Privacy Policy
iLearnSTEM Kids (“we”, “us”) is a learning platform for students in Grades 1–8, their parents and guardians, and their teachers. We respect your privacy and aim to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law. This policy applies to ilearnstemkids.ca and its subdomains.
What we collect
- Account information (the adult account holder). Accounts belong to adults — a parent or guardian, or a teacher — or to a self-learner aged 13 or older. For that account holder we store an email, a password (hashed, never kept in plain text), an optional display name, and their role (guardian, teacher, or self-learner).
- Child profiles. A child does not have an account. The adult creates and controls one or more profiles, and each profile carries only a display name and grade (plus an optional avatar and reading-font choice). Children have no email and no password, and never sign in.
- Learning activity. Practice attempts, quiz scores, skill mastery, and the topics marked as read — attached to the profile so the adult can follow the learner’s progress.
- Security signals. The account holder’s most recent sign-in timestamp and IP address — used to detect suspicious activity. We do not build advertising or behavioural profiles.
What we do not do
- No advertising or behavioural ad networks on the site.
- No third-party comment widgets, chat systems, or social-media embeds that could collect data from children.
- No selling, renting, or trading of personal information.
- No tracking pixels from data brokers.
- No Google Analytics. We deliberately do not use it — it relies on identifiers we consider inappropriate for a service used by children.
Analytics (cookieless, no personal data)
To understand which pages are used — so we can improve the site — we use Plausible, a privacy-first analytics tool.
- What it collects: aggregate, anonymous counts only — roughly how many people viewed a page, and general signals like approximate country and device type derived from the request. Everything is combined into totals; nothing is tied to a person.
- What it never collects: no cookies, no personal information, no child names or account/profile identifiers, no cross-site or cross-device tracking, and no advertising profiles. Before a page view is recorded we remove identifying parts of the web address (for example a student’s id in a dashboard link is replaced with
*), so a child can never be singled out. - No consent banner: we believe no cookie/consent banner is required under GDPR, PIPEDA, or COPPA because nothing personal is collected and no cookies are stored.
How we use information
- To create and secure your account.
- To personalize the dashboard with your progress and a “continue where you left off” link.
- To send the account holder a weekly summary of their learners’ progress by email.
- To detect abuse (rate-limiting registration and sign-in attempts).
Children and parental consent
Children never hold an account, and never have a login, email, or password. A child exists only as a profile that a parent or guardian creates and controls — this is one of our strongest privacy protections, because there is no child credential to lose, guess, or misuse. The responsible adult verifies their own email when they register, and that verification is our record of consent. We do not knowingly collect more information than the learning features above require, and a parent or guardian may review, correct, export, or delete a child’s profile and learning history at any time.
Service providers
We share personal information only with the processors below, each only to the extent needed to run the service:
- MongoDB Atlas — our database; it stores all account and learner data. Hosted in Canadian or US regions; we contractually require equivalent protections wherever data is processed.
- Cloudflare R2 — hosts our lesson videos; receives standard web-request data (IP address, browser type) when a video loads.
- Resend — sends our transactional email to adult account holders only: email verification, password reset, and the weekly progress digest. The digest summarises a child’s learning activity and is sent only to that child’s account holder.
- DeepSeek (our adaptive-reading text generator) — when a reading passage is generated it receives only the target grade / reading level, the chosen topic, and any special or review words. It never receives a child’s name or any account or profile identifier.
- Plausible (hosted at plausible.io, in the EU) — receives the cookieless, scrubbed page-view requests described under Analytics above. No cookies and no personal data.
- Sentry — error monitoring. When an error is reported, cookies, authentication headers, passwords, and guardian emails are automatically removed before the report is sent. Active only when configured (in production); dormant in development.
Your rights
You can request a copy of your information, correct it, or ask us to delete it. We reply within 30 days. Email privacy@ilearnstem.ca.
Retention
We keep accounts and learning history while the account is active. On a deletion request, account records are removed within 30 days; anonymized aggregate statistics may be retained for product analysis.
Updates
We will update this page if our practices change and notify signed-in users by email when material changes are made.