Skip to main content
Homeschool Harbor

Legal

Privacy Policy

Last updated: October 12, 2026

Homeschool Harbor holds information about families and children, so we take privacy seriously. This policy explains what we collect and why, who can see it, how long we keep it, and your choices. We never sell personal information, never show ads, and never use family data for marketing.

"Homeschool Harbor", "we", and "us" mean Homeschool Harbor, LLC, 8401 Mayland Dr Ste S, Richmond, VA 23294, USA.

Two kinds of information, two roles

Information your co-op keeps about you. Homeschool Harbor is used by homeschool co-ops and groups ("Organizations"). When you apply to or belong to an Organization, the Organization decides what to collect about your family and how to use it; we store and process it for them. For that information the Organization is in charge (the "controller" or "business"), and we act on its instructions (as its "processor" or "service provider"). If you have questions about it, or want to see, correct, or delete it, please contact your Organization first. Its administrators have the tools to do this, and we help them when asked. If you can't reach your Organization, email us and we'll pass your request on.

Information we collect for ourselves. This covers people who visit homeschoolharbor.org, sign up an Organization, or manage an Organization's subscription. For this information, Homeschool Harbor is in charge.

Both kinds are described below.

What we collect and why

Family and member information (held for your Organization)

Depending on what your Organization uses, this can include:

  • Adults: name, email, phone number, date of birth, pronouns, photo, relationship to the children, and roles in the co-op.
  • Children: name, date of birth, grade, photo, and, if the family provides them, allergies or medical notes, learning differences, and accommodations.
  • Family: family name, general area, homeschool approach, interests, social media links, emergency contacts, and whether the family shares its details in the member directory.
  • Membership applications: the information above plus answers to the Organization's own application questions.
  • Co-op activity: class enrollments, attendance, teachers' notes about a student, volunteering sign-ups and hours, event RSVPs, and notes administrators keep.
  • Payments to your Organization: invoices and payment records. Card and bank details are entered directly with Stripe, go to the Organization's own Stripe account, and never reach our servers.

Who can see it. Your Organization controls this with roles and permissions. In general: the Organization's administrators, according to the permissions they're given; a child's teachers see that child's roster details, including allergy and medical notes, so they can keep the child safe; emergency contacts are visible to whoever the Organization's setting allows (administrators, teachers, or all adult members); and otherwise other member families see only what your family chooses to share in the member directory.

Your Organization's public website. An Organization can also publish pages on a public website, for example "Meet our teachers" (names and photos of instructors), testimonials (a quote with the author's name and role), announcements, photos, downloadable files, and a class schedule or upcoming events. Homeschool Harbor never publishes member information there on its own: only what the Organization puts on its pages and widgets appears, and anything on a public page is public. The Organization decides what to publish and is responsible for having the permission it needs (our Terms say so). The member directory, notes, medical and learning information, emergency contacts, and payment records are never part of the public website.

Viewing as a member. An administrator with the "impersonate members" permission can view the site as a member to help with a problem. Every time this happens it is recorded and visible to the Organization's administrators, and any change made during it is recorded under the administrator's own name, not the member's. Administrators can't view the site as another administrator.

Children

Homeschool Harbor is used by adults to organize children's education: Organization administrators, instructors, and parents and guardians. Children under 13 never have their own login. We collect information about a child only from their parent or guardian or from the Organization they belong to, never from the child, and it is entered and managed by them. Teens 13 to 17 may be given a login by their Organization, which should do so only with a parent or guardian's agreement.

What we hold about a child, for the child's Organization: their name, date of birth, grade, and photo; allergies or medical notes, learning differences, and accommodations, if the family provides them; and their class enrollments, attendance, and teachers' notes (the full list is above). The Organization uses it to run classes and keep children safe. We use it only to provide the Services to that Organization: never for advertising, profiling, or any other purpose. Organizations must have any permission the law requires from a child's parent or guardian before including them; our Terms say so.

A parent or guardian's choices. You decide what to share with your Organization. At any time you can ask it to show you, correct, or erase your child's information (see "When a family's information is erased" below). Its administrators have the tools to do this, and we help them. If you can't reach your Organization, email privacy@homeschoolharbor.org and we'll pass your request on.

We don't knowingly collect information directly from children under 13; if we learn that we have, we'll delete it.

Organization account and billing (held by us)

When someone signs up an Organization, we ask for their name, email address, the Organization's name, and the site address they want. We use this to set up the site and to send essential account emails (verification, welcome, setup reminders, billing notices).

We may also send product updates to an Organization's administrators; each has an unsubscribe link. Families never receive marketing from Homeschool Harbor.

Subscription payments are handled by Stripe. We store the number of families billed, billing status, and a record of payments, but not card numbers. We also keep a record of which version of the Terms each Organization accepted, when, and which administrator accepted them, for as long as the Organization has an account. A family that applies is also asked to agree to these terms, and the version and time are kept with the application.

Website visits and security

  • Cookies. We use only the cookies the site needs to work: a session cookie that keeps you signed in, a security (CSRF) cookie, and a short-lived cookie that carries on-screen notices such as "Saved". We don't use advertising or analytics cookies, and no third-party scripts track you on our sites. Fonts and scripts are served from our own servers.
  • Your browser. We keep a few things in your own browser, not on our servers until you submit them. An unfinished membership application or class proposal is saved there so you can come back to it; drafts are discarded after 7 days, when you submit, or when you clear them. For an administrator, whether the theme editor is open is remembered for the browser session. We don't use this storage to track you.
  • Server logs. Our servers log requests (such as the page address, time, and browser) and errors to keep the Services running and secure. These logs are deleted after 30 days.
  • Error reports. When something breaks, an error report goes to our error-monitoring provider. Reports include technical details and an internal user number. Before a report leaves our servers we remove contact details, birthdays, addresses, photos, notes, and sensitive fields such as medical notes; a report can still include a person's name.

Correspondence

When you email us, we keep the conversation so we can refer back to it if you contact us again.

De-identified statistics

We use aggregate numbers that don't identify anyone, such as how many families an Organization has or which features are used, to run, price, and improve the Services.

When we access or share information

  • Service providers. We use a few trusted providers to run the Services, such as hosting and email delivery. They may process personal information only on our instructions. The full list is on our Subprocessors page.
  • Your Organization's own Stripe account. Payments to your Organization are handled by Stripe under the Organization's own agreement with Stripe.
  • People at Homeschool Harbor look at Organization data only to help with a support request from the Organization, to fix a problem (looking at as little personal information as possible), to keep the Services secure or investigate misuse, or when the law requires it. We never browse Organization data out of curiosity, and we don't use real family data for development or testing.
  • When the law requires it. We disclose information to government authorities only when legally compelled, for example by a valid subpoena, court order, or search warrant, or in an emergency involving danger of death or serious injury. Unless the law forbids it, we'll tell the affected Organization before disclosing.
  • Business transfers. If Homeschool Harbor is acquired or merges with another company, we'll notify Organizations before any personal information is transferred or becomes subject to a different privacy policy.
  • With your Organization's permission. We'll list an Organization's name and logo as a customer only if it turns that on in its settings.

We never sell or rent personal information, and we never share it for advertising.

How long we keep it

  • While an Organization uses the Services, its administrators decide how long to keep family records. Families who leave can ask their Organization to erase their information (see below).
  • Membership applications: applications that were never confirmed are deleted after 7 days; declined or withdrawn applications are deleted 1 year after the decision. Approved applications become the family's record.
  • When an Organization cancels, or its trial ends without a paid subscription, its administrators have 60 days of read-only access to export their data. After that, all of the Organization's data is permanently deleted, and removed from backups within a further 3 weeks.
  • Backups are kept for 14 days, so anything deleted is gone from backups within 3 weeks.
  • Server logs: 30 days.
  • Erased families: personal information is deleted at once; invoices and payments keep the family's name for 30 days (longer only if the Organization places a hold), then become "Former family" with a number (see "When a family's information is erased").
  • Our own account and billing records (who signed up, invoices, and payments for the subscription) are kept as long as we need them for accounting and legal obligations.

When a family's information is erased

At a family's request, an Organization's administrator can erase the family. This permanently deletes, at once, the family's adults and children, their contact details, addresses, birthdays, photos, medical and learning notes, emergency contacts, teachers' and administrators' notes, membership applications, event RSVPs, volunteer sign-ups, change history, and any login not used by another Organization.

Two kinds of record remain:

  • Class records. Enrollment and attendance in classes that have started stay as "Former student", with no name, so the class's records still add up; a class still running marks the student withdrawn. Notes written about the student are erased, and so are places on a waitlist or in a class that has not started. If a parent in the family also teaches, they stay in the classes they taught as "Former instructor", with no name, contact or payment details, so those classes still show that someone taught them.
  • The Organization's accounts. Invoices and payments belong to the Organization's books. They keep the family's name for 30 days after the erasure, so the Organization can export them (and for as long as the Organization places a hold on them, for example for a dispute or an unpaid balance). Then the name is replaced with "Former family" and a number, and any free-text notes on them are cleared. Amounts, dates, payment methods, and payment processor references remain, because the Organization needs them for its accounts and taxes.

Other families' own records are not changed. For example, if another family listed someone as an emergency contact, that entry stays in that family's record, because it is their information about who to call. If you want an entry like that removed, ask the Organization, which can edit it.

Erasing is permanent. We keep a record that an erasure happened (a number and dates, with no name once the 30 days are over). Backups (14 days) and server logs (30 days) are outside the erasure and age out on their own schedule, and the Organization's own payment processor keeps its own records of payments. Before erasing, the administrator can download the family's attendance records to give to the family, for example for state homeschool records, and an export of the invoices and payments. The Organization, not Homeschool Harbor, is the school of record: it is responsible for its own accounting and for any official records or transcripts. A family that has been erased and comes back should ask the Organization, which may hold copies it exported before the erasure.

Your rights

Wherever you live, you can ask to:

  • know and access the personal information held about you;
  • correct it;
  • delete it, subject to the exceptions above;
  • receive a copy of it in a portable format; and
  • object to or restrict how it's used.

For information your Organization holds, contact your Organization, and we'll help it respond. For information we hold for ourselves, email privacy@homeschoolharbor.org. We may need to verify your identity first. If someone acts on your behalf, we'll need your written permission. We won't treat you differently for exercising these rights. If we deny a request, we'll tell you why and how to appeal. You may also complain to your local data protection or consumer protection authority.

How we protect information

  • All connections to our sites are encrypted (HTTPS, with HSTS).
  • Passwords are stored only as salted hashes; we can't see them.
  • Access within an Organization is controlled by roles and permissions, and changes are recorded.
  • Photos of families and members are served only to people allowed to see them.
  • When you upload a photo, we save a resized copy, which removes hidden camera and location data (such as GPS coordinates) embedded in the file. Animated images (such as GIFs) and files that aren't photos, such as PDFs and other documents, are stored as uploaded, so check them before uploading.
  • Backups are encrypted and stored separately from our servers.
  • If we discover a security incident affecting an Organization's data, we'll notify the Organization without undue delay and within 72 hours.

No system is perfectly secure, but we work hard to protect your information and to fix problems quickly.

Where information is stored

Homeschool Harbor is a US company, and our servers and backups are in the United States. If you use the Services from outside the US, your information will be transferred to and stored in the US.

Changes and questions

We may update this policy as our Services or the law change. For significant changes, we'll update the date above and notify Organizations' administrators by email before the change takes effect.

Questions, concerns, or requests? Email privacy@homeschoolharbor.org, or write to Homeschool Harbor, LLC, 8401 Mayland Dr Ste S, Richmond, VA 23294, USA.

Adapted from 37signals' policies, used under CC BY 4.0.