Privacy Policy

Last updated: October 2026

Who runs ThinkStep

ThinkStep is a small, independently-run tutoring app. This policy explains what information it collects from users — including children — and how that information is used, stored, and protected.

Information we collect

When you use ThinkStep, we may collect:

• Account info (if you sign up): a name, a grade level (1–12), a password (stored as a secure hash — we never see or store your actual password), and an email address: your own if you're 13 or older, or a parent or guardian's if you're under 13.
• Progress counts (accounts only): for each day, how many questions were asked, how many homework photos were sent, quiz scores, and badges earned — never what was asked. These counts are kept for about 40 days and are only used for the progress dashboard.
• Profile picture (only if you choose one): an emoji or a picture you pick is saved only in your own browser on your device. It is never uploaded to ThinkStep.
• Chat messages: what you type to the AI tutor, so it can respond to you. Chat history is used to keep the conversation working and is not sold or shared with advertisers. As a safety measure, if a message contains language that may indicate someone is in danger (for example, mentions of self-harm or being hurt by someone), that message is automatically logged so the app's operator can check in — see "Your safety" below.
• Homework photos (only if you send one): the photo is sent to Groq so the AI can read the problems on it (or, with "Check my work", read your steps and find the first mistake), then thrown away — ThinkStep never saves photos on its servers. The written-out text of the problems, and a smaller copy of the photo, are kept in your own browser with the rest of the chat. Please only photograph homework — no faces, names, or addresses.
• Guest usage: if you don't create an account, we store an anonymous random ID in a cookie on your device to track how many free questions you've used — this is not linked to your name or any personal information.
• Feedback you submit: if you use the Feedback page, we collect the name, rating, and review you choose to provide.
• Parental consent info: if a user indicates they are under 13, we collect a parent or guardian's email address to request consent before the account can be used, as required by law.
• Read aloud (only if you use it): the text of a tutor reply is sent to Groq to turn it into speech; the audio isn't saved. If that voice is busy, the page may instead download a free voice model (from jsDelivr and Hugging Face) that runs entirely on your own device.

Parent dashboard

When a parent or guardian approves an under-13 account, they get a private link (shown on screen and sent once by email) to a progress dashboard with the counts above. Students 13 and older can open their own dashboard from the Account box. The dashboard never shows what was asked, and anyone with the private link can see it, so please keep it private.

What we don't do

• We do not sell or rent personal information to anyone.
• We do not show ads or use data for advertising.
• We do not collect more information than is reasonably necessary to run the app.
• We do not knowingly allow a child under 13 to create or use an account without a parent or guardian's verified consent.

Children's privacy (COPPA)

ThinkStep is built with kids in mind, and we take children's privacy seriously. If a user tells us they are under 13, we require a parent or guardian's email address before their account is created, and we send that parent a consent request. The account cannot be used to chat with the AI tutor until that consent is confirmed.

Parents and guardians have the right at any time to:

• Review the personal information we have collected about their child
• Request that we delete their child's account and associated information
• Refuse to allow further collection or use of their child's information, and revoke previously given consent

To do any of this, a parent or guardian can email us at the address below — we will respond and act on the request as quickly as we reasonably can.

Your safety

ThinkStep's AI tutor is instructed to gently redirect a kid to a trusted adult if they mention being unsafe, hurt, or thinking about harming themselves or someone else. On top of that, an automated keyword check looks for language like this and, if it finds a possible match, logs the message and notifies the app's operator directly so a real person can follow up. This check is simple and imperfect on purpose — it's meant to catch too much rather than too little.

How information is stored

Passwords are never stored in plain text — only a secure, one-way hash. Your chat history is saved in your own browser on your device, not on our servers (except messages caught by the safety check described above). Account and chat data is not shared with anyone except the services below, which ThinkStep needs in order to work.

Services that help run ThinkStep

Each of these only receives what it needs to do its job:

• Groq (the AI that writes the tutor's replies): receives your chat messages, any homework photos you send, and the text of replies you ask to hear read aloud, plus your first name, grade and difficulty setting so replies fit your level. Groq's terms say it does not use this data to train AI models.
• Exa (web search, used through Groq): for some questions that need up-to-date facts, the last few lines of the conversation are used to search the web. Your name, grade and account details are not included.
• Render (website hosting) and Neon (database): run the website and store account information, feedback, and safety-check logs.
• Gmail (email): sends parent-consent, dashboard-link and password-reset emails, and lets the app's operator receive feedback and safety alerts.

We never use these services for advertising, and we don't sell information to them or to anyone else.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. Continued use of ThinkStep after a change means you accept the updated policy.