Privacy Policy

Effective October 15, 2026. Brigade Management, Inc. ("Baccare," "we," "us"). Policy version privacy-2026-10-15.

1. Who we are and what this policy covers

Baccare is operated by Brigade Management, Inc., a Texas corporation, 3400 Coit Rd. #262084, Plano, TX 75026. This Privacy Policy explains how we collect, use, disclose and keep personal information through baccare.com, app.baccare.com, our iPhone, iPad and Android apps, and the emails and text messages we send (together, the "Service"). It also covers our password-protected information pages for educators and investors at teach.baccare.com and brief.baccare.com: they set one cookie that remembers the password was entered, and they load their fonts from baccare.com. Before brief.baccare.com opens, the viewer accepts a confidentiality agreement and gives a name, an email address and, optionally, an organization; we record those with the date and time, the IP address, the browser and the version of the agreement, and each later visit to the overview, keep the record for seven years to document the agreement, use it for nothing else, and set a second cookie that remembers the acceptance. No Baccare site or app loads fonts from Google.

In this policy:

• "Parent" means the adult who holds a Baccare account and adds children to it. Only a child's parent or legal guardian may add that child.
• "Adult" means a Parent, any other adult a Parent adds to the family, and a guardian in another household whom a Parent gives access to one child.
• "Learner" or "child" means a child a Parent adds to the account. Children never have their own accounts, passwords or email addresses. We give every Learner the protections in this policy and in the Children's Privacy Notice, including Learners who are 13 or older.
• "Child mode" means the mode in which a Parent hands a device to one Learner. A four-digit PIN keeps the Parent's pages locked. The PIN is a convenience, not a security boundary.
• "Professional" means a teacher, specialist or tutor whose application for professional tools we have approved.
• "Children's Information" means personal information collected from or about a Learner.

The Children's Privacy Notice is our notice to parents under the Children's Online Privacy Protection Act ("COPPA") and is part of this policy. If the two ever seem to say different things about Children's Information, the statement that gives the child more protection applies. The Cookie Policy lists what the Service keeps in your browser. A school's use of Baccare is also governed by our School Data Addendum. Capitalized terms not defined here have the meanings given in our Terms of Service.

This policy does not cover services we link to but do not run, such as Stripe's checkout and billing pages, Canvas, Google's sign-in pages, app stores, and the websites Ask Bacc may cite. Their own policies apply there.

2. The short version

• Parents decide. Only an adult can create an account. Before we collect anything about a child, a Parent reads the Children's Privacy Notice and agrees to it. Before anything about a child goes to an outside company (Ask Bacc, Notes Studio and the microphone), we verify that the consent came from a parent, by a real card charge or a signed consent form.
• What we hold about a child is what a Parent enters (a first name, a grade, an avatar, and anything optional on the learner's card and Calendar), the child's practice in Baccare, and what is typed to Ask Bacc or uploaded to Notes Studio, whether by the Parent or by the child in Child mode.
• Who receives it. The service providers that run Baccare for us, named in section 7, and only the people a Parent chooses: other adults in the family, a teacher, specialist or tutor, a study pod, or another family in a race.
• What we never do. Sell or rent personal information; show ads or allow targeted advertising; profile a child except as the learning features need; train AI models on your family's information or let our providers do so; diagnose anything.
• How long we keep it. Ask Bacc conversations and Notes Studio jobs, 12 months. Uploaded photos and PDFs, 90 days. Most other information, until you delete it or close the account; an account no adult in the family has used for 24 months, with no live subscription, is deleted 30 days after a warning email. Section 11 has the full schedule.
• Your controls. Read every Ask Bacc conversation, export your family's information, and delete a child or the whole account, all in the app. Or write to privacy@baccare.com.

3. Information we collect from Parents and other adults

Our iPhone, iPad and Android apps load the same Service as app.baccare.com. They do not collect device advertising identifiers, contacts or precise location. A photo or file reaches us only when you, or your child in Child mode, choose one to upload to Notes Studio. If an app store or device ever gives us an age category or parental-consent status for the person using the app, we will use it only to apply age restrictions, comply with law and run safety features.

4. Information about children

4.1 What a Parent enters

To add a Learner, a Parent enters a first name (or nickname), a grade from kindergarten to 8th grade, and chooses an avatar. That is all we require. Please use a first name or nickname only. The field accepts up to 30 characters and cannot check what is typed, so it is up to you not to enter a full name.

A Parent may also choose to enter, and can edit or clear at any time:

• on the learner's card: school, teacher, interests, strengths, goals, what the child is working on now, and notes for Bacc;
• classes (name, teacher, period, days, room, notes), the order a class covers the standards (and, if you add them, the weeks it starts each one), Calendar entries (title, notes, details, due dates, status), weekly notes, and goals with the rewards that earn them;
• learning preferences, such as untimed practice, chunked instructions, read-aloud, reduced motion, larger targets, a preferred way of seeing problems, enrichment level, languages, number of questions, rewards, leaderboard visibility, and the app's look;
• learning supports: switches that describe what helps the child practice (for example, "reading takes extra effort," "focus comes and goes," "more time to think helps"), and a short note of up to 300 characters. We do not ask for a diagnosis, the app offers none to select, and the note is refused if it names one. We still treat learning supports as sensitive, because what helps a child can suggest a health or learning condition.
• reports from school: a report a Parent chooses to keep with a Learner (an ability test, a progress report, a report card, a state test such as STAAR, or another report), its name and date, the Parent's takeaways in their own words, and, if the Parent adds it, a photo or PDF of the report. A report can show scores and the school's identifiers for the child. We use it only to show it back to the family and to the people the Parent chooses to share it with. It is never sent to our AI provider, never shown in Child mode, and never used to rate or place a child. If a Parent copies a takeaway to the learner's card (strengths or goals), those words become part of the card, which Ask Bacc reads (section 6.1). We treat reports from school as sensitive.

4.2 What is recorded as a child uses Baccare

Practice results (which activities, scores, questions missed, active time, the standards practiced, whether each answer was right, how sure the child was, and how much help was used); skills check and level check results (the topics asked, how many questions on each were right, and the suggested topics to start with); math facts drill results, only for a child whose parent turned the drill on (which kind of facts, how many were right and how many were tried in the minute); lessons finished (which lesson and how many of its two Try it questions were right); the flashcard review schedule; study time; the points, levels, badges and Bacc Bucks practice earns and the items bought with Bacc Bucks (they have no cash value); a screen name built from fixed word lists, never from a real name; races and team climbs; sports drills, printable missions, real-world project days and family activities a parent marked done (which one and when, never a score); and daily usage counts used for the plan's limits.

4.3 What is typed or uploaded in Ask Bacc and Notes Studio

Once a Parent has verified consent, a child in Child mode can use Ask Bacc and Notes Studio, so the information below can come from the Parent or directly from the child.

• Ask Bacc stores every message (up to 600 characters each), every reply, any safety flags, and which AI model answered and how much it used. Words that name a medical or learning condition are replaced with "[removed]" before a message is stored or sent to the AI, and a reply that names a condition is not shown.
• Notes Studio stores typed notes (up to 12,000 characters), what Bacc was asked to make, file names, the results, and photos and PDFs of class pages (up to 6 MB each) in private storage. A photo or PDF can show whatever is on the page, including a child's name or handwriting. Please photograph only the class page, never a face. We store each distinct file once, and when exactly the same pages, notes, request and learner settings are submitted again, we may reuse the result already made.

Children cannot message other people through Baccare, post anything publicly, or create a profile others can search.

4.4 Speaking a question or an answer (the microphone)

Practice questions ("Say your answer"), Ask Bacc and Notes Studio quizzes have a microphone button. It is offered only inside the signed-in app at app.baccare.com, in a web browser, on a Parent's account, and for a child only after a Parent has verified consent as the Children's Privacy Notice describes. It is never offered on the public practice pages of baccare.com, which a child can open without a Parent's account, and it is not offered in the iPhone and Android apps or inside a school's Canvas.

It uses the speech recognition built into the browser: Google's in Chrome and on Android, Microsoft's in Edge, and Apple's in Safari and on iPhone and iPad. The audio goes to that company and is handled under its own terms. Baccare never receives, records or stores audio. We receive only the words the browser returns. In Ask Bacc they appear in the typing box and are treated like typed text, and nothing is sent to us until the child or Parent taps Send. On a practice question with a typed answer, the words only fill the answer box. On a multiple-choice question, the child says the letter or the answer, and Baccare picks out that choice for the child to confirm. On a question that asks to put cards in order or sort them into groups, the child says the cards (and, to sort, the groups), and Baccare places them where the child can still move them before checking. Every way, we record the result as we do for a typed or tapped answer, and never the words themselves. The browser asks before the microphone is used the first time, and you can turn that permission off in its settings.

4.5 Information from school systems a Parent connects

• Canvas. If your child's school uses Canvas and you connect your own parent (observer) account, we read, for that child only: courses, assignments, quizzes, discussions and calendar events with due dates, turned-in status and scores, and class announcements (title, text and the teacher's display name). Canvas also gives us the student's name as Canvas shows it, which is usually the child's full name.
• School calendar feeds. If you add a calendar feed from a school portal, we store its address, which contains the portal's private token, and import its events to your Calendar.

A school can also install Baccare inside its own Canvas courses. Section 10 explains what we receive then.

4.6 What we do not collect

We do not ask for, and the Service has no place to enter, a child's birth date, email address, phone number, home address, government identifier or biometric information, and we do not collect precise location. We never ask for a photo of a child. We collect no more Children's Information than the features in use reasonably need, and a child can use Baccare with only the required first name, grade and avatar.

5. How we use information

We use personal information to:

• provide the Service: accounts, Learners, activities, practice, progress, the Calendar, printables, groups, pods, Ask Bacc and Notes Studio;
• fit the learning to each child within Baccare, for example by choosing what to practice next and by giving Ask Bacc the context in section 6;
• show Parents, and the other adults they choose, how a child is doing;
• run the trial and the subscription through Stripe;
• send account and service messages (sign-in links, password resets, receipts and billing notices, notice of changes to our terms), the notices the law or our terms require, which we send even if you turn reminders off (a trial-ending reminder, renewal reminders, and an inactive-account warning), and the reminders you turn on;
• record your agreement to our terms, a parent's consent and its verification, and your consent to automatic renewal, and review signed consent forms;
• keep children safe: screen Ask Bacc and Notes Studio messages, show flagged exchanges to the Parent, apply daily limits, and review flagged exchanges;
• secure the Service and prevent fraud and abuse;
• answer support and privacy requests;
• improve the Service using aggregate or de-identified statistics, such as which activities are used and which standards are hardest; and
• comply with law and enforce our Terms.

What we never do

• We never sell or rent personal information, including Children's Information, and we have never done so.
• We never show ads, and we never use or share personal information for targeted advertising.
• We never build a profile of a child except the practice record and learner card the learning features use inside Baccare.
• We never use your family's information to train or improve AI models, and we do not let our providers do so.
• We never diagnose, screen for or infer a medical, psychological or learning condition.
• We never make decisions about anyone that have legal or similarly significant effects by automated means.
• We never email, text or otherwise contact a child.

A small number of Baccare staff can reach account data, including Children's Information. They use that access only to answer a support request, to review an exchange our safety rules flagged, and to meet a legal obligation.

6. AI features and what goes to Anthropic

Ask Bacc and Notes Studio are answered by Claude, an AI model made by Anthropic, PBC, which we use through Anthropic's commercial API. Bacc is an AI, not a person, and it can be wrong; see our AI disclosure. Nothing about a child is sent to Anthropic until a Parent has verified consent, as the Children's Privacy Notice describes.

6.1 What Ask Bacc sends

With each message, Ask Bacc sends Anthropic the message, up to 12 earlier turns of the conversation, and a note about the Learner built from what is already in your account:

• the Learner's first name and grade;
• the learner's card: school, teacher, interests, strengths, goals, what the child is working on, and the Parent's notes;
• classes, with teacher names;
• Calendar entries from the last 2 days and the next 14 days, including their notes and any Canvas scores imported into them;
• assignments from a study pod or a teacher's class, the class calendar, an extract of up to 600 characters from each class document, and the teacher's display name;
• a summary of the child's own practice in Baccare: standards done well, standards in progress, and standards not practiced lately;
• learning preferences, learning supports and the supports note, given as instructions for how to explain and pace, never as a label.

6.2 What Notes Studio sends

The Learner's first name, grade, interests, learning preferences and supports; the typed notes and request; and the uploaded photos and PDFs. "Go deeper" also lets the model search ten named educational websites through Anthropic's web search tool. The child's name is removed for that step.

Study plans. When a test's or project's title does not say what it covers, Baccare sends Anthropic the titles of Calendar items from the same class, the subject and the grade, and the names of Baccare's practice activities, and asks which activities fit. The child's name and the Calendar notes are not sent.

6.3 What is not sent

Your email address, payment details, phone number, any other Learner's information, and Canvas announcements. If you would rather Bacc did not have a piece of information, remove it from the learner's card or the Calendar and it stops being sent.

Reports from school and their files are never sent.

6.4 Safety screening

Every message is screened before it reaches the model and again after the model answers, for sexual content, self-harm, violence, personal information such as addresses and phone numbers, talk of meeting up or being home alone, substances, swearing and slurs, and attempts to change Bacc's instructions. A reply about self-harm gives the 988 Suicide & Crisis Lifeline. Flagged exchanges appear for the Parent on the Ask Bacc conversations page, under Safety review. When a child's message is flagged for personal information, meeting up or being home alone, sexual content, self-harm, violence or substances, we also alert the Parent right away by email, and by push notification on any phone where the Parent turned them on, and we alert Baccare's administrators by email. An alert says what kind of message was caught and when, never the message itself.

6.5 Anthropic's terms

Anthropic's commercial terms provide that Anthropic does not train its models on the inputs and outputs we send through its API, and that it deletes them within 30 days, except content its safety systems flag, which it may keep for up to two years, and except where the law requires it to keep them. We do not use your family's conversations or notes to train any AI model.

7. Who receives information

7.1 Service providers

These companies run parts of the Service for us. Each receives only what its part needs, and we choose providers whose terms with us limit their use of the information to providing their service.

Two other kinds of recipient work under their own terms rather than for us: the speech services built into your browser (Google, Microsoft or Apple), which receive audio only if someone uses the microphone (section 4.4), and Instructure, the maker of Canvas, which exchanges information with us only if a Parent or school connects Canvas (section 10).

7.2 Recipients you choose

Each of these happens only when a Parent does it, none is needed to use Baccare, and each can be undone. You may agree to our collection and use of your child's information without agreeing to any of them.

• Other adults in your family see and manage everything about your children, including Ask Bacc conversations.
• A guardian in another household you give access to one child sees that child's Calendar, progress, preferences and Ask Bacc conversations.
• A teacher's class, a specialist's caseload or a tutor's group you join with a code, and progress sharing with that group: see section 8.
• A tutor you invite sees your display name and your message.
• A study pod. The other families see your child's screen name (or "Pod buddy"), avatar, whether each pod assignment is done, and level on the pod leaderboard; in a pod of six or more, the three learners with the most points that week are shown with their points and place. They never see your child's first name, grade, scores or tests. You can hide your child from leaderboards or leave the pod.
• A race or team climb with another family, which needs both Parents to agree: the families involved see each child's screen name, avatar and steps.
• Notes Studio results shared with a pod: the other families see the result, its title, subject, date and page count, and your display name, and they can have Bacc make new study material from the stored pages, which can show whatever is on them.
• Canvas and school calendar feeds: see sections 4.5 and 10.
• Your phone's calendar. If you turn on a learner's phone calendar link on the Calendar page, the calendar app you add it to (for example Google Calendar, Apple Calendar or Outlook) fetches that learner's first name and Calendar items (dates, titles, class names and notes) through the link, and keeps them under that company's own terms. Anyone you give the link to can see the same. You can make a new link (the old one stops working) or turn it off at any time.

7.3 Other disclosures

We may disclose information when the law requires it, for example to comply with a subpoena or court order; when we believe in good faith that disclosure is needed to protect a child or anyone else from harm; to enforce our Terms or protect our rights; and to a successor in a merger, acquisition, financing or sale of all or part of our business. A successor must keep to this policy for information collected under it, and we will tell you before your information becomes subject to a different policy.

8. Teachers, specialists and tutors

Professionals are adults who apply in Settings and whom we approve. Their professional tools need no plan. Baccare does not employ, supervise or vouch for them. A tutor's listing may describe a background check that Baccare has looked at, but Baccare does not run background checks.

• How a Professional reaches a child. Only after the child's Parent enters the group's six-letter code, sees the group (its name, the Professional's display name, the school and how many learners are in it) and agrees. A child cannot join a group, and a Professional cannot add a child.
• What they see. The child's first name, grade and avatar; when the child joined and when access ends; and the work the Professional assigned and whether it was done. Progress sharing is off unless you turn it on; if you do, they also see a summary of progress by standard and how many practice answers the child gave in the last seven days. A specialist also sees the learning-support switches you turned on, never the supports note.
• Reports from school. Only a report you share with them: for each report you can pick the teachers, specialists or tutors already connected to your child, and nothing is shared until you do. They see that report's details, takeaways and file, read only, until you stop sharing it, remove your child, or their access ends.
• What they never see. Ask Bacc conversations, notes on the learner's card, your other children, and, for teachers and specialists, your name or email address.
• What goes the other way. Assignments, dates and documents a teacher posts appear for your family, and an extract of each document and the teacher's display name are part of Ask Bacc's context (section 6.1). Families in the same group do not see each other, and there is no messaging in a group.
• When access ends. On June 30 of the school year unless you set an earlier date. You can remove your child at any time, and access ends at once.

9. Family sharing, guardians and deleting an account

A Parent can invite other adults to the family with a link, and can give a guardian in another household access to one child (section 7.2 says what each sees). Removing an adult ends that adult's access.

When a Parent deletes the account and another adult remains in the family, the children's records are handed to that adult instead of being deleted, and stay under this policy. If you want a child's information deleted rather than handed over, delete the child under Learners before you delete your account.

10. Schools and Canvas

• A Parent's Canvas connection (section 4.5) uses the Parent's own Canvas sign-in. Baccare never writes to Canvas and never sees the Canvas password. The access token is kept in encrypted storage and is deleted when you disconnect, delete the child or delete the account; you can also revoke Baccare inside Canvas. Announcements are stored as plain text and are not sent to the AI. Baccare is independent and is not affiliated with Instructure, Inc.
• A school's Canvas installation. A school can add Baccare activities to its Canvas courses. A student then opens an activity from Canvas without a Baccare account. Canvas sends us an identifier for the student and the student's given name and role in the course, and we record the results and send the score back to the school's Canvas gradebook. Nothing from these sessions is sent to the AI. A Parent can link that work to the family's account with the pairing code shown. If the Parent then turns on "Use [child]'s supports in Canvas too," five of the child's learning supports from the family's account (read-aloud, step-by-step instructions, untimed games, larger buttons and reduced motion) are applied to Baccare activities on the student's screen in Canvas. They are not sent to Canvas or the school, nothing else from the learner card goes with them, and the setting turns off when the Parent disconnects or switches it off. We use this information only to provide the activities to the school, under our School Data Addendum.
• Classes. When a school or teacher uses Baccare classes for school purposes, we do not use student information for targeted advertising, do not build profiles of students except for school purposes, do not sell it, and delete it at a school district's request as the School Data Addendum describes.

11. How long we keep information

A daily job deletes information when its period ends. You can delete most of it sooner yourself (section 12). The Children's Privacy Notice gives, for each kind of Children's Information, why we keep it and for how long; this table covers everything we hold.

The 4-year periods match the Texas limitations period for contract claims, so that we can show what was agreed if a question or claim arises. A canceled or ended trial or subscription does not delete the account by itself. The periods above keep running, and you can delete the account at any time.

12. Your rights and choices

• Review. See each child's information and progress in the app. Read every Ask Bacc conversation, child by child, on the Ask Bacc conversations page.
• Export. Settings → Export gives you a machine-readable copy of every record your family can see in the app: your account, each child and their card, preferences and supports, practice and learning events, flashcard state, rewards, classes, the Calendar, class orders, weekly notes, calendar feeds (without the private feed address), imported announcements, Canvas links, Ask Bacc conversations, Notes Studio jobs and which uploaded pages each job used, assignments, family members and guardians, classes and pods you joined, pod shared notes, races and climbs, sports drills, printable missions, real-world project days and family activities marked done, tutor invitations and profile, teaching groups, credits and code redemptions, notification settings, your mobile number, the texting consent log, your subscription, and your parental consents. Records you cannot see in the app (texts you sent us, records from a school's Canvas installation, and contact messages) are provided on request.
• Correct. Edit your account and each child's details in the app, or ask us.
• Delete conversations. Delete a child's Ask Bacc conversations at any time on the Ask Bacc conversations page.
• Delete a child. Delete a child under Learners. This deletes the child's record, practice, Ask Bacc conversations, Notes Studio jobs and Canvas token at once; uploaded pages go within about a day.
• Delete the account. Delete it in Settings (this needs a recent sign-in and cannot be done in Child mode). It cancels any subscription, deletes your Stripe customer record, and removes your family's information from our live database at once, except what section 11 says is kept longer and the handover in section 9.
• Withdraw consent. You can withdraw your consent to our collection and use of a child's information at any time. Deleting the child stops all further collection and deletes what we hold; the child then cannot use Baccare until a Parent adds them again with consent. To withdraw only the verified consent that lets a child use Ask Bacc, Notes Studio and the microphone, ask us as described below; those features then turn off for your children. You can also stop any single choice in section 7.2 without withdrawing consent as a whole.
• Texts. Reply STOP to any text, or remove your number in Settings.
• Email. Every marketing email we send will have an unsubscribe link. Account and service emails continue while you have an account.
• Browser storage. See the Cookie Policy.

How to make a request

Use the controls above, or email privacy@baccare.com, use the contact form (choose the Privacy topic), or write to Brigade Management, Inc., Attn: Privacy, 3400 Coit Rd. #262084, Plano, TX 75026. You do not need to create an account to make a request.

We verify requests. Before we act on a request, we confirm that it comes from the account holder, for example by replying to the account's email address or asking you to confirm in the app, and, for a child's information, that you are a Parent on that account. We ask only for what we need to verify you. If someone makes a request for you, we may ask for proof that you authorized them.

Timing. We respond within 45 days. If we need more time, we will tell you why within those 45 days and take no more than 45 more. Requests are free.

Appeals. If we decline all or part of a request, you can appeal by replying to our decision or writing to privacy@baccare.com with "Appeal" in the subject. We will decide within 60 days and explain the decision in writing. If we deny your appeal, you may file a complaint with the Texas Attorney General at texasattorneygeneral.gov, or with the attorney general of the state where you live.

We do not treat anyone differently for using these rights.

13. State privacy rights

13.1 Texas

The Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541) gives Texas residents the right to confirm whether we process their personal data and to access it, correct it, delete it, get a portable copy, and opt out of its sale, of targeted advertising and of profiling that produces legal or similarly significant effects (§ 541.051). We respond within 45 days, extended once by up to 45 more days when reasonably necessary, with notice to you of the extension and why (§ 541.052). If we decline to act, you may appeal, and we will decide the appeal within 60 days and tell you in writing how to contact the Texas Attorney General to submit a complaint (§ 541.053). Section 12 describes how. We honor these requests whether or not the Act's small-business exemption (§ 541.002) applies to us. The categories of personal data we process, and why, are in sections 3 to 6; the categories we share, and the categories of third parties we share them with, are in section 7.

Sensitive data. Personal data collected from a known child is sensitive data under the Act (§ 541.001), and we also treat learning supports, which could suggest a health or learning condition, as sensitive. We process a child's information only with a Parent's consent as described in the Children's Privacy Notice, and learning supports only when a Parent chooses to enter them. We do not sell personal data, including sensitive data (§ 541.107), and we do not process personal data for targeted advertising or for profiling that produces legal or similarly significant effects.

13.2 California

• Reviewing and changing your information: section 12. How we tell you about changes: section 18. Effective date: the top of this page.
• Do Not Track (Cal. Bus. & Prof. Code § 22575(b)(5)–(6)). We do not track visitors across other websites or services, and we do not allow advertising or analytics companies to collect information about your online activities over time and across different websites when you use the Service. We therefore treat every visitor the same whether or not the browser sends a Do Not Track signal. Companies whose own pages you use through the Service, such as Stripe on its checkout pages and Google or Microsoft when you sign in with them, collect information there under their own policies, including for fraud prevention.
• Global Privacy Control. We treat a Global Privacy Control signal as a request to opt out of the sale of personal data and of targeted advertising. Because we do neither, the signal does not change how the Service works for you. If that ever changes, we will honor the signal as an opt-out before it does.
• Content. A Parent can delete any content in the account at any time (section 12).
• Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes, so there is no list of such disclosures to request.

13.3 Other states

Several other states give their residents privacy rights like those above. We honor the same requests from every account holder, wherever they live, using the process, timing and appeal in section 12. If the law of your state gives you more, we follow it. You may also contact your state's attorney general.

14. Security

We protect personal information with measures suited to information about children, including:

• encryption in transit (TLS) for every connection, and encryption at rest for our database and file storage at our hosting provider;
• passwords kept only as one-way hashes by our sign-in provider, and the Child mode PIN and text verification codes kept only as hashes;
• Canvas access tokens kept in encrypted secret storage;
• database access rules that stop one family's account from reading another family's information;
• uploaded pages kept in private storage that is not publicly addressable;
• a bot check on the sign-in, create-account and password-reset pages, and a recent sign-in before an account can be deleted;
• screening of Ask Bacc and Notes Studio messages (section 6.4);
• staff access limited to support, safety review and legal obligations (section 5); and
• a written information security program, summarized in the Children's Privacy Notice.

Please keep your password private, and remember that the Child mode PIN only locks the Parent's pages on that device. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization.

15. Data breach notice

If we discover a breach of security that affects your personal information, we will notify you without unreasonable delay and within the time the law requires. For Texas residents, that is no later than 60 days after we determine that the breach occurred, and if a breach affects at least 250 Texas residents we will also notify the Texas Attorney General no later than 30 days after that determination (Tex. Bus. & Com. Code § 521.053). We will notify you by email to the account address and in the app, and tell you what happened, what information was involved, what we are doing, and what you can do. We notify residents of other states as their laws require, and schools as the School Data Addendum provides.

16. International users

The Service is offered to families in the United States. Our database and file storage are located in the United States. Some of our providers may handle information in other countries as part of their service (for example, Cloudflare's network delivers pages from locations near the visitor). If you use the Service from outside the United States, your information is transferred to and processed in the United States under United States law.

17. Text messages

"Baccare schoolwork reminders" is an optional text program for Parents. It will launch when carrier registration is approved; until then, no texts are sent. Only an account holder 18 or older can turn it on, and texts never go to a child. The messages are informational reminders, never marketing. We use your mobile number only to send the reminders you choose and the code that confirms your number. We do not share your mobile number or text-message consent with third parties or affiliates for their marketing; Twilio and the mobile carriers receive only what they need to deliver the messages. Reply STOP (or QUIT, END, CANCEL, UNSUBSCRIBE, STOPALL, OPTOUT or REVOKE) to cancel, or HELP for help. Message and data rates may apply. The full program terms are in the text messages section of our Terms of Service.

18. Changes to this policy

When we change this policy, we post the new version here with a new effective date and version. If a change is material, we will tell account holders by email and in the app at least 30 days before it takes effect; from that date, the app asks every adult on an account to agree to the new version before continuing, and we record that agreement (section 3); and, where the law requires, we will also notify the app stores that distribute our apps before the change takes effect. Changes apply only from their effective date. We will not use personal information we already hold in a materially different way, or share it with a new kind of recipient, without your consent; and we will not use Children's Information in a materially different way, or disclose it to a new kind of third party, until a Parent has given consent again. Ask us if you would like an earlier version of this policy.

19. Contact

Privacy questions, requests and COPPA inquiries:

• Email: privacy@baccare.com
• Phone: (469) 712-7465
• The contact form (choose the Privacy topic)
• Mail: Brigade Management, Inc., Attn: Privacy, 3400 Coit Rd. #262084, Plano, TX 75026