Legal
Privacy Notice
Last updated May 10, 2026.
We've tried to keep this short. The summary: we collect what we need to teach you, we don't sell or share it for advertising, and you can take a copy of your data or delete it any time.
What we collect
- Account basics: the email, name, and password you provide.
- Profile: country, province, and grade — used to pick your real syllabus.
- Learning activity: topics started, milestones completed, quizzes attempted, homework submitted, and Kelly tutoring transcripts.
- Files you create: documents, sheets, slides, and graph homework stored in Google Cloud Storage on our account.
- Billing: if you subscribe to the Monthly Pass, Stripe handles your card. We see the last 4 digits and the country, nothing more.
- Technical logs: IP address, device type, and timing — used for security and debugging only, retained for 90 days.
What we don't do
- We don't sell your data, ever.
- We don't run ads, third-party analytics with identifiers, or pixel tracking.
- We don't train third-party AI models on your work or your tutoring transcripts.
- We don't share student data with anyone outside KMF except as required to operate the service (Stripe for billing, Google for the Gemini tutor, LiveKit for voice).
Children (COPPA & FERPA)
For users under 13 we require parent or guardian acknowledgement before the account becomes active. Parents can:
- Review what we've collected about their child.
- Refuse further collection.
- Delete the child's account permanently.
To request any of these, email [email protected] from the address on file — or open Account → Privacy & data.
For schools using KMF in a classroom: where applicable we operate as a "school official" under FERPA. We don't use student data for any purpose other than providing the service.
Your rights
Wherever you are, you can:
- Download a copy of everything we hold on you.
- Correct anything that's wrong.
- Delete your account and all related data.
- Object to a specific use of your data.
GDPR (EU/UK) and CCPA (California) residents have additional rights — including the right to a copy of any "sale" of personal information. For us that's easy: we don't sell anything.
Where data lives
Application data is stored in Google Cloud SQL (managed Postgres) and Google Cloud Storage, both operated by us in US and EU regions depending on where you signed up.
Retention
- Active accounts: kept as long as you use the service.
- Inactive accounts: archived after 24 months of no activity, then deleted after a further 12 months unless you sign back in.
- Deletion requests: completed within 30 days; security logs may persist for an additional 90 days.
Cookies
We use a small number of strictly necessary cookies (orlocalStorage entries) to keep you signed in. No advertising cookies, no cross-site tracking. We may add anonymous performance metrics in the future — we'll update this page first.
Contact
Privacy questions go to [email protected]. For everything else, [email protected].
See also: Terms of Service.