Privacy Policy

Account holders must be at least 18 years old. ArrowPath is designed for parents, guardians, and adult instructors. Children may participate in activities under an adult's supervision, but they may not create accounts, sign in independently, or submit information directly to ArrowPath. The adult account holder supplies and controls every student record.

• Adult account details, including email address, name, authentication, and settings.
• School and student records the adult chooses to enter, such as names, optional legal name and birth date, grade, curriculum, schedules, activities, attendance, progress, assessments, reports, notes, photos, and uploaded evidence.
• Calendar and task information imported after the adult connects Google or Microsoft, plus encrypted connection credentials needed to maintain that connection.
• Book images submitted to the optional AI-assisted curriculum scanner and the extracted curriculum information returned to the adult.
• Narrow product-usage events, error categories, security events, and operational quota records. ArrowPath does not send student names, activity text, curriculum titles, or uploaded files to product analytics.

ArrowPath uses this information to authenticate the adult, provide homeschool planning and recordkeeping, synchronize requested third-party data, generate reports and exports, protect accounts, prevent abuse, diagnose failures, and understand whether core product workflows function. ArrowPath does not sell personal information, run behavioral ads, or create advertising profiles.

Information is processed only as needed through Supabase for authentication, database, file storage, and server functions; Vercel for web hosting; Cloudflare for domain, network, email-routing, and bot-protection services; PostHog for privacy-minimized product analytics; and OpenAI for an adult-requested book scan. If the adult connects or signs in through Google, Microsoft, or another provider displayed by ArrowPath, that provider also processes the information required for the requested connection.

ArrowPath may disclose information when required by law, to protect people or the service, or as part of an operator or ownership transfer with appropriate notice and safeguards. It does not disclose child education records for marketing.

• Account and education records remain until the adult deletes the record or account.
• Provider credentials and imported mirrors remain until disconnect or account deletion.
• Expired OAuth state is removed within 24 hours after expiration. Quota records are kept for no more than their two-day operating window plus 24 hours.
• Security audit events, including pseudonymous deletion receipts, are kept for 24 months.
• ArrowPath targets 12 months for identified PostHog analytics.
• ArrowPath does not retain book-scan images after the request. OpenAI may retain abuse- monitoring data for up to 30 days under its API data controls, unless law requires longer.
• Deleted information may remain temporarily in protected backups and infrastructure logs until those systems complete their normal expiration cycles.

The adult may correct or delete student records in the product, disconnect calendar providers, download a portable ZIP archive from Settings, and permanently delete the account. Account deletion removes active database records, encrypted provider credentials, uploaded files, and the identified analytics profile; a limited pseudonymous security receipt remains for the retention period above. For help exercising these controls, contact the support address above.

ArrowPath uses account-scoped database controls, private file storage, encryption for provider credentials, secure transport, security monitoring, and stronger verification for consequential actions. No internet service can guarantee absolute security. Adults should use a unique password, enable multi-factor authentication, and avoid entering information they do not need for their homeschool records.

ArrowPath is currently offered for United States use and processes information in the United States. The policy and consent model will be reviewed before intentional expansion to other countries or before adding independent child accounts. Material policy changes will receive a new effective date and, when appropriate, an in-product notice.