Privacy Policy
Effective October 8, 2026
We collect only what we need to run courses, sell access and keep the site safe. Here is exactly what that is.
What this page covers
This policy explains what Shiro Solutions LLC, which operates Poppy Scholars (“we”), collects when you use poppyscholars.com, why, who helps us run the site, and what choices you have. We do not sell your personal information and we do not show advertising.
What we collect
Your account. Your email address, and a sign-in session that keeps you signed in on up to two devices.
Your purchases. Which course you bought, the plan, the amount, the date and when access ends, plus any grading credits you hold. Stripe handles your card details; we never receive your card number.
Lesson activity. When you open a lesson for the first time we record the course, the lesson, the time, your IP address, a random identifier stored in your browser and, if you are signed in, your account. We use this to count the free preview and to spot people working around it.
AI grading. We record that a grading happened (the prompt, the time and whether it was free or paid). The text you submit is sent to our AI provider to produce the feedback; we do not keep the text in our database.
Teacher review. The student name you type, the response text and the file names are stored with your account. Photos or PDFs you attach are emailed to the teacher and are not kept in our database.
On your device. The site stores your progress, your light or dark setting, your sign-in session and your free-lesson count in your browser’s local storage. We do not use advertising cookies or analytics trackers. Clearing your browser removes this local data; your account data stays with us.
Technical data. Our hosting provider and our server see your IP address and request details when you load a page. We also keep short-lived counters that limit how often something can be requested, to prevent abuse.
How we use it
- to sign you in, keep your access, and give you the courses, grading and review you paid for;
- to take payments and send receipts and the emails you ask for (sign-in links, review confirmations);
- to enforce the free preview, the device limit and daily limits, and to protect the site from abuse;
- to fix problems and improve the courses.
Who helps us run the site
We share only what each provider needs to do its job:
- Cloudflare: hosts the website, runs our server and stores our database.
- Stripe: processes payments. Your payment details go to Stripe, under its own privacy policy.
- Anthropic: its AI model grades the responses you submit for AI grading and transcribes photos of handwritten answers when you use that feature. Your submitted text or photo is sent to it for that purpose.
- Resend: sends our emails, including sign-in links and teacher-review messages.
- Google Fonts and cdnjs: your browser loads fonts and math-display code from these services, which means they can see your IP address when a page loads.
Teachers and staff who review your work receive the content you send them. We may also disclose information if the law requires it or to protect the safety and rights of our users and the site.
Children
The site is meant for students and their families. We do not knowingly collect personal information from a child under 13 unless a parent or guardian has created and manages the account. If you believe a child under 13 has given us information without a parent’s involvement, email us and we will delete it.
How long we keep it
We keep account, purchase and grading records for as long as your account exists and as long as we need them for tax, accounting and security purposes. Lesson-activity logs are kept only as long as they are useful for preventing abuse. You can ask us to delete your account and the personal information we hold about you (see the next section); we may keep what the law requires us to keep, such as payment records.
Your choices and rights
You can ask us to tell you what we hold about you, correct it, or delete it. If you live in California, you have these rights under California law, and we will not treat you differently for using them. We do not sell or share personal information for advertising. To make a request, email [email protected] from the address on your account so we can confirm it is you.
You can also sign out of a device from the Account button, and clear your browser’s local data at any time.
Security
Pages and our server use encrypted connections. Sign-in links work once and expire in 15 minutes. No system is perfectly secure, so we cannot promise absolute security, but we limit what we collect and who can see it.
Changes and contact
If we change this policy we will update the date at the top, and tell you on the site if the change is significant. Questions: [email protected].