THS Privacy Notice

1. Scope and contact

The Homeschool Social (THS) is owned and operated by DotWin LLC in Texas, United States. These documents take effect on September 14, 2026. They apply to THS.social, the private Society and THS-operated activities. A feature is available only when it is offered in the application; publication of these policies does not promise that every programme or region is open.

For support, legal notices, safety concerns or privacy requests, contact DotWin LLC at shelby@holdco.win. Privacy requests may also be submitted at https://ths.social/audience/privacy. Please identify THS and the request type. Do not email identity documents, passwords or intimate images.

We explain practices that are implemented and the conditions for optional features. We do not sell personal information, use targeted advertising, sell sensitive data, or use private youth content or identity documents to train a general-purpose AI model. We do not rent family contact lists or disclose them to local organisers for their independent marketing.

2. Information we handle

• Adult account and household information: name, email address, authentication identifiers, guardian relationships, support correspondence and preferences.
• Student information supplied in the private family flow: display name, date of birth, grade where relevant, homeschool eligibility, guardian permissions and age lane.
• Verification and safety records: documents or assertions actually requested for a stated check, review decisions, reports, restricted incident records and access audits. We do not request more evidence than reasonably needed.
• Participation information: interest answers, room membership, posts, moderated contributions, event registrations and attendance, guardian decisions and private programme work.
• Transaction information: subscription state, payment references, receipts, refunds and signed programme agreements. Stripe handles payment-card details; THS does not store full card numbers or security codes.
• Technical information: security logs, approximate region, device/browser details, essential session cookies and delivery records. Exact private venue details are restricted to eligible recipients. We do not publish a child’s home, school or routine location.

3. Why we use information

We use information to authenticate users, establish age and guardian authority, provide requested membership and events, explain appropriate introductions, collect and account for authorised payments, handle support, prevent abuse, investigate reports and meet legal duties. Interest recommendations are explainable participation suggestions, not automated decisions producing legal or similarly significant effects.

Required data supports the service the family requests. Optional marketing, public student work, photographs and other separately described uses require separate choices. Refusing an optional use does not change membership price or eligibility. Where law requires consent for sensitive data, including known children’s data, we obtain the required permission before that processing. We use contractual and legal grounds only where applicable; this notice is not blanket consent.

4. Children and guardian visibility

Youth accounts are limited to ages 13 through 17. We do not knowingly invite children under 13 to create accounts or submit information directly. A guardian can enquire about an eligible family event without creating an under-13 youth profile. If we learn of prohibited under-13 collection, we restrict the account and remove or lawfully address the information. Contact us if you believe this has happened.

An approved guardian can review the named student’s eligibility, permissions and the private information the guardian’s recorded authority allows. Guardians do not obtain unrestricted access to another household or confidential reporter information. A student who reaches 18 makes their own adult privacy choices; youth information does not automatically become public or migrate to adult rooms.

5. Who receives information

Other eligible members see only the profile and content authorised for their age-appropriate room or activity. Staff and screened operators receive information needed for their assigned work. Sensitive identity evidence and private case information require specific permissions and audited access.

Our core service providers include Supabase for database, authentication and private storage; Vercel for application hosting; Resend for email delivery; Stripe for payment processing; and Google when an adult chooses Google sign-in. They receive information needed for their service under the applicable service arrangements. A separate verification, event or Builder provider must be disclosed and authorised before private information is sent to it.

We may disclose limited information to professional advisers, payment networks, competent authorities or emergency services to fulfil legal duties, investigate abuse, protect someone or resolve a dispute. We assess requests and limit disclosure where lawful. In a genuine business transfer, information remains subject to this notice or we provide notice and obtain any required new consent.

6. Storage, security and international processing

THS operates from the United States. Providers may process information in the United States and other locations under their applicable contractual safeguards. We do not promise that every provider operation is restricted to Texas or a single data centre. Contact us for the current provider and transfer information relevant to your account.

We use authenticated access, restricted database policies, private storage, encryption in transit and provider storage protections, audit records and separation of youth and adult permissions. No system is perfectly secure. A document is not made available to a reviewer merely because its file extension is recognised; the production evidence-safety process must approve it. Do not send sensitive evidence by ordinary email.

If a breach requires notification, we notify affected people and authorities within the applicable deadlines. In Texas this includes the applicable individual notice deadline and Attorney General reporting rules. We do not delay legally required notification until an internal review is convenient.

7. Retention and deletion

We retain information only as long as needed for the stated service, safety, accounting or legal purpose. An active account and its necessary consent records remain while the service is supplied. On a verified closure or deletion request, we remove or de-identify ordinary account and communication information within 45 days unless an identified exception applies. We explain any extension or retained category.

The default sign-in and invitation delivery retention period is 30 days. Completed programme applications, deleted Foundry content, mentor notes, Builder audit records and Chapter application or candidate records have a 365-day retention period after the relevant final state or deletion. Programme contract and payment evidence and Chapter identity audit records have a seven-year period. Customer-discovery evidence has a purpose-specific deadline no longer than 90 days, followed by the configured 90-day disposal window.

Verification source documents are scheduled for deletion within 30 days after the review or appeal ends; only the minimum eligibility assertion and necessary audit record should remain. Ordinary moderation evidence is retained for one year after closure unless seriousness, a legal duty or a documented hold requires longer. These are operator retention requirements, including cases requiring supervised deletion rather than an automated purge.

A documented legal, safety, fraud or dispute hold may temporarily prevent deletion of relevant records. Access remains restricted, and we review the hold and delete when the reason ends. Backup copies expire through the provider’s backup cycle and are not used for ordinary service after deletion; if restored, we reapply recorded deletion decisions. We explain any specific remaining backup or legal-retention limitation when answering your request.

8. Your requests and appeals

You may request confirmation and access, correction, deletion or a portable copy of information you supplied, and withdraw optional permissions. We also honour applicable rights to opt out of sale, targeted advertising and specified profiling, although THS does not conduct those activities. An authorised representative may submit a request where allowed. We verify authority using proportionate information and do not reveal another family’s records.

Use the privacy contact above or the privacy-request page. We respond without undue delay and ordinarily within 45 days. Where legally permitted and necessary, we may extend once by up to 45 additional days, explaining the reason within the first period. We do not penalise a person for exercising privacy rights.

To appeal a refusal, reply to the decision or email the same contact with “Privacy appeal” in the subject within 60 days. We review the request and explain the appeal outcome within 60 days of receipt. If denied, you may complain to the Texas Attorney General through https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint. Rights and exceptions required by another applicable law remain available.

9. Cookies and communications

Essential cookies maintain authentication, security and requested preferences. Optional marketing or non-essential tracking requires any consent applicable to that use; an absent choice is not agreement. THS does not use advertising cookies in youth rooms. Browser privacy signals are respected for any applicable opt-out purpose.

General marketing and regional event discovery are separate adult opt-ins. Every marketing email must identify DotWin LLC, provide its current physical postal address and a working unsubscribe link. We honour unsubscribe requests within ten business days and ordinarily sooner. Security, billing and registered-event updates remain distinct service messages.

10. Changes

We publish a dated version when this notice changes and notify account holders of material changes. New sensitive-data purposes or materially expanded public sharing require any required new permission. Earlier consent does not automatically authorise a different use.