FAMILY PILOT · UPDATED 6 SEPTEMBER 2026

Your family’s information

What this pilot stores

Learn with Susie stores your verified parent email, sign-in records and family membership; parent details; child nickname, date of birth, country and avatar; optional learning notes; private uploaded work; reviewed library material; lesson plans, answers and requests for help; recorded visits; parent-created education reports; and feedback you choose to provide. The parent manages this information. Use only information you have the right to share.

Where it goes

Cloudflare hosts the application and stores records in D1 and private files in R2. Cloudflare Email Sending delivers requested sign-in links. Your email provider also processes those messages. Files are accessible through authenticated parent requests, not public file links.

AI content generation

When a parent creates teaching material, OpenAI receives the selected generic topic, theme, reading band and card count, or a parent-reviewed generic topic/worksheet description. A second AI check reviews the freshly generated content and answer keys before the parent reviews them. We do not send names, exact ages or birthdays, emails, profile notes, child answers, questions, history, files, visits or report content. The app adds personal context and saves learning records inside Cloudflare. Generated material can be inaccurate: parents must review it before publishing it to their child.

OpenAI requests use store:false. This does not mean Zero Data Retention: provider security and abuse-monitoring rules still apply to the generic content request. We have not enabled personal-data AI features such as uploaded-work interpretation or child chat. Any future change requires an updated notice and appropriate provider arrangements.

Parent and child spaces

The child has a restricted session for one profile. Parent notes, sibling details, report controls and account information are not included in child responses. Parents can see saved learning answers and help requests. Switching to child mode ends this browser’s parent session. Returning to parent tools in that browser requires a fresh email sign-in. Parents can instead create a one-use link for a separate child device and keep their own parent session. These links expire after 15 minutes and open only the chosen child’s four-hour session. Creating a replacement cancels the previous unused link. Parents can end child device access remotely; signing out everywhere also ends their child sessions. We store a hash of the link, its expiry and issuing session, not the original link.

Adult-only image test

Chris and Gemma can separately test a reviewed, non-personal image and generic question from their fictional demo family. This sends the displayed image and question to OpenAI under standard API retention with store:false; Zero Data Retention is not enabled. No image is added to a child’s history by this test. Real minors’ data and images containing people must not be submitted. This test uses adult review, not automated person detection.

Garden and visit discoveries

Parents prepare activities and approve them for their child. Children save written observations and, only when the parent enables photos for that child, optional photographs. Exploring photos and descriptions stay in the private family library for human marking. A parent may separately permit a named tutor to view submitted discoveries and mark them. Children cannot send photos directly to AI. Photos are resized in the browser and EXIF location metadata is removed. Avoid photographing people or private details. Turning photos off prevents new uploads but does not delete existing images. Parents or their explicitly permitted tutors verify completed work; only verified discoveries enter report drafts. Deleting an activity removes its written answers; its photos remain in the library until separately deleted. Existing report snapshots are not rewritten by deleting source work.

Parent image checks and monthly treats

Parents can send a reviewed non-personal image and question to the OpenAI API. Each submission requires confirmations covering faces, people, identifying information and standard retention. Declaring people blocks sending. These are human checks, not automatic face detection. Zero Data Retention is not enabled. No child profile or learning history accompanies the image. Optional monthly treat targets, recorded lesson time and child sign-in dates stay in Cloudflare. Lesson time is an estimate of visible, recently active use; it is not a measure of attention. Rewards are hidden from the child when disabled.

Shared family and tutors

A family owner can invite another adult by exact email. After accepting, that adult has full parent access to this family’s profiles, learning, files and reports. Existing separate family records are not merged. Only the owner manages shared-parent membership. Tutors use their own verified email and receive only the children and categories the parent selects. Discovery marking is a separate permission covering submitted photos and descriptions. Removing permission blocks further access; it cannot recall copies already downloaded. Directory listings and community worksheets are available to signed-in adults after manager publication.

Reading without a quiz

Parents and invited tutors can prepare reading articles. The parent approves them before the child sees them. We record the title and date when a reading is opened and when the child chooses “I’ve finished reading”. These records remain in Cloudflare and may be included in parent-reviewed reports. Opening a page is not proof of understanding. Reading records are included in the family export.

Calendar and reports

Calendar events, holidays and learning days stay in Cloudflare. Only completed events selected for reports are included as learning evidence; planned events are not treated as accomplishments.

Reports and your choices

Education reports are drafted in this app, using the dates and observations you choose. They highlight recorded participation and achievements. They exclude private profile notes, visit notes and sessions marked as off days or excluded. You can edit the draft, approve it, download Word or PDF, and decide whether to share it. Nothing is automatically sent to a local authority. Downloads are separate copies you control.

Tutors and parent-controlled sharing

Parents can invite multiple tutors by their verified email address. Each child and tutor connection has separate sharing controls. Tutors see their assigned tasks and completion status; parents can additionally share scores for assigned tasks or all learning statistics. Separate tick boxes cover learning profile and goals, parent session comments, calendar learning, visit observations and parent-approved reports. Turning a category off stops future access through the app. Tutors may already have read or downloaded information while access was enabled; revocation cannot erase copies they hold. Tutors do not become family account owners. Tutor records, learner details and messages are not sent to an AI provider. Tutors may separately submit a confirmed, general educational brief to generate reading material.

Tutor tasks and child-facing feedback require parent approval. Direct messages are shared only between the parent and that tutor. Completed calendar entries selected for reporting can appear in report drafts; future or planned events do not become evidence of completed learning. Private calendar planning notes are excluded from tutor calendar sharing and reports. Parents can revoke tutor access at any time.

Keeping and removing records

Test learning records remain until deleted. Library notes, sessions, visits and reports have delete controls. Deleting a child removes their linked learning records; original uploaded family files become unassigned and can be deleted separately in the library. Deleting a source visit or session does not rewrite an already saved report: edit or delete that report separately. Deleting a file removes it from active R2 storage. Provider backups and operational security records may have separate retention periods.

Sign-in and essential cookies

We use a secure essential parent session cookie for up to seven days, a child session for up to four hours, and a short-lived cookie protecting email links. Expired authentication records are cleaned in bounded batches. No advertising tags or optional analytics cookies are installed. The unlisted pilot link can be forwarded; email verification and server permissions protect family accounts.

Questions and feedback

Contact the person who gave you the pilot link for account-removal requests or privacy questions. This is an early family pilot; do not rely on it for safeguarding, medical advice or a formal educational assessment.