Child Safety and Privacy

This page describes exactly what the site does today, written to be accurate rather than to sound reassuring. Last updated 2026-10-27 (version 2026-10-27). See also our Children's Privacy Statement (COPPA).

Who we are

Who we are. This site (danstudypath.com) is operated by 4Learn Motto LLC, a Maryland limited liability company. Email: contact@4learnmotto.com. Questions about privacy or this policy can also go through the Contact page.

Children never register directly

This is the center of how we handle a child's information: a child cannot create an account, and we never collect a child's contact details. Only a parent or legal guardian can register, using their own email and identity. A parent then optionally creates a "learner" profile for a child — a first name or nickname, a grade, and a username and password (hashed, never shown in plain text). We do not ask a child for their last name, address, phone number, photo, or email, and there is no page anywhere on the site that asks a child to type in contact information.

A child can also practice with no account at all, as a guest. Guest practice is tied to a randomly generated session number, not a name, and stops working the moment the browser session ends unless a parent creates an account.

What we collect, and why

• Parent accounts: name, email address, role (parent or guardian), the date they agreed to these terms, the date they confirmed reading our content and standards notice, and a password stored only as a one-way hash (we cannot read it back, even if asked to). Email is used to confirm the account, send password resets, and (only if a parent opts in) a weekly progress summary.
• Learner profiles: first name/nickname, grade, username, and a hashed password. Created only by a signed-in parent, never by a child directly.
• Practice answers: which question was answered, whether it was correct, and when. For a guest, this is tied to a random session number; for a signed-in learner, it is tied to that learner's profile so progress and stars follow them.
• Server logs: for abuse protection, we log a coarse version of the network address (the first three number groups only, e.g. 203.0.113.x for IPv4 — never the full address) alongside the page requested. This is not stored with a name and is not usable to identify a specific device.
• Sign-in places: when a grown-up signs in, we store a one-way code made from the shortened network address (never the address itself) so we can notice when an account is used from an unusually large number of different places in one day and email the account owner. We do not block anyone for this. Codes are deleted after 30 days and when the account is deleted.
• Read-aloud: when someone taps the read-aloud button, the question text that we wrote (never anything a child types) is turned into speech by a speech service we use, and we keep the recording so it can be played again. No name, account or other personal information is sent with it.
• Cookies: one session cookie that keeps a practice session and sign-in working. It carries no advertising identifier and is never sold or shared with an ad network. Technical detail for the curious: it is marked HttpOnly (JavaScript cannot read it), Secure (sent only over HTTPS), and SameSite=Lax.
• If you write to us: the name, email and message you send through the Contact or Plans page, kept so we can reply. A "report a problem" tap on a question sends only which question it was and the reason picked from a list, nothing typed and nothing about the child.
• If you pay for a plan: billing is handled by Stripe on a page hosted by Stripe, not by us — we never see or store a card number. We keep only Stripe's own reference IDs (a customer ID and a subscription ID) so we know an account is paid. See Stripe's own privacy policy for how they handle payment data.

Companies that help us run the site

We use a small number of trusted service providers to host the site, send account emails and process payments for paid plans. They may use your information only to provide those services to us, and the data stays in the United States.

We do not use an advertising network, a third-party analytics/tracking pixel, or a chat/support widget that would send visitor data to yet another company.

What we do not do

• We do not sell or rent personal information, to anyone, for any reason.
• We do not show ads or use ad trackers.
• We do not offer chat, comments, or any way for children to share content or contact each other or a stranger.
• Practice questions never link to outside websites.
• We do not knowingly collect personal information directly from a child under 13. If we ever learn that a child has provided personal information to us directly (for example, by typing it into a text field meant for something else), we will delete it as soon as we find it — tell us via Contact if you spot this.

How we protect data

• Passwords are stored as one-way hashes, never as plain text, using a standard modern hashing algorithm (Werkzeug's password hashing, currently scrypt-based).
• Pages are served over HTTPS only, with security headers including a Content-Security-Policy, HSTS, and X-Frame-Options set to deny embedding this site in another page.
• Login, registration, password-reset, and answer-submission endpoints are all rate-limited to slow down automated abuse.
• Progress pages show only the current student's own results, never other people's data or email addresses.
• We keep only what is needed to save practice progress and improve the questions.
• The database is continuously backed up (point-in-time recovery, roughly a 4-week window), so it can be restored after an accident, not only protected against a device failure.

How long we keep data

• Agreement records: each time a grown-up signs the agreement we keep the version accepted, the time, the account email, which boxes were ticked, the typed signature and a shortened network address. We keep these for the life of the account and for at least four years afterward, even if the account is deleted, so we can show what was agreed.
• Free trial record: when a grown-up starts the free trial, we keep a one-way code made from the account email (the email cannot be read back from it) so each email gets the free trial only once. This code stays after the account is deleted. It holds nothing else: no name, child data or practice history.
• If an account has had no activity for 12 months, we email the parent a notice with two choices: keep the practice history, or remove it now. We send a reminder 30 days later. Practice history is never removed automatically: after both notices with no reply, a person on our team reviews the account and decides, no sooner than 30 days after the reminder. Only the practice history is removed (answers, results and progress); the account and learner profiles stay. Copies in backups are removed on a rolling schedule, within 35 days.
• A parent or guardian can delete practice history immediately, any time, from My Progress — you do not need to wait for that year.
• Deleting a parent account (see below) deletes its learner profiles and their practice history with it.

Your choices and rights (parents and guardians)

• Review and download: a parent account's own page can download everything stored for it and its learners as a data file, any time, with no waiting period.
• Delete practice history at any time from My Progress, without deleting the account itself.
• Delete an account entirely, self-service, from the account page: request deletion, confirm it via a one-time emailed link, and the account, its learner profiles, and their practice history are permanently removed. Nothing is deleted until that link is opened.
• Ask any privacy question through the Contact page.
• Children under 13 should use the site with a parent's or guardian's involvement, since only a parent or legal guardian can create or manage the account they practice under.

Schools and FERPA / Maryland student-data law

Our Classroom plan is meant for teacher-led use. If a school or district asks us to sign a data-processing or student-data-privacy agreement as a condition of use, we are open to that discussion — contact us before rolling the site out at a school. Absent a specific agreement, treat this policy as governing use, the same as an individual family account.

Content safety

Every question and explanation is checked against a safety list (no bullying, violence, or scary content) and written to be kind. If you see anything that should be fixed, use the report button on the answer page or the Contact page.

Changes to this page

If we change what we collect or how we use it, we will update the date at the top of this page. We will not weaken these protections for existing data without telling parent account holders first.