Privacy Policy

1. Who We Are

TumbleTree is operated as a private preschool communication platform, accessible at www.tumble-tree.com. For questions about this policy, contact us at admin@tumble-tree.com.

2. Information We Collect

We collect the following types of information when you use TumbleTree:

Account information

• Full name and email address (provided during sign-up)
• Password (stored as a secure hash — we never see it in plain text)
• Profile photo (optional, uploaded by you)
• Account role (parent, teacher, or administrator)

Classroom and school data

• Classroom membership and approval status
• Posts, comments, and files you share within your classroom
• Direct messages exchanged between parents and teachers
• Calendar events created by teachers

Information about children

• Child name and classroom enrollment (entered by a teacher or administrator)
• Daily activity reports (mood, meals, nap, activities, notes — entered by teachers)
• Incident reports (filed by teachers, visible to parents of the child)
• Authorized pickup contacts (entered by administrators)
• Health notes (entered by administrators)

Information about children is entered by school staff or authorized parents — not by children themselves. We do not knowingly collect data directly from children under 13.

Contact form submissions

• Name, email address, and message sent through the public contact form

Technical data

• IP address (used for rate limiting on public forms — not stored beyond the request)
• Push notification tokens (if you opt in to browser or mobile notifications)
• Basic server logs maintained by our hosting provider (Vercel)

3. How We Use Your Information

We use the information we collect solely to operate and improve TumbleTree:

• Authenticate your account and verify classroom membership
• Deliver posts, messages, and files within your classrooms
• Send email notifications (e.g., new messages, contact form confirmations)
• Send push notifications if you have opted in
• Display daily reports and incident history to authorized teachers and parents
• Maintain platform security and prevent abuse

We do not use your information for advertising, behavioral profiling, or any purpose unrelated to providing the platform to you.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:

Within your classroom

Posts, files, and messages you create are visible to other approved members of the same classroom. Broadcast messages from teachers are visible to all approved parents in that classroom. Direct messages are visible only to the sender and the specific recipient.

Third-party service providers

We use the following services to operate TumbleTree. Each processes data only as needed to deliver their service:

• Supabase (database, authentication, and file storage) — data stored in the United States
• Vercel (web hosting and serverless functions) — data processed in the United States
• Resend (transactional email) — used to send notification emails
• Google Firebase (push notification delivery for mobile apps) — device tokens only
• Upstash Redis (rate limiting on public forms) — IP address processed ephemerally, not stored

Legal requirements

We may disclose information if required by law, court order, or to protect the safety of any person.

5. Children's Privacy (COPPA and FERPA)

TumbleTree serves preschool classrooms and therefore holds information about young children. We take this responsibility seriously and operate in accordance with the Children's Online Privacy Protection Act (COPPA) and, where applicable, the Family Educational Rights and Privacy Act (FERPA).

Children do not use TumbleTree directly

Children under 13 do not create accounts or interact with TumbleTree. All information about a child — including name, classroom enrollment, daily reports, and incident records — is entered and managed exclusively by school staff or the child's authorized parent or guardian.

School responsibility for COPPA consent

Under COPPA, schools may consent to the collection of children's information on behalf of parents for educational purposes. By enrolling students in TumbleTree, schools represent that they have provided parents with appropriate notice and have obtained any required consents, consistent with COPPA's school-consent exception (16 C.F.R. § 312.5(b)(1)).

FERPA — student records

For schools subject to FERPA, TumbleTree acts as a "school official" with a legitimate educational interest, as defined under 34 C.F.R. § 99.31(a)(1). We use student education records only to provide the platform to the school and do not disclose, sell, or use student records for any other purpose. The school remains the data controller and retains full ownership of all student records.

How children's data is used

• Used only to operate classroom features: displaying reports, incident history, and student profiles to authorized teachers and parents.
• Never used for advertising, analytics, or any purpose unrelated to the classroom.
• Never shared with any party other than authorized school staff and the child's own parent or guardian.

Parental rights

Parents and legal guardians may, at any time:

• Request to review the information we hold about their child.
• Request correction of inaccurate information about their child.
• Request deletion of information about their child — we will complete deletion within 30 days of receiving a verified request.

To exercise any of these rights, email admin@tumble-tree.com with the subject line "Children's Data Request" and include your name, your child's name, and the name of their school.

Retention of children's data

Information about a child is retained for as long as the child is enrolled at an active TumbleTree school. Schools or parents may request deletion at any time. When a school closes its TumbleTree account, all associated student data is deleted within 60 days.

6. Data Retention

We retain your account information and associated data for as long as your account is active. If you would like your account and data deleted, contact us at admin@tumble-tree.com and we will remove your account and personal data within 30 days.

Contact form submissions are retained for up to 12 months and then deleted.

7. Security

We take reasonable technical and organizational measures to protect your information, including:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Passwords are never stored in plain text (managed by Supabase Auth)
• Files are stored in private buckets and served only via signed, time-limited URLs
• Classroom access is enforced at the database level via row-level security policies
• All accounts require administrator approval before accessing any classroom content
• Rate limiting is applied to public-facing forms to prevent abuse

No system can guarantee absolute security. If you believe your account has been compromised, contact us immediately at admin@tumble-tree.com.

8. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated personal data
• Withdraw consent to push notifications at any time through your browser or device settings

To exercise any of these rights, email us at admin@tumble-tree.com. We will respond within 30 days.

9. Cookies and Local Storage

TumbleTree uses both browser cookies and local storage to keep you signed in and remember your preferences.

Authentication cookies

Supabase Auth sets HTTP session cookies to maintain your signed-in state across page loads. These cookies are strictly necessary for the platform to function and cannot be opted out of while using TumbleTree. They are scoped to tumble-tree.com, are not accessible to third parties, and expire when your session ends or you sign out.

Local storage preferences

We use browser local storage (not cookies) to remember non-sensitive preferences such as your sidebar state, light/dark theme, and push notification enrollment. This data stays on your device and is never transmitted to our servers.

No tracking or advertising

We do not use tracking cookies, advertising pixels, analytics scripts, or any third-party cookies. The only cookies set on tumble-tree.com are the Supabase authentication cookies described above.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of TumbleTree after a change constitutes acceptance of the revised policy. For material changes, we will notify users via email or an in-app notice.

11. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy, please contact us: