Privacy Policy

Last updated: August 23, 2026 · Effective: August 23, 2026

The short version

We collect only what the account needs: your email, name, birth date, a few favorites, and your learning progress.
We do not sell personal information — ever — and we never sell or share children's data for advertising. There are no third-party advertising or tracking cookies.
We use a small number of trusted service providers (hosting, email, and the AI tutor) purely to run LoomLearn.
The optional AI tutor never trains on a child's conversations, and is never used to profile or advertise to them (see §6).
Children under 13 sign up only with verifiable parental consent, or through a school that consents on parents' behalf for educational use.
You (or a parent, or a school) can review, export, or delete the account's data at any time.

LoomLearn ("LoomLearn," "we," "us") is a free suite of educational games tied together by a single learning account, operated by Riverside Digital Studio LLC, California, USA. This policy explains what we collect, why, who we share it with, and the choices you have. It covers loomlearn.com and the connected games ("Threads") that read your LoomLearn profile.

What we collect · How we use it · Who we share with · Children (COPPA) · Schools (FERPA) · The AI tutor · Cookies · Your rights · Retention · Security · Contact

1. What we collect

We collect only the information below. We do not collect a physical address, phone number, or payment information for a personal account, and we do not buy personal data from other sources.

Category	Details
Account	Email address, a password (stored only as a salted hash — we never see it), your name, date of birth, and a few "favorites" you choose (a favorite science, book, and pie) used to personalize games and help recover your account.
Account type	Whether you are an individual, a parent, a student, a teacher, or a school administrator, and — for school accounts — which institution and class you belong to.
Learning activity	Your progress, levels, and scores in each game, so your learning follows you across Threads and (for school accounts) so a teacher can see how you're doing.
AI tutor messages	If you chat with a game's built-in tutor, the messages you send and receive to generate a reply — plus a first name and approximate age to set the tone. These are never used to train AI models (see §6).
Security & technical	Sign-in sessions and, if you enable it, two-factor codes; and basic technical data needed to keep accounts secure — the approximate IP address and browser type of a sign-in, and a bot-check when you register.

2. How we use it

To create and secure your account and sign you in across every game.
To save and carry your learning progress between games so you're never asked to start over.
To personalize lessons (for example, using a favorite subject to pick a good starting point).
For school accounts, to show a teacher or administrator the progress of students in their own class.
To send you account emails you need (a sign-in code, verification, or an account notice). We do not send marketing email to children, and we don't send it to anyone without a clear way to opt out.
To keep LoomLearn safe and working (preventing abuse, fixing problems).

We do not use personal information to serve advertising, and we do not build advertising profiles.

We share personal information only with a short list of service providers that process it on our behalf, under contract, solely to run LoomLearn — never to sell it or to advertise:

Cloudflare, Inc. — website hosting, our database, and the sign-up bot-check.
Resend — sending account emails (like your sign-in code).
Anthropic, PBC — powering the optional in-game AI tutor; conversations are not used to train its models (see §6).

We may also disclose information if required by law, or to protect the rights and safety of our users. If LoomLearn is ever involved in a merger or acquisition, we will honor the commitments in this policy and give notice before any transfer of personal information.

We do not sell personal information, and we do not share it with data brokers.

4. Children's privacy (COPPA)

LoomLearn is designed for learners of all ages, including children. We take the Children's Online Privacy Protection Act (COPPA) seriously.

We collect the minimum needed to run the learning account, and we never condition a child's participation on disclosing more than is reasonably necessary.
Under-13 accounts require verifiable parental consent, or are created through a school that provides consent on parents' behalf for educational use (see §5). When a parent consents directly, we ask for a parent's email and confirmation before the child's account is activated, and we record that consent.
No behavioral advertising, ever — we do not use children's data for advertising, profiling, or third-party marketing, and we do not enable third-party trackers.
Parents are in control. A parent may review the personal information we have about their child, ask us to delete it, and refuse to allow further collection at any time by contacting us at [email protected] or using the tools in the account.

5. Schools & student data (FERPA and the COPPA school-consent exception)

When a school, district, or teacher uses LoomLearn with students, the school directs how student data is used, and we act as its service provider — a "school official" with a legitimate educational interest under FERPA. In that setting:

School consent, with parent notice. The school provides consent for the educational use of the service on parents' behalf, under COPPA's school-consent exception. We rely on this only for the school's authorized educational purpose, and we ask the school to give parents notice as COPPA requires. The school receives the same description of our data practices that a parent would.
Educational purpose only. We use student personal information only to provide the service to that school. We do not use it for any commercial purpose beyond operating LoomLearn — no advertising, no profiling, no selling, and no training of AI models (see §6).
The school stays in control. Student records belong to the school. On parents' behalf, a school may review, correct, export, or delete its students' data at any time — through the school administrator tools we provide, or by contacting us at [email protected]. We will delete student data on the school's instruction or at the end of our relationship.
Written agreement, on your paper or ours. We enter into a written data-privacy agreement with each institution before student accounts are used in a classroom. We will review and sign your state's or district's standard student data privacy agreement (for example, California's Student Data Privacy Agreement, or the National Data Privacy Agreement / NDPA), and we can also provide our own data-processing addendum on request.

6. The in-game AI tutor

Some games include an optional AI tutor — for example, a friendly mascot that answers questions, or an AI recreation of a historical figure. It is powered by Anthropic, PBC. Because this means a child's messages reach an AI system, and we know that is exactly where a parent or school looks hardest, we spell out precisely how it works:

What is sent to the AI provider. Only the text of the tutor conversation (the messages the learner types and the tutor's replies), together with the learner's first name and an approximate age, so the tutor can match its tone and vocabulary. We do not send the learner's email address, date of birth, password, account identifier, or the "favorites" on the account.
It is never used to train an AI model. Under Anthropic's commercial terms, these conversations are not used to train Anthropic's models — and they are not used to train any model of ours (we do not build any). If the honest question is "does any of my child's data train an AI?", the answer is no.
It is not used to profile, target, or advertise to the child. There is no advertising anywhere in LoomLearn, and tutor conversations are never used to build a profile of a learner or to market to them.
How long it is kept. LoomLearn does not store the content of tutor conversations after the reply is generated. Anthropic processes the messages only to produce that reply and to guard against misuse under its commercial terms, and then handles them under those terms; it does not use them to train its models.
The tutor is built to protect children. It is instructed to keep everything age-appropriate and to never ask a child for personal information (such as a last name, address, school, phone number, or password), and to steer back to the lesson if a conversation turns personal or off-topic.
It is optional. Every game works fully without the tutor; a learner, parent, or school can simply not use it.

7. Cookies

We use only a small number of strictly necessary cookies to keep you signed in and to remember a trusted device — there are no advertising or cross-site tracking cookies. Because these cookies are essential to signing in, disabling them will prevent the account from working.

8. Your rights & choices

You — or a parent or school on a child's behalf — can:

Review the personal information in an account (from the profile and settings pages).
Export a copy of the account's data.
Delete the account and its personal information.
Correct information that's wrong, or ask us to stop collecting more.

You can do the first three from account settings, or contact us and we'll help. Depending on where you live, you may have additional rights (for example under the CCPA/CPRA in California); we honor those requests and never charge for them or retaliate for making one.

9. How long we keep it

We keep account information for as long as the account is active, so a learner's progress is there when they return. You, a parent, or a school can delete it at any time. Specifically:

Short-lived security items expire on their own: a one-time sign-in code after 10 minutes; an email-verification link after 24 hours; a parental-consent link after 14 days; a signed-in session after 14 days; and a "remember this device" token after 30 days.
An account that is never approved is discarded: if an under-13 account is created but a parent never approves it, it stays locked and is removed once the 14-day consent link expires (or immediately if a parent declines).
When an account is deleted — by you, a parent, or a school — we remove its personal information from our live systems immediately, and it ages out of routine encrypted backups within 30 days.
Tutor conversations are not retained by LoomLearn after the reply is generated (see §6).
School data is deleted on the school's instruction or at the end of our relationship with the school.

We keep only a minimal record beyond this where the law requires it — for example, to meet a legal obligation or resolve a dispute.

10. How we protect it

Passwords are stored only as salted hashes; optional two-factor secrets are encrypted at rest; sign-in uses secure, http-only session cookies; and all traffic is encrypted in transit (HTTPS). No system is perfectly secure, but we work to protect your information and to limit what we collect in the first place.

11. Changes to this policy

If we make a material change, we'll update the date above and, where appropriate, give notice in the app or by email. For any new use of a child's personal information, we will obtain fresh parental (or school) consent as required.

12. Contact us

Questions, or a request to review or delete a child's information? Email [email protected]. We are Riverside Digital Studio LLC, California, USA, operator of LoomLearn.