anyone |
2. What we collect
2.1 Information you give us
| What | Where it comes from |
|---|---|
| Name (first, last) | Registration, or your teacher adding you to a class |
| Email address | Registration |
| Password | Registration. We never see it — it is hashed by our authentication provider |
| Role (student / teacher / admin) | Registration or admin assignment |
| School or program name | Optional, on an access request |
| Age confirmation | Whether you are 18 or older, or 13 to 17, when you accept the Terms. We do not ask for your birth date |
| Parent or guardian name and email | Only for learners under 18 — provided by the parent or guardian when they accept the Terms for the learner in LearnPath, or held by the school when the learner is enrolled through a school. Kept only with the acceptance record |
| Billing details | Only if you buy something yourself — a teacher's credits or, if offered, an independent subscription (for a learner under 18, bought by a parent or guardian in their own name). Handled by Stripe — see Section 5.5. We never see or store your full card number |
| Teacher confirmation | For teachers: your confirmation that you will use student information only to teach, and — if you enroll anyone under 18 — that either your school permits the use and holds the required parental consent, or the learner's parent or guardian consented in LearnPath |
We record your age confirmation, not your birth date. For a learner aged 13 to 17 we also record how permission was given — through the school, or by a parent in LearnPath.
2.2 Information created as you use LearnPath
| What | Detail |
|---|---|
| Answers and submissions | Every answer you select, how long you took, whether it was correct, and which version of a question you saw |
| Written responses | Anything you type into a question |
| Photographs of handwritten work | Images you or your teacher upload of work done on paper, plus the AI's reading of them |
| AI tutor conversations | The full text of your messages to the AI tutor and its replies |
| Progress and mastery records | Per-topic and per-skill mastery, streaks, badges, vocabulary review schedules |
| Diagnostic and placement results | Placement test results, estimated ability, estimated NRS level and projections |
| Externally administered scores | TABE or CASAS results, when your teacher enters them |
| Class and enrollment records | Which classes you are in, when you joined, teacher-set display name |
| Live session activity | Your responses during a teacher-run live classroom session |
2.3 Information collected automatically
- Sign-in timestamps and session information.
- Technical logs needed to operate and secure the Service, including IP address and browser type, and error reports.
- An audit log of sign-ins and of certain sensitive actions — for example acceptance of the Terms, moves between classes, and account status changes — recording who did it and when. It does not record every time a record is viewed, and not every change is logged yet.
- IP-based rate-limit counters, used to stop abuse. These hold an IP address and a count.
2.4 What we do not collect
We do not collect or ask for: Social Security numbers, fingerprints, face or voice scans, precise geolocation, immigration status, health records, or advertising identifiers. We do not use third-party advertising trackers or social media pixels. Photographs of handwritten work are images of the work itself; because FERPA's definitions treat handwriting as a biometric record, for School Accounts we handle those images as education records.
We never collect payment details from a learner who joined through a teacher — that use of LearnPath is free, so there is nothing to bill. Payment details are collected only from teachers buying credits and, if offered, from adults who subscribe for themselves or for a learner under 18, and they go directly to Stripe (Section 5.5); we never see or store a full card number.
If you type sensitive information into the AI tutor anyway, our system redacts a few common patterns before AI processing (Section 5.3) — but not names or most other details — so please do not do it.
3. Why we use it
We use your information only to:
- Create and secure your account, and keep other people out of it.
- Run the learning engine — choose your next question, estimate what you have mastered, schedule vocabulary review, and set difficulty.
- Show your teacher your work and progress, which is the core purpose of the Service.
- Give you feedback, including AI-generated explanations and readings of your handwritten work.
- Operate, debug, and improve LearnPath. This includes calibrating questions and the adaptive engine from how learners answer them, within our own systems, and keeping a record of how teachers correct AI-suggested figure crops so that detection improves.
- Meet legal and institutional obligations, including FERPA record-keeping.
For K-12 students we use information only for K-12 school purposes (N.C.G.S. § 115C-401.2), and any successor that acquires LearnPath remains bound by this policy for that information.
We do not use your information to advertise to you, to profile you commercially, to sell to data brokers, or for any purpose unrelated to your education.
4. Who can see your information
| Who | What they can see |
|---|---|
| You | Your own work, progress, and account |
| A teacher whose class you joined | Everything you do in that class: answers, scores, progress, scanned work, and AI tutor conversations tied to that class, plus the record of your acceptance of the Terms (including a parent's name and email, if a parent accepted for you). Nothing from other classes or from your independent practice |
| Your school or program | Only if your account is a School Account — then whatever its staff are authorized to see, as the institution decides. Otherwise nothing |
| Other students | Nothing — except that during a live classroom activity, classmates in the same session can see each other's progress and score for that activity |
| A parent or guardian | For learners under 18: through the school if the learner was enrolled through a school; by contacting us, if they are the parent who accepted the Terms for the learner in LearnPath. There is no separate parent login |
| LearnPath staff | Only as needed to operate and support the Service |
| Our subprocessors | Only as described in Section 5 |
Beyond the people above and the subprocessors in Section 5, we disclose information only if the law requires it, if it is needed to protect someone's safety (for School Accounts, as the school directs or as FERPA's health-and-safety emergency rule, 34 CFR § 99.36, permits), if a school directs us to for its School Accounts, or to a successor if LearnPath is acquired (Terms, Section 20). If we are legally compelled to disclose School Account records, we tell the school first unless the law prohibits it, and we keep a record of the disclosure for the school.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
5. Companies that process data for us
These are our subprocessors. Each is bound by a contract limiting them to processing data only to provide their service to us, not to disclose it further, and to protect it with reasonable security. AI providers may hold inputs briefly for abuse monitoring under their terms (Section 5.3).
5.1 Supabase — database, authentication, and file storage
Stores essentially everything: accounts, work, progress, uploaded images. Data is held in the United States.
5.2 Vercel — application hosting
Serves the application and processes requests in transit. Holds operational logs, including IP addresses.
5.3 OpenAI and Anthropic — AI features
Used for the AI tutor, feedback, analysis narratives, and question and passage generation.
What is and is not removed before sending:
- We do not attach your name, email address, or account ID to AI requests.
- In text you type to the AI tutor, email addresses, phone numbers, and Social Security number patterns are automatically redacted, including when earlier messages are sent back as context for the next reply. Names and other details you type are not removed.
- Photographs of paper work are sent as they are, including anything written on them. When a teacher scans a stack of answer sheets, the AI reads the names on them to match sheets to students.
The substance of your work is always sent — the sentence you wrote, the question you asked, the image of your handwriting. That is necessary for the feature to function.
We use these providers' business APIs, under terms that do not permit them to train their models on our data. Providers may retain data briefly for abuse monitoring under their own policies.
If you do not want AI processing, tell your teacher before you start. We maintain a platform-wide switch that turns AI features off for everyone. A per-class or per-student switch is not yet available — a school that needs AI off for particular students should raise it with us before those students are enrolled.
5.4 Sentry — error monitoring
We use Sentry to detect failures. It may capture technical context about a failed request, which can include a user identifier.
5.5 Stripe — payment processing
If you buy something — a teacher's credits, or an independent subscription if offered (for a learner under 18, bought by a parent or guardian) — Stripe processes the payment. Your card details go directly to Stripe and are never stored on our systems — we keep only a customer reference, your purchase or subscription status, and the billing email.
Stripe is not involved at all for learners who joined through a teacher, because that use is free.
6. Where data is held
All of it in the United States.
7. How long we keep it
| Data | Retention |
|---|---|
| Account record | While the account is active |
| Student work, responses, progress | While the account is active, then per Section 7.1 |
| Photographs of handwritten work | While the account is active, or until the teacher deletes them |
| AI tutor conversations | 24 months, then deleted |
| Audit log | 5 years, for accountability |
| Records of accepting the Terms (including a parent's name and email) | 4 years after the account closes, as evidence of the agreement |
| Technical and error logs | 90 days |
| Rate-limit counters | 30 days |
| Access requests that were denied | 12 months |
Automated deletion for the AI-conversation and technical-log periods is being built. Until it ships, we delete those records on request; no AI tutor conversation on LearnPath is yet older than 24 months.
7.1 When an account or a school relationship ends
- You ask us to delete your account: we delete or irreversibly anonymize your personal information within 30 days, except the records this Section says we keep longer (acceptance records and the audit log), records a school must retain, and anything the law requires us to keep. Deleted data may remain in encrypted backups for up to 30 days before it is overwritten.
- A school stops using LearnPath, or asks for its data back: on the school's written request or notice that services are complete, we export its School Account data in a format it reasonably specifies and then delete it — within 45 days for a K-12 school (N.C.G.S. § 115C-401.2), and otherwise within 90 days — certifying the deletion in writing within 30 days after it is done.
- We keep de-identified information — such as how difficult a question turned out to be across all learners — indefinitely. It is stripped of identifiers so that it cannot reasonably be linked to you (for School Accounts, as 34 CFR § 99.31(b) requires).
8. How we protect it
- Encryption in transit (HTTPS) and at rest.
- Row-level security in the database, so a learner's account cannot read another learner's records even if the interface were bypassed — the one exception is progress and score within a live classroom activity, which classmates in that session can see. Learners have no direct database read access to question content or answer keys.
- Role-based access control, separating student, teacher, and administrator.
- An audit log of sign-ins and certain sensitive actions (Section 2.3).
- No account identifiers attached to AI requests, and redaction of email, phone, and Social Security number patterns in tutor text before AI processing (Section 5.3).
No system is perfectly secure. If a security incident affects your personal information, we will notify affected users and any school whose School Accounts are affected without undue delay — for schools, within 72 hours of learning of it, or sooner where our agreement with the school requires — and as the law requires.
9. Students under 18
- LearnPath is for ages 13 and up. We do not knowingly collect information from anyone under 13, and teachers may not enroll a learner under 13. If a user tells us they are under 13, or we otherwise learn it, we suspend the account immediately and delete its information within 7 days (for a School Account, after telling the school). LearnPath is not directed to children under 13 and we do not knowingly collect their information; if we learn that we have, we delete it, as the Children's Online Privacy Protection Act (COPPA) requires.
- A learner aged 13 to 17 can use LearnPath in one of two ways. Through a school: the school obtains parent or guardian consent before the account is used; the learner confirms at sign-in that it is in place, the teacher attests to it, and the signed consent form stays with the school. With a parent's consent in LearnPath — for a learner on their own, with a tutor, or in a class not run for a school: a parent or guardian gives their name and email and accepts the Terms on the learner's behalf; we keep that record with the acceptance and may contact the parent to confirm it. In both cases we record the confirmation and rely on it — we do not independently verify it. The learner reads a plain-language summary ("LearnPath: What You Should Know") rather than a contract.
- A learner under 18 is never charged. Paid independent access, if offered, is bought by a parent or guardian in their own name; otherwise minors reach LearnPath through a teacher's class, which is free to them.
- A parent or guardian may ask to review, correct, or delete their child's information: through the school if the learner was enrolled through a school, or by contacting us (Section 11) if they are the parent who accepted the Terms for the learner in LearnPath. At a college or adult-education program, FERPA rights belong to the student at any age, so the program decides under its own policy how a parent's request is handled.
- We never use a learner's information for advertising or to build a commercial profile, at any age.
10. FERPA and your school
Through us, FERPA applies only to School Accounts — accounts covered by a school's signed agreement with us, or accounts of learners under 18 enrolled by a teacher acting for a school. If your account is a personal account, no school is a party to your relationship with us, and you deal with us directly under Section 11. Whether a school treats the records of a class its teacher runs as the school's own education records is that school's decision under FERPA, not ours. If it does, we honor the commitments in Section 11 of the Terms toward that school for those records; that does not change who controls your personal account.
For School Accounts, the school controls the education records. Where it treats us as a school official with a legitimate educational interest (34 CFR § 99.31(a)(1)), we meet the obligations that status carries and remain under the school's direct control for those records. In every case we make the commitments below, and the school may enforce them.
Our commitments to the school are the ones the school-official exception requires: we use the records only for the school's purpose; we never use them for advertising, never sell them, and do not redisclose them except as 34 CFR § 99.33 permits; our subprocessors — including the AI providers in Section 5.3 — are bound to use them only on our instructions; and the school can direct their correction, return, or deletion at any time. Whether a school treats a tool its teachers adopt as its school official is decided by the school's own policies and annual FERPA notice. Districts that want a written agreement, including the North Carolina Department of Public Instruction Data Confidentiality and Security Agreement or a National Data Privacy Agreement, should contact us at info@bluebirdtutor.com. We are prepared to sign the NCDPI agreement or an NDPA, and we will review a district's own agreement in good faith.
Practically: if your account is a School Account, send requests about your record to the school first. They have the authority; we support them.
11. Your rights
Whoever you are, you may ask us to:
- See the personal information we hold about you;
- Correct anything inaccurate;
- Export your data in a portable format;
- Delete your account and personal information;
- Stop AI processing of your work — today this means not using the AI tutor and your teacher not scanning your paper work; AI cannot yet be turned off for one person (Section 5.3).
Where to send the request depends on how you joined:
- If your account is a personal account — every adult, including an adult in a teacher's class — email us directly at info@bluebirdtutor.com. There is no school in the middle; we act on your request ourselves. If you want a teacher to stop seeing new work, leave the class — ask your teacher or email us; there is no leave button yet.
- If your account is a School Account, send the request to that school or program first. It controls the education record and has the authority to decide — including whether the account can be closed or the record deleted; we will support it in responding. You may still email us and we will refer the request to the school and help you reach the right person.
We respond within 30 days and may need to verify your identity first.
Residents of states with comprehensive privacy laws may have additional rights, including the right not to be discriminated against for exercising them. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of on that front.
12. Cookies
We use only what is necessary to run the Service: a session cookie to keep you signed in, and local browser storage for interface preferences such as which tab you last had open. No advertising cookies, no third-party trackers, no analytics that follow you to other sites.
13. Changes to this policy
We may update this policy. Every version carries a version identifier and effective date. When we make a material change we will ask you to review it the next time you sign in, and tell you what changed. Past versions are available on request.
14. Contact
Bluebird Tutor, LLC Email: info@bluebirdtutor.com
Privacy questions, data requests, and concerns: info@bluebirdtutor.com
Questions about these documents? Ask your teacher, or contact us using the address at the end of the policy.