Privacy Policy

reweave is operated by reweave Inc., a 501(c)(3) educational nonprofit registered in the United States (EIN 46-1877873). for privacy purposes, we are the data controller for personal information we collect from you on reweave, except for student data submitted by schools (see Schools and students).

for any privacy matter, email [email protected]. we do not yet have a formal Data Protection Officer given our size, but the support@ inbox is our designated contact for all privacy questions, requests, and incidents.

Account information. when you create an account: your email address, a hashed credential (or magic-link auth token), and the display name you choose.

Profile preferences. notification preferences, locale, accessibility settings.

Usage information. what searches you run, what films you view, what lessons you generate and save, when. tied to your account so we can serve your library back to you and enforce monthly caps.

Lesson content. the lessons you weave, titles, notes, and saves.

Notebook entries (encrypted blobs only). if you use the reflection notebook, your entries are encrypted on your device before they reach us. we store the encrypted blob, your encrypted key envelope, and metadata like dates and prompt types. we cannot read the contents. see the Security section for what this means in practice.

Technical information. IP address (kept briefly for security and abuse prevention), browser type, device type, approximate location from IP at city level, referrer.

Communications. if you email us, we keep that email so we can answer it and reference it later.

Payment information (paid subscribers only). Stripe handles your card. we receive a subscription identifier, status, and the last 4 digits, never the full card number.

• student personal information. we do not want or need this. teachers must not enter student names, photos, IDs, addresses, or other identifiers into the weaver.
• your contacts, calendar, files, photos. we don't request these browser permissions.
• biometric data. none.
• precise geolocation (lat/lon). only city-level from IP.
• third-party advertising or tracking IDs. none, with one narrow exception: if you reach us by clicking one of our Google ads, Google adds its own click id (gclid) to the link. we keep it in your browser (see our cookie notice), with your account, with your email signup or link request, or with an app store tap or brain break start that follows, and we may also keep it with a purchase or a team quote or gift request. today there is no time limit on the copies we keep on our side. we use it in three ways. first, to tell Google the ad worked: we may upload a file to Google by hand with only that click id, the name of the step, its time, and for a purchase the amount paid, for account signups, requests to join our email list (counted when you ask, before you confirm), link requests, app store taps and purchases. brain break starts, team quotes and gift requests are never uploaded, unless they become a purchase. second, our own dashboard uses it to count which steps came from ads. third, when we keep it with a purchase, team quote or gift, it travels with that checkout or invoice through Stripe, our payment processor. if you delete your account, we delete the copy kept with your account and with any team quote or gift request made with your account's email. the copies kept with an email signup, link request, app store tap or brain break start never held your name or email, and they stay. a purchase keeps it on our purchase record, Stripe keeps its copy with the checkout or invoice, and anything already uploaded is held by Google. no email, no name, and no Google ads or analytics script on the site. details in our cookie notice.
• special category data as defined under GDPR (race, religion, health, sexual orientation, etc.). we do not solicit, infer, or process special category data.

• operate the service: keep you logged in, run searches, generate lessons, serve films
• bill paid subscribers via Stripe
• answer your support emails
• improve the service by looking at aggregate, de-identified usage patterns. our internal dashboards are built to show counts and trends, not people. an individual account is looked at only when you contact us for support and we need to see your account to help (see What we look at, and why)
• send our newsletter: when you tick the newsletter box as you create a free account, buy a plan (with the email you give at checkout), or join our email list and confirm with the link we email you, we add you to our list on EmailOctopus. every one of those emails has an unsubscribe link, and you can turn the newsletter off any time in /account. our newsletter is sent through EmailOctopus, which records whether each newsletter is opened and which links in it are clicked; unsubscribing stops the newsletter. emails about your account or your payments are not on that list.
• prevent abuse, fraud, and spam
• comply with legal obligations
• nonprofit research, only on aggregated and de-identified data, never on identifiable data

we do not use your personal information to target ads. the one advertising use is the Google click id measurement described above. we do not sell or rent it. we do not use AI to make automated decisions that produce legal or similarly significant effects on you.

this is the part most privacy policies leave vague, so we want to be plain about it. there is a difference between support-style access and browse-style access, and we only do the first.

Our dashboards are aggregate. the internal tools we use to understand how reweave is doing show counts, trends, and where signups come from. they are built so the people behind the numbers stay anonymous: a paying subscriber appears as an anonymous handle and a journey, never a name or an email. no one on our side opens a marketing or analytics dashboard and browses through who you are. the tools are designed so they cannot, not merely so they should not.

Individual identity surfaces only when you reach out. just like any support team needs to know your name and look at your account to answer your question, when you contact us we may open your account to help you. that is how support works everywhere. what we do not do is go looking at your data with your identity attached when you have not asked us to. account access happens through tools that keep their own access records, so there is a trail behind any individual lookup.

Some things we choose not to look at. even though we technically could, we do not:

• your individual activity, unless you have contacted us and we need to see your account to help.
• what you do outside reweave. we place no third-party advertising or tracking pixels on the site, so there is nothing to look at there in the first place.
• anything not explicitly described on this page.

Some things we could not look at even if we wanted to. this is the stronger promise, and it is enforced by math, not by policy:

• your notebook and any private reflection you write there. entries are encrypted on your device with a key derived from your password before they ever reach us. we hold only an unreadable blob. we do not have the key. we cannot decrypt your notebook even if we wanted to, even if a court ordered us to, even if we were breached. see Security for exactly how this works.

under GDPR and UK GDPR, we process your personal data on these bases:

• contract: to provide the service you signed up for
• legitimate interests: site security, abuse prevention, basic cookieless analytics, service improvement, always weighed against your rights and freedoms
• consent: where you join our email list yourself, or take part in research
• legal obligation: when required by law (tax records, valid law enforcement requests)

you can withdraw consent at any time without affecting the lawfulness of prior processing.

we use a small set of trusted vendors. each is contractually bound to protect your data. each receives only what it needs to do its job.

• Cloudflare: hosting, CDN, bot protection, and cookieless edge web analytics. Cloudflare Turnstile, the check that keeps bots out of our forms (sign-in, sign-up, help, gifts, team quotes, the email list form at the foot of most pages, the email boxes on some topic pages, and the form on phones that emails you a link), loads its script from challenges.cloudflare.com on those pages and sees the standard request your browser makes, including your IP address. privacy policy
• Supabase: authentication and database. the code that connects your browser to Supabase is served from reweave.org itself. privacy policy
• Anthropic: Claude API powering the weaver, search, help answers, support reply drafts, our check for names, contact details and ID numbers, and dimension suggestions. privacy policy
• Stripe: subscription, gift and team payments and invoices. when we keep an ad click id with a checkout, team quote or gift, Stripe holds it with that checkout or invoice. privacy policy
• Google: we run search ads on Google through Google's free nonprofit ad grant. when one of those ads led somewhere, we may upload a file to Google by hand with only the click id it added to the link, the name of the step, its time, and for a purchase the amount paid. no Google script runs on reweave. privacy policy
• DonateStock: stock, donor-advised fund, and crypto donations on our donate page. its scripts load from donatestock.com on that page only, and DonateStock receives what you enter there under its own terms.
• Givebutter: donations made on our donate page. its script and donation form load from givebutter.com on that page only. Givebutter receives what you enter in the form (for a donation, usually your name, email, and payment details) under its own privacy policy, and may set its own cookies or storage when that page loads. privacy policy
• Resend: transactional and auth emails. when you create an account, Resend also carries a short note to our team inbox with your email address and first name, sent before you confirm your email. Resend also sends the email that asks you to confirm joining our email list, and the link you ask us to email you from a phone; for a link request, it also carries a short note to our team inbox with the address you typed. Resend tells us whether each of our emails was delivered, and we keep that delivery record, with the address it went to. privacy policy
• EmailOctopus: our newsletter, for people who tick the newsletter box when they create a free account, people who buy a plan, and people who join our email list and confirm. stores email address and name. servers in the EU and UK. privacy policy
• Cloudflare Stream: film hosting and delivery. part of our existing Cloudflare infrastructure. no advertising or tracking cookies. films play in Cloudflare’s own player, loaded from cloudflarestream.com, and on film pages that show a muted preview, a small Cloudflare player script from embed.cloudflarestream.com also loads so our sound button can turn the sound on. the still pictures of our films load from videodelivery.net, which is also Cloudflare Stream. Cloudflare privacy policy

we may also disclose data:

• to law enforcement when legally required (we will push back on overbroad requests when we can)
• in connection with a merger, acquisition, or sale of assets, with notice to you
• to protect rights, safety, or property of reweave, our users, or the public

we do not share your data with advertisers or data brokers. the most Google may receive is the ad click measurement described above: the click id, the name of the step, its time, and for a purchase the amount paid.

reweave Pro can be purchased as a team plan for a school, district, or organization. team plans change who can see what about your account, but the limits below are strict.

what your team admin can see. if you are a member of a reweave team, the person who administers that team can see your name, your email address, and the date you joined the team. that is all. they cannot see your journal entries, your film viewing history, your saved films, or any notes you have written. that data is private to you.

leaving a team. you can leave a team at any time from your account. when you leave, you are removed from the administrator's view immediately. your journal, notes, and viewing history stay yours and stay private.

PO and district plans. when a district or organization purchases a team plan via purchase order, we store the billing contact's name, email, and organization name to process payment and provision access. this information is used only for billing and account setup. it is not shared with third parties.

schools and COPPA / FERPA. we do not want or need student personal information. our school posture is set out in our terms: teachers and administrators are the account holders, and students do not need accounts. teachers must not enter student names, photos, or other identifying information into the weaver or search.

we are a US-based nonprofit. several of our vendors are also in the United States. if you are in the EU, UK, or another country with cross-border data protection rules, your data may be transferred to and processed in the US.

for EU and UK transfers we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable, plus supplementary measures: TLS encryption for transfers, vendor selection that prefers EU-hosted options where reasonable, and access controls that limit what each vendor can see.

• account data: while your account is active, plus a short reconciliation window after deletion. the Google ad click id has no time limit today; what deleting your account removes is under What we never collect
• email list requests: when you ask to join our email list, we keep your address and the time you asked while we wait for you to confirm. the link we send works for 7 days; if you do not confirm, the request is deleted the next time anyone asks to join our email list after those 7 days. when you confirm, we keep the time you confirmed (not your IP address) as the record of your yes, with no time limit today
• email delivery records: the delivery record Resend sends us for each of our emails, with the address it went to, has no time limit today
• usage logs: 12 months rolling
• generated lessons: until you delete them
• email correspondence: 24 months
• payment records: as required by tax and accounting law (typically 7 years)
• backups: full purge within 90 days of a deletion request

if you have been completely inactive for 24 months, we may email you and then delete the account if you do not respond.

schools as controllers. when a school or district uses reweave, the school is the controller of any student-related data. reweave acts as a service provider on the school direction, in line with FERPA and applicable state student privacy laws.

COPPA. reweave is a teacher-and-learner platform. we do not knowingly collect personal information from children under 13 outside of a school context with verifiable parental consent. teachers must not enter student names, photos, IDs, or any identifier into the weaver. if we learn we have collected info from a child under 13 without proper consent, we delete it promptly. parents or schools can request deletion at [email protected].

FERPA. where reweave is used by US K-12 schools, we recognize that student records may constitute education records protected under FERPA. we treat any such records as confidential, do not disclose them except as directed by the school, and do not retain them beyond what the school directs.

Data Processing Agreements (DPAs). schools and districts that need a written DPA can email [email protected].

state laws. we comply with applicable state student privacy laws including SOPIPA (California) and similar regimes in other states.

everyone (regardless of where you live) has these rights with us:

• access: request a copy of your data
• correct: fix what is wrong
• delete: ask us to delete your account and content (or use the delete button in /account)
• export: download a structured copy of your data (available in /account)

to exercise any right, email [email protected]. we respond within 30 days, faster when we can.

EU and UK (GDPR and UK GDPR), additional rights:

• portability: receive your data in a machine-readable format
• restrict processing
• object to processing based on legitimate interests
• lodge a complaint with your supervisory authority. in the UK that is the ICO (ico.org.uk); in the EU it is your country DPA.
• not be subject to solely automated decision-making with legal effects (we do not do this anyway)

California (CCPA / CPRA), additional rights:

• right to know what personal information we have
• right to delete personal information
• right to correct inaccurate information
• right to limit use of sensitive personal information (we do not process sensitive PI for non-essential purposes)
• right to opt out of sale or sharing: We never sell your personal information. The only thing we send to Google is the ad click code described above, and only when you arrived from one of our ads.
• right to non-discrimination: we will not penalize you for exercising your privacy rights
• authorized agents: you can have someone act on your behalf; we will verify

we do not provide a "Do Not Sell My Personal Information" link because we do not sell. if that ever changes, we will add one and tell you first.

Brazil (LGPD), Canada (PIPEDA), Australia, India (DPDP), South Africa (POPIA) and similar regimes: we honor reasonable rights requests under any applicable law. email [email protected] and tell us your country of residence.

see our cookie notice for the full breakdown. very short version: cookieless edge web analytics (Cloudflare), strictly-necessary auth tokens (Supabase, in browser localStorage), Cloudflare bot management, first-party campaign and Google click id measurement, and third-party cookies set when you check out via Stripe. no ads on the site, no data brokers, and no cross-site tracking beyond the Google ad click id measurement.

we use industry-standard practices:

• TLS encryption for all data in transit
• encrypted storage at rest where vendors offer it
• role-based access controls
• limited employee and contractor access on a need-to-know basis
• regular review of security practices

Your notebook gets a stronger guarantee. Notebook entries are encrypted on your device with a key derived from your password using PBKDF2 and AES-GCM. What you write inside your journal is encrypted on your device, and only you hold the key; we cannot decrypt it. Before a moment is saved, its words pass once through our check for names, contact details and ID numbers, which uses an AI model. That check keeps no copy of your words. Notes left on a person’s page or after a film are not encrypted.

What that means in practice:

• If you forget your password, you can reset it with email like any other account.
• If you forget your password and lose your recovery phrase, your notebook contents are permanently unrecoverable. We cannot restore them. We don't keep a backup of your unencrypted entries.
• If we receive a legal request for your notebook contents, we can only hand over encrypted blobs that are useless without your key.

This is the tradeoff. You get true privacy. The price is that you are responsible for your own recovery phrase. We strongly recommend writing it down somewhere physical and adding a verified backup email so you have a second path to reset your password.

your account credentials (email, password hash, profile info) are managed by Supabase Auth and protected with industry-standard hashing. session tokens are short-lived. you can sign out on every device at any time from your account settings.

no system is perfect. if you spot a vulnerability or suspect a breach, email [email protected]. we will respond fast. in the event of a personal data breach affecting you, we will notify you and applicable regulators in line with the law.

we use Anthropic’s Claude API for: the weaver, Pro Search and quick search; the answers on our help and support pages; drafting our replies when you write to support (a person reads and sends every reply); a check that looks for names, contact details and ID numbers in a moment you add to your notebook and in your answers to our welcome questions, before they are saved or encrypted; and suggesting one of our dimensions for notes you save for counting without one. the text each of these needs is sent to Anthropic over an encrypted connection so the model can generate output. Anthropic processes this data under their commercial API terms and does not use API inputs or outputs to train their models. we send only the text each use needs. we do not use AI to profile you or to make automated decisions with legal effects.

the reweave game, on the App Store and Google Play, is a separate app for young learners. a few things leave the phone, and the game never sends your child’s notes or progress. this section describes the current versions of the game.

What stays on your device. progress on each island, which stories have been watched, the growth garden, storybook progress, reflections and notes, settings, your language choice, and whether you have bought the full game. all of it lives in local app storage on the phone. we have no server that receives any of it. deleting the app deletes it from the phone; a copy may remain in your phone’s own backup.

What your child writes in the game (notes, answers, postcard notes and thank-you notes) stays on your child’s device and is never sent to us. Like your photos, it is included in your phone’s own backup if you use one. From game version 3.4, a grown-up can erase it at any time in the Grown-ups’ corner; progress stays.

What does leave your device. the short films stream from Cloudflare Stream, which, like any video service, sees a standard web request (including your device’s IP address) so it can deliver the video; the address it asks for is the film’s id, with nothing about your child in it. purchases are processed by Apple or Google, which tell the app whether you have bought the full game. after a few films, the game may show the store’s own rating sheet once, inside the Grown-ups’ corner; that sheet is run by Apple or Google. links a grown-up opens from the game, such as our terms, privacy and donate pages or the store’s pages, open like any other link. and if a grown-up chooses to send us feedback, a mail draft opens in their own mail app with the game’s version, build and platform, plus whatever they write; nothing is sent unless they send it. the game itself never sends us your Apple or Google account, your name, or your payment details.

No analytics, no tracking. the game has no analytics SDK, no crash reporting SDK, no advertising, no advertising identifier, and no tracking prompt. we cannot tell who is playing, how often, or which story they watched. if you have allowed your phone to share diagnostics with app developers, Apple or Google may pass us anonymous crash reports.

Earlier versions. Current versions of the game include no tracking. Versions before 1.7.0 used Google Firebase for usage analytics, crash reports, and an in-app feedback form; updating the app removes all of it.

Grown-ups only. purchases, feedback, and every link that leaves the game sit behind a parental gate.

Feedback. after the parental gate, the feedback button opens a draft email in your own mail app, addressed to [email protected]. nothing is sent unless you choose to send it.

Children. the game collects no personal data from anyone, children included. there is no sign-up, no email field, and no profile.

Contact. for anything about the game, and for any privacy request, email [email protected].

we may update this policy. material changes will be flagged at the top of this page with a new "Updated" date and emailed to active subscribers when we can. non-material changes are noted by the date alone. continued use of reweave after a change means you accept the updated policy.

real emails reach real people:

• general support, privacy and data requests, security issues and legal notices: [email protected]
• school agreements (DPA): [email protected]

for the agreement to use reweave, see our terms of use. for cookies, see our cookie notice.