Privacy Policy

Effective [[Effective date]]

This policy explains what Yia, LLC ("we", "us") collects through Yia | Socratic (the "Service"), why, who can see it, how long we keep it, and what you can do about it. The Service is for students ages 13 to 18 and the parents, guardians, and mentors who support them. We wrote it to be read. If anything is unclear, ask us at jake@yiafirm.com.

The short version. We collect what we need to run the tutor and keep students safe. We don't sell personal information. We don't show ads or use advertising trackers. Tutor conversations delete themselves after 30 days. A student's record of work stays until the family deletes it. Parents can see it, export it, and delete it.

1. Who the Service is for

• Students are 13 to 17, or 18 and still in high school. The Service is not for children under 13. We do not knowingly collect their information. If we learn that we have, we delete it.
• Students who are 18 control their own account. Parents, guardians, and mentors can see it only if the student agrees, and the student can change that at any time on the "Your data" page.
• Parents and guardians are 18 or older and approve each student's account.
• Independent mentors are 18 or older and can follow a student only with a parent or guardian's agreement.
• Schools. Yia | Socratic is sold to families, not schools. We are not a school and do not receive student records from schools, so FERPA, the federal law for schools that receive U.S. Department of Education funds, does not apply to us directly. If you would use the Service through a school, district, or program, tell us at jake@yiafirm.com before you sign up.

2. What we collect

Account information

• Email address and password. Passwords are stored scrambled, so we cannot read them.
• Your role: student, parent or guardian, or mentor.
• State of residence. Required at sign-up. Privacy laws and homeschool reporting rules differ by state, and we use it to apply the right ones.
• For students: a first name or nickname, grade level, and the email address of the parent or guardian they named.
• When you accepted our terms, and which version.

Learning activity

• The missions a student starts, the decisions they make, and the time they spend.
• What students write to the tutor, the tutor's replies, and which step of a mission they were on.
• Written defenses: short explanations a student writes at the end of a mission, with skill scores from 1 to 4 and a line of feedback.
• Work students upload to their portfolio, with a subject label and review status.

Safety information

• When an automated check flags a message or defense, we record the date, the kind of concern, the level of concern, and how our team handled it.
• We also keep a restricted copy of the flagged exchange, which only our safety reviewers can see. See sections 5 and 7.

Billing information

• Payments are handled by Stripe. We receive your plan, its status, payment dates, and your billing location for tax. We never receive full card numbers.

Referrals

• Each parent has an invite code. When a family joins through it, we record which account invited which, whether the new family's plan has been paid for 8 days, the credit given, and the one-time discount the new family received. A parent sees only how many families joined through their link, never who.

Parent guide emails

• If you ask for our free parent guide, we store your email address, the page you signed up from, the exact consent wording you agreed to and when, a salted one-way hash of your IP address (used only to stop repeated sign-ups), when you confirmed or unsubscribed, and which guide emails we sent you.
• You must confirm your address before we send the guide or any follow-up. The guide is a short series of emails over about two weeks. Every email has a one-click unsubscribe link.
• The parent guide is separate from an account. Signing up for it doesn't create one, and we don't link the two.

Public pages that collect nothing

• The free taste at `/try` and the mission previews at `/missions` work without an account, use no AI, and save nothing about you.
• The read-only service for AI assistants at `/mcp` shares only public information: missions, prices, and how to start. It never returns personal or student information. To prevent abuse it counts requests per IP address for one minute; we don't store those addresses.

Technical information

• A sign-in cookie that keeps you logged in, and a small note in your browser that remembers a student's place in a mission. We use no analytics and no advertising trackers.
• Our host, Cloudflare, logs basic request details, such as IP address, page, and time, for security and troubleshooting. These logs are kept for 3 days.

3. How we use it

• To run the Service: sign you in, build missions, let the tutor reply, score defenses, and show families the work.
• To keep students safe: run safety checks, review flags, and alert parents where section 5 says we do.
• To check quality: our team reviews each library mission once before students see it, and reviews custom topics before they open.
• To support you, bill you, give referral credits, prevent misuse, secure the Service, and meet legal duties.
• To send the parent guide and its follow-up emails, only to people who asked for them and confirmed their address.

We do not sell personal information. We do not use it for advertising or to build advertising profiles. We do not use students' work to train AI models.

4. AI processing

When a student writes to the tutor or submits a defense, we send that text and the context it needs to an AI provider, which writes the reply or the score. Before that, we remove some personal details automatically, such as email addresses, phone numbers, and street addresses. Under our commercial terms with these providers, what we send is not used to train their models, and they delete it within 30 days. They may keep it longer only if it is flagged for misuse or the law requires it. AI can make mistakes. Our Terms of Service explain how to treat what it says.

The tutor is an AI, not a person, and the chat says so. When a student's message suggests a risk of self-harm, or that someone may be in danger, the tutor stops the lesson, shares crisis resources such as 988 and the Crisis Text Line, and flags the conversation for human review.

5. Who can see what

• Students see their own work and conversations.
• Parents and guardians linked to a student can see that student's record of work (missions, time spent, written defenses, and skill scores), read their recent conversations and portfolio, export the record of work, and delete the student's data. Some conversations may not appear in the parent view while our team reviews them, as explained below. Students are told plainly, where they write, that their parent or guardian can read their chats with the tutor.
• At 18. When a student is 18, the account is theirs. Parent, guardian, and mentor access stops unless the student agrees to share.
• Mentors linked to a student see the same work and conversations. They cannot delete data.
• Safety alerts go to parents only for self-harm risk. If a check flags a possible risk of self-harm, linked parents, guardians, and mentors see a check-in notice at once, with the date and status. The notice does not quote the student.
• Flagged conversations are held for review. Any conversation or written defense that a safety check flags, including for self-harm, is withheld from parents, guardians, and mentors until our team reviews it. We decide case by case, to protect the student's safety, whether to release it. For example, we would not release a conversation where a student says someone at home is hurting them. A student who needs to talk to someone privately can use the services on our Support page, which are separate from this site.
• Our team. A small number of authorized people see the data they need to run the Service, review missions, and handle safety flags. Only our safety reviewers can see the restricted safety copies.
• Other families never see your information.

6. Who else receives data

We share data with companies that help us run the Service, and only for that purpose:

• Supabase: database, sign-in, and file storage, in the United States.
• n8n: the automation system that runs our mission and tutor workflows. It keeps a history of workflow runs, which includes message text, for 7 days.
• Anthropic: the AI that writes missions, tutor replies, and defense scores.
• OpenAI: turns a student's message, with personal details removed, into a search key so the tutor can find the right source passages.
• Stripe: payments and sales tax.
• Resend: sign-in, account, and summary emails, and the parent guide emails.
• Cloudflare: hosts the website and protects it from attacks.

We may also share information if the law requires it, to protect someone from serious harm, or as part of a sale or merger of our business. If that happens, we will tell you, and the new owner must honor this policy.

7. How long we keep it

| Data | How long | |---|---| | Tutor conversations and session logs | 30 days, then deleted automatically | | Conversations linked to a safety flag, in the normal view | 2 months | | Safety flags (date, kind, level, how it was handled) | 12 months | | Restricted copy of a flagged exchange (safety reviewers only) | 12 months. Up to 3 years if we told a parent about a possible immediate risk, made a report to authorities, or the law or a legal process requires it. | | Record of work (finished missions, dates, minutes, written defenses, skill scores, feedback) | Until the family deletes it | | Portfolio uploads | Until the family deletes them | | Account details | Until the account is closed | | Billing records and referral credits | As long as tax and accounting law requires | | Parent guide sign-up that was never confirmed | 14 days, then deleted automatically | | Confirmed parent guide subscriber | Until you unsubscribe or ask us to delete it | | Unsubscribed parent guide address | Kept only so we never email it again. Ask us at jake@yiafirm.com to delete it entirely. |

The record of work is kept apart from conversations, so the 30-day deletion never removes it. We keep no separate backups of the database, so once a deletion runs, the data is gone.

8. Your choices and rights

• See and export. Linked parents, guardians, and mentors can export the record of work in one click, as a printable page or a CSV, and download recent conversations while they exist. The export includes logged hours and an estimate of high school credit at 120 hours per credit, clearly labeled an estimate. Students can export their own.
• Parent guide emails. Unsubscribe with one click from any guide email, or email jake@yiafirm.com.
• Delete. Students and parents or guardians can delete data from the "Your data" page. Choose one:
• Conversations only. The record of work and portfolio stay.
• Everything the student has made. Conversations, the record of work, missions, and portfolio files. The account stays.
• Everything, including the account.

Requests run automatically, usually within an hour. Safety records are the one exception: we keep safety flags and the restricted copies of flagged exchanges for the times in section 7, so we can show how a concern was handled and meet our legal duties. A deletion request does not remove a copy we keep for these reasons.

• Anything else. Email jake@yiafirm.com to ask for access or correction, or with any question. We may need to confirm who you are first.
• Your state's rights. Depending on where you live, you and your teen may have extra rights, such as to access, correct, or delete personal information. We don't sell personal information or use it for targeted ads. We honor these requests for every family, whatever its state.

9. How safety checks work

This is our crisis protocol, in plain words.

1. Every message is checked. Each message a student writes to the tutor, and each written defense, goes through an automated safety check before the tutor replies.
2. The student gets help first. If a check finds a possible risk to the student or someone else, the tutor stops the lesson. It shows fixed, human-written text with crisis resources: call or text 988 (Suicide & Crisis Lifeline), text HOME to 741741 (Crisis Text Line), Childhelp at 1-800-422-4453 if someone is hurting them, and 911 in an emergency. The tutor does not counsel or ask probing questions.
3. A person is told. Our safety reviewer gets an email at once for every flag. The email names the kind of concern, never the student's words.
4. Parents hear about self-harm risk. For a possible risk of self-harm, linked parents and mentors see a check-in notice at once. Every flagged conversation is held from them until review.
5. A person reviews it. Held flags are reviewed within 7 days, and urgent ones sooner. If we believe a student may be in immediate danger, we contact their parent or guardian. Where the law allows or requires it, we contact emergency services or report suspected abuse or exploitation to the authorities.
6. We keep a record. Each flag, and how it was handled, is logged and kept as section 7 describes.

No one watches conversations live, and automated checks can miss things. If someone is in danger, call 911.

10. Security

Data is encrypted on its way to and from the Service. Access rules keep each family to its own data, and we limit which of our people can see what. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

11. Changes

We may update this policy. We will tell you by email or in the Service before a material change takes effect.

12. Contact

• Yia, LLC
• 117 S Lexington Street, Suite 100, Harrisonville, MO 64701
• jake@yiafirm.com