Privacy Policy

Mykubo is operated by School in a Backpack LLC. Mykubo helps families find real-world learning experiences and keep a record of what their children learned. You can reach us at ronald@schoolinabackpack.com.

We deliberately collect as little as possible. Specifically:

• Adult account holders. Your name, email address, a securely hashed password, and your home state (used to pick the right educational standards).
• Children. Only a first name and a grade level. We do not collect a child's last name, date of birth, address, phone number, photograph or precise location.
• Learning records. Bookings, assessments, credits awarded and transcript entries created as your child completes experiences.
• Evidence you choose to upload. Organizers may upload work products or documentation after a workshop.
• Location (mobile app only).If you grant permission, we use your device's location solely to show nearby experiences on the map. It is used on your device to center the map and is not stored on our servers or sold. You can deny or revoke this permission at any time in your device settings; the rest of the app continues to work.
• Sign-in cookies. A single session cookie keeps you signed in. We do not use advertising or cross-site tracking cookies.

Mykubo is designed to be used by parents and guardians, not by children. Accounts are created and controlled by an adult. We ask for a parent's affirmative consent before any information about their child is added, and a child's record only ever exists because a parent entered it.

A parent can review, correct or permanently delete their children's information at any time from the Account page, or by emailing us. We do not condition a child's participation on disclosing more information than is reasonably necessary, and we never serve behavioral advertising to children.

We use your information only to operate the service: to sign you in, show relevant experiences, process bookings, build your child's transcript, and send you transactional email such as password resets and verification notices.

We do not sell your personal information, and we do not share it with advertisers.

We use a small number of service providers strictly to run the product. They process data on our behalf and are not permitted to use it for their own purposes:

• Supabase — hosts our database.
• Vercel — hosts and serves the application.
• Resend — delivers transactional email.

Organizers you book with can see the information necessary to run their session. An organizer can never read another family's transcript or portfolio.

We keep your information for as long as your account exists. When you delete your account, your profile, your children's profiles, bookings, assessments, credits and transcripts are permanently deleted from our database. Deletion is immediate and cannot be undone.

• Review and update your information from the Account page.
• Permanently delete your account and all associated family records from the Account page.
• Revoke location permission at any time in your device settings.
• Email us to request a copy of your data or ask a privacy question.

Passwords are stored using bcrypt hashing and are never stored in readable form. Sessions use long, unguessable random tokens. Access to family records is checked on every request so that one family cannot read another's. No system is perfectly secure, but we treat children's learning records as sensitive and design accordingly.

If we make a material change to how we handle your information, we will update this page and, where appropriate, notify you by email.