Legal
Effective date: October 12, 2026
Updated October 12, 2026. Four changes, and nothing about student accounts changed. First, we switched off Google's remarketing feature, so visiting our site no longer puts you on a Google advertising list (section 7). Second, to match a signup or a purchase to the ad that led to it, Google now also receives a scrambled (hashed) form of the email address you give us on a signup form, and for a purchase, a scrambled form of the buyer's first and last name plus their ZIP code and country, details Meta already receives for a purchase (section 6). Third, anyone, not only parents, can now use the rights in section 11, and section 11 explains how to appeal if we turn a request down. Fourth, section 8 now says plainly that we do not use anyone's information to train AI models, and section 2 now says "precise" location, because our analytics tools estimate a visitor's general area from their IP address.
Updated September 25, 2026. Four changes, and nothing about how we handle student accounts changed. First, two companies are back in section 6 that we took out in August because we had not switched them on yet. They are on now: Meta, which tells us which of our Facebook and Instagram ads bring families to the site, and MailerLite, which sends our email newsletter. Sections 6 and 7 say exactly what each one receives, and neither receives a student's name, account, or schoolwork. Second, the Global Privacy Control signal now switches Meta off completely on your browser, not only Google's advertising storage (section 7). Third, sections 1 and 13 now give our legal name and mailing address. Fourth, section 9 now says plainly that when we delete something, copies can remain in our automatic backups for up to 98 days before those backups expire.
Updated September 5, 2026. Three corrections after an internal audit, all in your favor. Section 6 now names two more companies we use behind the scenes (Anthropic and Slack), neither of which receives any student information. Section 8 now lists every feature that sends data to Google's Gemini models, not just four of them, including the optional AI study assistant and the safety screen that protects it. And assignment notification emails no longer carry your student's name, so of the emails we write, a student's name now reaches our email provider only in the optional weekly progress email, exactly as this policy says.
Updated August 26, 2026. Two changes. We now use Google Ads to measure which of our ads bring families to the site, on our public marketing pages only, and section 7 says exactly what that involves and how to turn it off. We also removed two tools this policy described but which we had not actually switched on, because a policy that lists things we do not do is not worth much. Nothing about student data changed, and nothing new is collected from a student. Sections 6 and 7 carry the detail.
Genesis K12 Academy LLC ("we") operates the Genesis K-12 Academy learning platform ("the Platform"). We teach hands-on engineering to homeschool students in grades 6 through 8 from a Biblical worldview. Our students are children, so this policy is written to be read by their parents. Contact us at team@gk12academy.com with any privacy question, or write to us at Genesis K12 Academy LLC, 8301 Sandstone Ct, Tampa FL 33615.
We collect only what the course needs to work:
We do not collect birth dates, phone numbers, home addresses beyond kit shipping, photographs of faces for identification, or precise location data such as GPS. Our analytics and advertising tools on our public pages do estimate a visitor's general area, such as their city, from the IP address.
Genesis K-12 Academy is built for middle school students. Every student account is created by a parent or guardian and stays linked to that parent's account. We comply with the Children's Online Privacy Protection Act (COPPA):
How we verify that you are the parent
Every family reaches us through a purchase before any student account exists. You buy the course, our payment processor (Stripe) charges your card and emails you a receipt for that transaction, and only then do you receive a code to create your account. A payment card transaction that notifies the account holder is one of the methods the Federal Trade Commission recognises for verifying parental consent, and it is the method we rely on.
Before you create a student account, we also show you a plain-language notice of exactly what we collect from your student, how we use it, who else receives it, and how you can review or delete it. You confirm you are the parent or guardian and agree to that notice. We keep a record of both halves: the transaction that verified you, and the notice you agreed to, including its version and date.
You can withdraw your consent at any time from your account settings, or by emailing us. See section 11.
We use what we collect to:
We do not sell, rent, or trade personal information. We do not share it with anyone for their own marketing. The only outside companies that touch your data are the service providers listed in section 6, and they handle it only to do the job we hired them for. The one qualification is advertising measurement: Google and Meta also apply what their advertising tools collect on our public marketing pages under their own terms. Section 7 explains what that means and how to switch it off.
These are every outside company that receives data from the Platform, and what each one gets:
Advertising and marketing tools run on our public marketing pages only. None of them run on the dashboard, on a course page, or on a lesson page. If we add another one, it goes on the public pages under the same rule and this policy is updated to name it.
On student pages we use no analytics and no tracking cookies at all. The dashboard, every course page, and every lesson page load without Google Analytics. No analytics tag is loaded there and no analytics cookie is set there.
On our public marketing pages (the homepage, course pages, the store, and similar) we use Google Analytics to count visits and understand which pages people read. It sets two first-party cookies, named _ga and _ga_ followed by a property code. They tell a returning visitor from a first-time visitor and group page views into a single visit. They expire on their own after two years, and you can delete them at any time from your browser settings.
We configure Google Analytics with Google Signals turned off, and we do not use it to build advertising audiences. Google Ads runs with its remarketing feature switched off too: it measures which ad led to a signup or a purchase, and it does not put visitors to our site on a list for later ads.
On those same public marketing pages we also run Google Ads conversion tracking, so we can tell which of our ads actually led to a purchase or a signup rather than guessing. It sets cookies whose names begin _gcl_, which record that you arrived from one of our ads. That is genuinely advertising, not just measurement, so we want to be plain about it: it lets Google connect your visit here to the ad you clicked. You can manage what Google does with it at myadcenter.google.com, you can block or delete the cookies in your browser, and you can switch the whole thing off on this browser using the control below.
On the same public marketing pages, apart from this policy, our terms, and our support page, we also run the Meta pixel, so we can tell which of our Facebook and Instagram ads led to a signup or a purchase. It sets a first-party cookie named _fbp, and one named _fbc when you arrive from a link on Facebook or Instagram. This is advertising too: it lets Meta connect your visit here to the ad you saw, and to your Facebook or Instagram account if you have one, and Meta uses it under its own terms. Section 6 lists exactly what Meta receives, including the signup and purchase records our server sends. You can manage what Meta does with it in the ad settings of your Facebook or Instagram account, you can block or delete the cookies in your browser, and you can switch it off on this browser using the control below.
We honor the Global Privacy Control signal. If your browser sends it, you do not have to do anything else: we do not load the Meta pixel on that browser at all, our server sends Meta nothing about a signup or purchase made from it, and we switch Google's tags to a mode that stores no advertising cookies and strips ad click identifiers from what they send. Google Analytics still counts the visit, because that measures our own pages and is not used for advertising.
None of this runs on student pages. The dashboard, course pages, lesson pages, our free lesson preview, and our student dashboard demo load no analytics tag and no advertising tag of any kind. A student is never added to an advertising audience. And once a browser has been used to sign in to a student account, we delete the analytics and advertising cookies on it and stop loading those tags on that browser everywhere, including here.
Separately, the Platform uses ordinary sign-in storage to keep a signed-in user signed in and to remember a browser tab's session. That is not tracking and it is not shared with anyone.
Your privacy choices
We do not show a cookie banner, because we advertise only in the United States and we are well below the size at which an opt-in prompt is required. What we do instead is give you a real switch and honor Global Privacy Control. The switch is per browser and per device. Switching it off also stops our server from reporting to Meta any signup or purchase you make from this browser.
You can turn off advertising measurement on this browser. We will delete the analytics and advertising cookies already on it and stop loading those tags here. This applies to this browser on this device, so it is a per-device choice, and clearing your browser storage will undo it.
These features send data to Google's Gemini models. We want to be specific about what leaves the Platform:
We use Google's paid Gemini service. On the paid service, Google does not use what we send, or what the model returns, to train or improve its models.
We do not use AI to make decisions about a child outside the course, to build a profile of a child, or for any advertising purpose.
We do not use anyone's personal information to train AI models, our own or anyone else's, and we do not use personal information to make automated decisions about anyone that have legal or similarly significant effects.
The in-lesson AI study assistant is currently turned off and is not available to students, apart from the anonymous demo on our public lesson preview, which is not connected to any account. When we do turn it on, parents will be able to turn it off for each student individually. Study assistant conversations are saved for 90 days so you can read them from your parent dashboard, and are deleted automatically after that.
We keep each kind of record only as long as we need it. This is our schedule:
| Record | How long we keep it |
|---|---|
| Parent and student accounts, and all progress data | 24 months after the last sign-in on the account, then deleted |
| Student work uploaded for feedback or grading (build photos, assignment files) | The 18 month course access period, then deleted within 30 days of it ending |
| Grades and written feedback on that work | With the account, so 24 months after the last sign-in |
| Answers to the short end-of-lesson course feedback form and the course rating pop-up | 24 months from the date the answer was sent. These are not linked to a student, so they are not deleted with an account |
| AI study assistant conversations | 90 days, visible to you from your parent dashboard, then deleted automatically |
| Purchase, order, and kit shipping records | 7 years, which is what tax and accounting rules require |
| Unredeemed claim codes from a purchase | 12 months from the date of purchase, then they expire |
| Website analytics records from our public pages | 18 months |
| Advertising measurement data held by Google Ads | Governed by Google's own retention policy. You can turn this off on your browser at any time using the control in section 7, or manage it at myadcenter.google.com |
| Ad click identifiers we store with an order record | 18 months, the same as our other website analytics records |
| Support email and support tickets | 24 months |
| Email list signups (your address, which form you used, and how you found us) | Until you ask us to delete it. Unsubscribing stops the emails but does not delete the record |
| Anything you ask us to delete | Deleted from the Platform within 30 days of the request. Copies in our automatic backups expire up to 98 days after that (see below) |
When a record reaches the end of its period we delete it. Where a purchase record has to be kept for tax reasons, we keep the transaction and drop the personal detail attached to it once the account itself is deleted.
Backups. So that we can recover the Platform if something goes wrong, our database is backed up automatically every day and each backup is kept for 98 days. We can also roll the database back to any moment in the last 7 days. So when we delete something, whether its period ran out or you asked us to, it is gone from the Platform at once, but copies can remain in those backups until the last of them expires, up to 98 days later. Backups are encrypted and are not used to run the Platform.
We use encrypted connections (HTTPS) everywhere, Firebase Authentication for sign-in, and rules on our database that let a parent see only their own family's records and a student see only their own work. Uploaded files are stored with access tokens rather than public links, and course videos play through signed links that expire. No system is completely secure, so please use a strong, unique password on every account.
Parents and guardians may, at any time: see the data we hold about their child, correct anything wrong, download or request a copy of it, have it deleted, and withdraw consent for us to collect any more. Withdrawing consent means we close the student's account, because the course cannot run without it.
The fastest way is from your account: sign in and open Account settings, where Your family's data lets you download everything we hold about your family straight away, or send us a deletion request. You can also email team@gk12academy.com from the address on the parent account and tell us what you want. Either way we answer within 30 days and we do not charge for it.
These rights are not only for parents. Anyone we hold information about, such as someone on our email list or a visitor who bought from us, can ask to see it, correct it, get a copy, or have it deleted, and can opt out of advertising measurement using the switch in section 7 or the Global Privacy Control signal. Email team@gk12academy.com with your request. If we turn a request down, we tell you why, and you can appeal by replying to that answer and asking us to reconsider. We decide an appeal within 60 days and tell you the outcome in writing, and if you are still not satisfied, we tell you how to contact your state attorney general.
We may update this policy as the Platform changes. If a change is material, we will email enrolled families before it takes effect. The effective date at the top of this page always reflects the most recent version, and material changes are summarized there.
For privacy questions, data requests, or anything COPPA related, contact us at team@gk12academy.com.
By mail: Genesis K12 Academy LLC, 8301 Sandstone Ct, Tampa FL 33615.