Privacy Notice for Parents
Last updated: July 31, 2026 · This notice applies to the Synapse closed beta, a service operated by THINK PREP GROUP INC..
Synapse is an adaptive math learning service for children in Grades 3–5 (ages approximately 8–11), aligned to New York State curriculum. Because Synapse is directed to children under 13, it is governed by the Children's Online Privacy Protection Act (COPPA). This notice explains, in plain language, what information we collect from your child, how we use it, who we share it with, how long we keep it, and the rights you have as a parent or legal guardian.
We verify you and require your consent, as the parent or legal guardian, before we collect anything about your child. The order matters: first you verify you are the parent or guardian, then you review this notice and give consent, and only then can a child account be created. No child profile, school, interests, answers, or learning activity is collected before both steps are complete. To verify parental consent under COPPA, we will make a temporary $1 verification charge through Stripe. The charge is refunded automatically. Card details are handled by our payment processor (Stripe) and never touch our servers. The verification charge is always refunded in full, and we do not store your card number. If you later purchase a paid subscription, payments already made are not refunded; cancelling stops future charges, and deleting the account ends billing immediately with no refund of the current period. We keep a record of your verification and consent — including which version of this notice you accepted — as COPPA requires. These billing terms are also set out in our Terms of Service.
1. Who we are
Synapse is operated by THINK PREP GROUP INC.. For any privacy question or request, contact us at info@thinkprepny.com. You can reach us at this address to review, correct, or delete your child's information, or to refuse further collection (see Section 7).
You can write to us at 4554 Bell Blvd, 2nd Fl, Bayside, NY 11361. You can call us at 917-485-4459.
2. Information we collect from your child
We practice data minimization: we collect only what the learning service needs. Specifically:
- Account details you provide when you create the child account: the child's name or nickname (a display name), a login username, a password (stored only as a secure hash), and the grade level. A school name may be provided but is optional and is not required to use the service.
- Interest themes your child selects (e.g. animals, space) so practice worksheets feel relevant. Alongside the preset themes there is an optional free-text box ("Anything else?") where your child can type other interests, and a matching box for topics they would rather avoid. Anything typed there is automatically screened before it is saved — we reject text that looks like an email address, a link, or a phone or account number — and the free text is never sent to our AI provider; only the preset category label is. We do not require your child to provide an email address; the service generates an internal-only login identifier instead.
- Learning and progress data generated during practice: question answers, answer type, correctness, response time, whether a hint was used, your child's own rating of how hard a question felt (easy / just right / hard), session timestamps, and computed mastery and spaced-repetition memory state for each math concept.
- How a practice session ended — completed normally, closed mid-session, or left inactive — so we can resume your child's progress correctly next time. We do not use third-party analytics or advertising trackers, and we do not collect your child's home address, photograph, precise location, browsing history across other sites, device type, or time-of-day usage patterns.
3. How we use this information
- To create and secure your child's account.
- To deliver adaptive practice — selecting the next concept and difficulty using a spaced-repetition learning model.
- To generate practice worksheets themed to your child's stated interests (see Section 4 on AI generation).
- To show you, the parent, your child's progress, and to send you account-related email.
We do not sell your child's information, and we do not use it for behavioral advertising.
4. Service providers we share with
We share information only with the service providers needed to operate Synapse, and only as needed for them to perform their function. They are required to keep the information confidential and secure.
| Provider | Purpose | Child information they receive |
|---|---|---|
| Supabase | Database and authentication hosting | All account, learning, and progress data — our primary datastore |
| Anthropic | AI worksheet generation | Concept name, grade level, difficulty tier, and an interest category label only — no name, username, school, answers, or session history |
| Stripe | Subscription payment processing (parent) | A pseudonymous account identifier in payment metadata; card details are entered on Stripe and never reach our servers |
| Vercel | Web hosting and application runtime | Account identifiers, and the display name in server logs for email delivery |
| Google (Gmail SMTP, via Nodemailer) | Sending account email to parents | The parent's email address and the child's display name in the message body |
| Memgraph Cloud | Curriculum knowledge graph | Static curriculum concept identifiers only — no child information |
About AI worksheet generation. Worksheets are generated by Anthropic's AI service. We send only the math concept, grade level, difficulty, and an interest category label. We deliberately do not send your child's name, username, school, typed answers, or session history. Because the grade level and interest theme are derived from your child's account, we disclose this use to you for transparency even though no direct identifier is sent.
5. Cookies and browser storage
Synapse uses only the cookies and browser storage the service needs to function — what privacy rules call "strictly necessary" or essential use. Specifically:
- Sign-in cookies. Our authentication provider (Supabase) sets first-party cookies that keep you and your child securely signed in and are refreshed as you use the service. Without them, logging in does not work.
- Temporary browser storage. During the placement diagnostic, we keep a session identifier in your browser's temporary storage (sessionStorage) so your child doesn't lose their place if the page reloads. It contains no name or personal details and is cleared when the browser tab closes.
We do not use third-party advertising, analytics, or social-media cookies, and we do not use cookies to track your child across other websites.
6. How long we keep information, and how deletion works
This is our data retention policy. We keep your child's information only as long as we actually need it for the purpose we collected it for, and we do not keep it indefinitely. Each category below states why we keep it and for how long.
| What | Why we keep it | How long |
|---|---|---|
| Account details and learning data | The adaptive model needs your child's history to choose what to practise next and when to review it | While the account is active — see the next row |
| Accounts that stop being used | Once a child stops practising there is no longer a reason to hold their data | We email you at about 9 months of inactivity, and delete the account at about 12 months. Signing in and practising keeps the account active. |
| Accounts you delete | No retention purpose once you ask us to delete | Deactivated immediately (your child can no longer log in and the data is hidden), then permanently erased within 30 days. If the account has an active paid subscription, we cancel it first, then complete the erasure. |
| Consent and deletion records | COPPA requires us to be able to show we obtained your consent, and we need a deletion trail for security | Kept for up to 6 years. These records reference your child by an internal identifier only — they do not contain your child's name. |
| Copies in provider backups | Routine disaster recovery by our hosting providers | Until the provider's routine backup rotation ages them out. We are confirming the exact window with our hosting provider and will state it here once confirmed. |
We do not keep your child's information for any purpose other than the ones listed in this notice.
Where we are still building. We would rather tell you this than imply otherwise. The inactivity schedule above is our policy and the automated job that carries it out is written, but we are still validating it against real data before we let it delete accounts on its own — until we finish, that job only reports what it would delete, and we act on it by hand. The 6-year limit on consent and deletion records is likewise a policy we apply manually; the automatic clean-up for those records is not built yet. Deletions you request are unaffected: those run automatically today, on the 30-day schedule stated above.
7. Your rights as a parent
Under COPPA, you have the right to:
- Review the personal information we have collected from your child.
- Correct that information.
- Request deletion of your child's personal information.
- Refuse to permit further collection or use of your child's information (note that this may mean we can no longer provide the service).
To exercise any of these rights, email info@thinkprepny.com. You can also delete your child's account at any time from your parent dashboard.
8. Schools
This closed beta is a direct-to-parent service. It is not sponsored by, contracted with, or shared with any school or district, and any school name you choose to enter is not verified with or sent to a school. If we later offer Synapse through schools, that deployment will be governed by a separate agreement and notice.
9. Changes to this notice
If we change how we collect, use, or share your child's information, we will update this notice and change the "last updated" date at the top of this page. Where the change is material — a new category of information, a new provider we share with, or a new purpose — we will email you and obtain your consent again before that change applies to your child's account.
How that works today. Being straight with you about the mechanics: an in-app re-consent step now exists — when this notice changes, we record it, and if you sign in to your account after we do, you'll be shown the update and asked to confirm you agree, from your parent dashboard. We are still rolling this out: for some families it is shown as a request rather than a requirement while we finish that rollout, and we also email you directly about material changes rather than relying on you to notice a banner. If you would rather not wait to be contacted, you can check the "last updated" date above at any time, and you can withdraw consent or delete your child's account at any time using the contacts in Section 7.
10. Contact us
Questions about this notice or your child's privacy? Email info@thinkprepny.com.