Children's Privacy Notice

Effective October 27, 2026. Brigade Management, Inc. ("Baccare," "we," "us"). Notice version children-2026-10-27.

Changes coming December 4, 2026. We are adding the weekly summary to the AI features described in this notice. If consent is verified (section 3.2) and you leave the weekly summary on (Settings, Reminders), once a week Baccare will send Anthropic, our AI provider, the practice your child finished that week: each activity's name, its best score and how many times it was played, minutes of practice, topics that reached 80%, checks taken, sports drills marked done, and your child's grade. Your child's name and anything your family typed will not be sent. Anthropic will return a few sentences, which we will put in your weekly email. You can turn it off at any time. This version of the notice applies until December 4, 2026. From that date, the app will ask a Parent to agree to the new version, and nothing is sent for the weekly summary until a Parent agrees.

Plain-English summary (the full notice below controls): This notice is for parents. It says what Baccare collects about your child, why, who receives it, how long we keep it, and how you can review it, delete it or stop it. Consent works in two steps. First, you agree to this notice before you add a child; that lets your child use everything that stays inside Baccare. Second, before anything about your child goes to an outside company (Ask Bacc and Notes Studio, which use our AI provider, and the microphone, which uses your browser's speech service), we verify that the consent comes from a parent: by a card charge (a $1 charge when you start the free trial, credited to your first bill), or by a signed consent form. Your child never has an account. We never sell your child's information, never use it for ads, and never use it to train AI. This notice is part of our Privacy Policy, which uses the same terms.

1. Who we are and how to reach us

Baccare is operated by Brigade Management, Inc., a Texas corporation. We are the only operator that collects or keeps children's personal information through baccare.com, app.baccare.com and our iPhone, iPad and Android apps (the "Service"). You can reach us about children's privacy at:

Email: privacy@baccare.com
Phone: (469) 712-7465
Mail: Brigade Management, Inc., Attn: Privacy, 3400 Coit Rd. #262084, Plano, TX 75026
Online: the contact form (choose the Privacy topic)

In this notice, "you" means the child's parent or legal guardian who holds the Baccare account (the "Parent"), and "your child" means a child you add to your account (a "Learner"). We give every Learner these protections, including Learners who are 13 or older. This notice is our online notice under 16 C.F.R. § 312.4(d), part of the Federal Trade Commission's rule under the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506; 16 C.F.R. part 312, as amended at 90 Fed. Reg. 16918 (Apr. 22, 2025)).

2. What we tell you before you consent

Before you agree, the app shows you a short notice with a link to this one. Together they are our direct notice to you (16 C.F.R. § 312.4(c)), and they tell you:

that you gave us your own email address when you created your account, and that we did not get it, or anything else about you, from your child;
that we need your consent before we collect, use or disclose any information about your child, and that we collect nothing about a child without it;
what we will collect about your child (section 4), how we will use it (section 7), and the outside companies that will receive it and why (section 8);
how you give consent and how we verify it (section 3); and
how to review or delete your child's information, refuse further collection, and withdraw consent (section 10).

If you do not consent, we collect nothing about any child. Your own account information is yours: we keep it under the Privacy Policy until you delete the account, and it was not collected to ask for consent, so there is nothing to delete for that reason.

3. How consent works: two steps

3.1 Step 1: you agree to this notice

Before you add a child, and before Child mode can start, a parent or legal guardian reads this notice and checks the box that says: "I am this child's parent or legal guardian. I have read the Children's Privacy Notice and I agree to Baccare collecting and using my child's information as it describes." The box is not checked in advance. We record the time you agreed and this notice's version. No child can be added without that record, and one recorded agreement covers the children later added to your family until we ask again (section 13).

Step 1 lets your child use everything that stays inside Baccare: practice, lessons, games, rewards, progress and the Calendar.

3.2 Step 2: we verify your consent before anything goes to an outside company

Some features send a child's information to a company outside Baccare: Ask Bacc, Notes Studio and Study plans send it to Anthropic, PBC, our AI provider, and the microphone sends a child's voice to the speech service built into the browser (Google, Microsoft or Apple). Before any of them works for a child, a Parent in the family must verify consent in one of two ways (16 C.F.R. § 312.5(b)(2)):

A real card charge. A charge to your card verifies consent automatically (16 C.F.R. § 312.5(b)(2)(ii)), and Stripe, our payment processor, emails you a receipt for each charge. When you start the 14-day free trial without verified consent, we charge your card $1 right after checkout for this purpose and credit the $1 to your first Family plan charge (it is not refunded if you cancel during the trial). The first charge for the Family plan, or for an extra pack, also counts.
A signed consent form. In the app under Plan & billing → Verify parental consent, read the consent statement, type your name and sign it on screen with your finger or mouse; or print the Parental Consent Form, sign it, and upload a photo or PDF of it there, or mail it to us (16 C.F.R. § 312.5(b)(2)(i)). Baccare staff review each form, usually within two business days, and approve it or reject it with a reason. If a form is rejected, you can send a new one.

Until consent is verified, Ask Bacc, Notes Studio and the microphone stay off for your children, and everything in Step 1 keeps working. A verification by one Parent covers the children in that family. A Parent may still use Ask Bacc and Notes Studio for the Parent's own questions, with no learner chosen and outside Child mode.

3.3 School, co-op and TEFA codes

Families who join Baccare with an access code from a school, a co-op or a Texas Education Freedom Account (TEFA) program give consent and verify it in exactly the same way. A code is not consent, and a school, co-op or program cannot consent for you. The Federal Trade Commission did not add a school-authorization exception to its rule when it amended the rule in 2025. A family on a code pays nothing, so it verifies with the signed consent form, or by buying an extra pack.

3.4 No consent is needed for disclosures we do not make

The rule requires a separate choice before a child's information is disclosed to third parties when that disclosure is not integral to the service (16 C.F.R. § 312.5(a)(2)). We make no such disclosures: we show no ads, sell nothing, and give nothing to data brokers or anyone else for their own purposes. The only outside companies that receive your child's information are the service providers that run the features you use (section 8.1), and the speech services that make the microphone work. So we do not ask you for a separate disclosure consent. The ways you can choose to share your child's information with other people through Baccare, such as a teacher's group or a study pod (section 8.2), are each a separate choice you make only when you take that step, and you can undo each one.

3.5 The records we keep of your consent

Step 1: the time you agreed and this notice's version, kept after the account is deleted as the record that consent was given, no longer linked to the account.
A signed form: the file you upload (or the paper you mail) is kept while your account is open and deleted with the account.
Step 2: the record that consent was verified (the method, the date, and that a Baccare staff reviewer approved a form, or the payment reference for a charge) is kept for 4 years after the account is deleted, no longer linked to it.

4. What we collect about your child, and how

What	Who enters it	Why
First name (or nickname), grade (pre-K–8) and avatar. Required.	You.	To set up your child, pitch work at the right grade, and show it under the right name.
Optional details: school, teacher, interests, strengths, goals, what your child is working on, notes for Bacc; classes and the order each covers the standards; Calendar entries; weekly notes; goals and rewards.	You (or another adult in your family).	To make practice and Ask Bacc's help specific to your child.
Optional learning preferences and learning supports (switches such as "reading takes extra effort," and a note of up to 300 characters that is refused if it names a diagnosis).	You.	To adapt how Bacc explains and paces. We treat these as sensitive.
Practice results, skills check and level check results, math facts drill results (only if you turn the drill on), lessons finished, flashcard schedule, study time, points, badges, Bacc Bucks, screen name (from fixed word lists), races and climbs, sports drills, printable missions, real-world project days and family activities you mark done.	Recorded as your child uses Baccare.	To choose what to practice next and show you progress.
Ask Bacc messages (up to 600 characters each) and Bacc's replies, with safety flags. After verified consent only.	You, or your child in Child mode, by typing or by the microphone.	To answer questions and coach; to let you read every conversation; to keep your child safe.
Notes Studio notes and requests, photos and PDFs of class pages, and results. After verified consent only.	You, or your child in Child mode.	To make quizzes, flashcards and study notes from class material.
Canvas courses, assignments, due dates, scores, announcements, and the student's name as Canvas shows it.	Canvas, only if you connect your parent (observer) account.	To put schoolwork on your Calendar and give Bacc context.
Events from a school calendar feed.	The school portal, only if you add the feed.	To put school dates on your Calendar.
Reports from school: the kind, name and date of a report you choose to keep, your takeaways in your own words, and, if you add it, a photo or PDF of the report.	You.	To keep a report where you plan your child's learning, and to share it only with the teachers, specialists or tutors you pick. Never sent to our AI provider, never shown to your child, and never used to rate your child. We treat these as sensitive.
Persistent identifiers (section 6).	Collected automatically.	To run the Service, as section 6 lists.

First name only, please. We ask for a first name or nickname. The field cannot check what is typed, so please do not enter a full name.
Canvas names. The name Canvas gives us is usually your child's full name. It is stored with the Canvas connection, which you can remove at any time.
Photos in Notes Studio. A photo or PDF of a class page can show your child's name, handwriting or anything else on the page. Please photograph only the page, never a face.
Reports from school. A report can show your child's full name, school, student ID and scores. Keep only reports you want in Baccare. You can delete the file and keep your takeaways, or delete the whole report, at any time.
Words about health. Words naming a medical or learning condition that you or your child type to Ask Bacc are replaced with "[removed]" before the message is stored or sent to the AI.
Nothing public. Your child cannot message anyone, post anything publicly, or have a profile others can search.
Never collected: birth date, email address, phone number, home address, precise location, government identifiers, biometric information, audio recordings, or a photo of your child.

Students in a school's Canvas course. A school can add Baccare activities to its own Canvas courses. A student then opens an activity from Canvas without a Baccare account, and Canvas sends us an identifier for the student and the student's given name and role. We use them only to run the activity and send the score to the school's gradebook, under our School Data Addendum. Nothing from those sessions goes to our AI provider, and the microphone is not offered there. You can link that work to your family's account with the pairing code shown.

5. The microphone

Practice questions ("Say your answer"), Ask Bacc and Notes Studio quizzes have a microphone button. It is offered only inside the signed-in app at app.baccare.com, in a web browser, on a Parent's account, and for a child only after a Parent has verified consent (section 3.2). It is never offered on the public practice pages of baccare.com, which a child can open without a Parent's account, and it is not offered in the iPhone and Android apps or inside a school's Canvas.

The microphone uses the speech recognition built into the browser: Google's in Chrome and on Android, Microsoft's in Edge, and Apple's in Safari and on iPhone and iPad. Your child's voice goes to that company, not to Baccare, and the company handles it under its own terms. Baccare never receives, records or stores audio. We receive only the words the browser returns:

In Ask Bacc, the words appear in the typing box and nothing is sent to us until Send is tapped; we treat them like typed text.
On a practice question with a typed answer, the words only fill the answer box. On a multiple-choice question, the child says the letter or the answer, and Baccare picks out that choice for the child to confirm. On a question that asks to put cards in order or sort them into groups, the child says the cards (and, to sort, the groups), and Baccare places them where the child can still move them before checking. Every way, we record the result as we do for a typed or tapped answer, and never the words themselves.

The browser asks before the microphone is used the first time, and you can turn that permission off in its settings at any time.

6. Persistent identifiers and what they are used for

Some identifiers are needed just to run the Service, including on the Free Play and Learn pages that need no account. We use them only for these internal operations:

keeping the Parent's account signed in (a sign-in session stored in the browser);
keeping Child mode on and showing the right child's work (a Child mode flag and the current learner, stored in the browser);
saving and showing your child's work (internal identifiers for the account and each Learner);
delivering pages, protecting the Service and stopping automated abuse (IP address and device details in our hosting providers' logs, Cloudflare's security cookies and its Turnstile bot check);
applying daily limits (usage counts per Learner);
measuring whether the Service works, in aggregate (cookieless visit counts from Cloudflare Web Analytics, where turned on); and
running an activity a school opened from Canvas (a session token for that launch).

We never use these identifiers to contact a child, for advertising of any kind, to build a profile of a child, or to follow anyone across other websites. We do not put advertising or analytics tracking code in the Service. The Cookie Policy lists each item.

7. How we use your child's information

To provide the learning features you see: practice, progress, the Calendar, and, after verified consent, Ask Bacc and Notes Studio; to show you and the adults you choose how your child is doing; to keep your child safe (every Ask Bacc message is screened before and after the AI, flagged exchanges appear for you on the Ask Bacc conversations page, and a reply about self-harm gives the 988 Suicide & Crisis Lifeline); to secure the Service; and to comply with law.

We never sell or rent your child's information; use it for advertising; build a profile of your child beyond the practice record and learner card the learning features use; use it, or let anyone use it, to train AI models; diagnose or screen for any condition; or contact your child.

8. Who receives your child's information

8.1 Service providers that run Baccare

These providers are needed to operate the Service and receive only what their part needs:

Anthropic, PBC (AI provider), after verified consent only: for Ask Bacc and Notes Studio, your child's first name and grade, the learner's card, classes, nearby Calendar entries, class assignments and documents, a practice summary, preferences and supports, the conversation or notes, and uploaded pages. The full list is in section 6 of the Privacy Policy. Anthropic's commercial terms provide that it does not train its models on this information and deletes it within 30 days, except content its safety systems flag, which it may keep for up to two years, and except where the law requires it to keep it. For Study plans, only the titles of Calendar items from one class, the subject and grade, and the names of Baccare activities, never your child's name.
Supabase, Inc. (database, sign-in, file storage, encrypted secret storage), in the United States: everything the Service stores.
Cloudflare, Inc. (hosting, security, bot check, aggregate visit counts), and jsDelivr and cdnjs (script libraries): IP address and device details.
Twilio Inc., when the text program launches: the text of reminders to the Parent, which may include your child's first name and a Calendar item.
IONOS (our mailboxes and email delivery): anything you write to us about your child, and the account notices and reminder emails you turn on, which may include your child's first name and a Calendar item.
Microsoft 365 (our mailboxes): anything you write to us about your child.

Stripe, our payment processor, receives no information about your child. If someone uses the microphone, Google, Microsoft or Apple receives the audio as section 5 describes. If you connect Canvas, information passes between Canvas (Instructure) and us as section 4 describes.

8.2 People you choose to share with

Other adults in your family: everything, including Ask Bacc conversations.
A guardian in another household you give access to one child: that child's Calendar, progress, preferences and Ask Bacc conversations.
A teacher, specialist or tutor, after you enter their group's code and agree: your child's first name, grade and avatar, and whether assigned work is done. Progress by standard only if you turn on progress sharing. A specialist also sees the support switches you turned on. None of them sees Ask Bacc. Access ends June 30 unless you choose an earlier date, and you can remove your child at any time.
A report from school you share with a teacher, specialist or tutor: that report's details, takeaways and file, read only. Nothing is shared until you share it, and you can stop at any time.
A tutor you invite: your display name and your message.
A study pod: your child's screen name (or "Pod buddy"), avatar, done or not done on pod assignments, and leaderboard level (unless you hide your child). Never the first name or grade.
A race or team climb both parents agree to: screen name, avatar and steps.
Notes Studio results you share with a pod: the result and your display name; the pod's families can have Bacc reuse the stored pages.
Canvas and school calendar feeds, if you connect them.
Your phone's calendar app, if you turn on a learner's phone calendar link: your child's first name and Calendar items (dates, titles, class names and notes), which that app's company (for example Google, Apple or Microsoft) keeps under its own terms. You can turn the link off at any time.

We may also disclose information if the law requires it, to protect a child or anyone else from harm, or to a successor business that keeps to this notice, as section 7.3 of the Privacy Policy explains.

9. We ask for no more than we need

We do not make your child's use of any feature depend on giving more information than that feature reasonably needs. Everything beyond a first name, grade and avatar is optional.

10. Your rights and how to use them

As your child's parent, you may at any time review the personal information we hold about your child, have it deleted, and refuse to let us collect or use any more of it (16 C.F.R. § 312.6).

You can	In the app
Review your child's information	The learner's pages show the card and progress. The Ask Bacc conversations page shows every conversation, child by child. Settings → Export gives you a copy of every record your family can see.
Delete conversations	The Ask Bacc conversations page: delete a child's conversations.
Have your child's information deleted	Learners: delete the child. Their record, practice, conversations, Notes Studio jobs and Canvas token go at once; uploaded pages within about a day.
Refuse further collection, or withdraw consent	Learners: delete the child, which stops all collection. To stop one thing, turn off progress sharing, leave a group or pod, disconnect Canvas, or clear a field. To withdraw only the verified consent in section 3.2, ask us (below); Ask Bacc, Notes Studio and the microphone then turn off for your children.
Delete the whole account	Settings: delete the account. If another adult remains in your family, your children's records pass to that adult instead; delete each child first if you want them deleted.

You can also ask by email to privacy@baccare.com, through the contact form, or by mail to the address in section 1. Before we show or delete a child's information on request, we take reasonable steps to confirm that you are a Parent on that account. We respond within 45 days, and requests are free. The Privacy Policy explains how to appeal a decision.

11. How long we keep it: our data retention policy

This section is our written data retention policy for children's personal information (16 C.F.R. § 312.10). We keep each kind of information only as long as reasonably necessary for the purpose we collected it for, and never indefinitely. A daily job deletes information when its period ends; you can delete most of it sooner yourself (section 10). When we delete information, we use reasonable measures so that it cannot be accessed or used again.

Information	Why we collect it	Why we need to keep it	When we delete it
Ask Bacc conversations	To answer and coach your child.	So you can read them and Bacc can follow the thread.	12 months after each message.
Notes Studio jobs (notes, request and results)	To make study material from class pages.	So your child can study from them again.	12 months after the job.
Uploaded photos and PDFs of class pages	To make study material.	To remake or extend that material for a short time.	90 days after the job they were uploaded for, then removed from storage within about a day.
Learner profile, card, preferences, supports, practice history, rewards, Calendar, classes, weekly notes, and group and pod memberships	To teach your child and show progress.	Learning builds over months and school years, so practice history keeps its value while the account is in use.	When you delete the child or the account. If no adult in your family signs in to or uses Baccare for 24 months and there is no live subscription, we email you a warning and delete the account 30 days later unless someone signs in. We never delete for inactivity without sending that warning.
Canvas connection and token	To bring schoolwork into your Calendar.	To keep the Calendar up to date.	When you disconnect Canvas, delete the child or delete the account.
Reports from school	To keep a report with your child's learning plan.	So you can look back at it and share it if you choose.	When you delete the report or its file, or delete the child or the account.
Phone calendar link	So your calendar app can show your child's Calendar.	While you want the link to work.	When you turn it off, delete the child or delete the account. Copies already in your calendar app are kept by that app.
Canvas and calendar sync logs	To run and troubleshoot the connections.	To find and fix sync problems.	60 days.
Records from a school's Canvas installation	To run the school's activities and return scores.	While the school uses the activities.	Within 60 days of the school's request, or after it tells us it has stopped using Baccare in Canvas.
A signed consent form	To verify your consent.	To show that consent was verified while the account is in use.	When the account is deleted.
The record that consent was verified (method, date, reviewer or payment reference)	To show that consent was verified.	To answer a question or claim about consent; 4 years matches the Texas limitations period for contract claims.	4 years after the account is deleted. It is no longer linked to the account after deletion.
The record that you agreed to this notice (time and version)	To show that consent was given.	To answer a question or claim about consent.	Kept after the account is deleted, no longer linked to it. It holds no information about your child.
Messages to us that mention your child	To answer you.	To handle the request and keep a record of how we did.	24 months after we receive them; privacy requests and legal notices, 4 years.

Anything you delete is deleted at once from our live database. Backups are overwritten on our database provider's schedule and are never used to restore deleted information except to recover from a disaster. The full schedule, including records about Parents, is in section 11 of the Privacy Policy.

12. How we protect it

We maintain a written children's personal information security program, as 16 C.F.R. § 312.8 requires, suited to the sensitivity of children's information and to our size. Under it:

a designated employee coordinates the program;
at least once a year we assess the internal and external risks to the confidentiality, security and integrity of children's information;
we put safeguards in place for the risks we identify, and we regularly test and monitor how well they work;
we review and update the program at least once a year, and after a major change; and
before we give children's information to a service provider, we take reasonable steps to confirm that it can keep the information confidential and secure, and we use only providers whose written terms commit them to protect it.

The safeguards include encryption in transit and at rest, database rules that stop one family from reading another family's information, private storage for uploaded pages and signed consent forms, and staff access limited to support, consent review, safety review and legal obligations. No system is perfectly secure; if a breach affects your child's information, we will tell you as section 15 of the Privacy Policy describes.

13. Changes to this notice

If we change this notice in a way that affects children's information, we will tell you by email and in the app at least 30 days before the change takes effect. From that date, the app asks a Parent to agree to the new version before adding a learner or starting Child mode. We will not use your child's information in a materially different way, or disclose it to a new kind of third party, until you agree.

14. Questions

Write to privacy@baccare.com, use the contact form, or write to Brigade Management, Inc., Attn: Privacy, 3400 Coit Rd. #262084, Plano, TX 75026.