Privacy policy

Last updated October 15, 2026. Hero Sprouts Learn is a Capeling Press product. Plain-language summaries sit above each section; the section text is what applies.

Short version: we keep as little as possible. A parent account holds an email and a password hash. Child data is described in the children's privacy notice. We use no advertising or analytics trackers on any page. You can download or delete everything yourself.

1. Controller

Capeling Press operates Hero Sprouts Learn (learn.herosprouts.com). Contact: privacy@herosprouts.com.

2. Data we process

• Parent account: email address, password (stored as a hash by our authentication provider), optional parent PIN (stored as a hash), plan and trial dates, subscription status from the payment provider.
• How you found us: when a grown-up creates an account we keep which link or campaign brought them (for example "pinterest") and their optional answer to "How did you hear about us?", only to learn which channels help families find us; no cookies or third-party trackers are used.
• Child profiles and progress: as described in the children's privacy notice.
• Technical logs: our hosting provider keeps short-lived request logs (IP address, user agent, URL) for security and to keep the service running. We do not use them to profile anyone.

3. Why and on what basis

To provide the service you asked for (contract), to keep it secure (legitimate interest), and, for child data, with the parent's consent given at sign-up. We send service emails (account confirmation, password reset, receipts). Marketing email only if you opt in, and every such email has an unsubscribe link.

4. Processors

Cloudflare (hosting and content delivery), Supabase (database and authentication, EU region), Lemon Squeezy (payments and tax, as merchant of record), and our email provider for service messages. Each processes data under a data-processing agreement.

5. Retention

Account and progress data stay while the account exists. Deleting the account removes everything within 30 days, except invoices the payment provider must keep for tax law. Guest data lives only on the device.

6. Your rights

Access, correction, download (portability), deletion and objection. The Account page covers download and deletion directly. For anything else, email us. If you are in the EU or UK you may also complain to your data-protection authority.

7. Cookies and storage

We use browser local storage for guest progress, settings such as sound on or off, and the sign-in session. No advertising or analytics cookies.

8. Security

Data travels over HTTPS. Database rows are protected by row-level security so a parent can only ever read their own family's data. Progress writes go through a single server function that validates every record.

9. Changes

We will post changes here with a new date and email account holders about material changes.