COPPA Direct Notice

Effective Date: 2026-07-16 Policy Version: 2026-07-16 2026-07-17: product name updated from Nova to Lantern throughout (branding alignment; the same product, practices unchanged), and transcript retention simplified to the operating mechanism (deleted on your deletion request); no substantive change.

This is the "Direct Notice" required by the FTC's COPPA Rule (16 CFR §312.4(c)) — a clear, complete statement that we provide directly to parents before we ask for their consent.

1. Who we are

Scout Learning Lab LLC 65 Mission Trail Rd, Woodside, CA 94062 · privacy@lanternlearning.io · (310) 962-0091

We make Lantern, an AI tutor that helps children practice reading, writing, and math. We are the operator under COPPA.

2. What we collect from your child

• First name, age, grade, and any context notes you choose to provide
• Voice audio during sessions (streamed to OpenAI for the spoken conversation and to Deepgram for reading transcription — see §3)
• Camera frames of the page or worksheet your child shows the device (uploaded to Google for text recognition; a short-lived copy stays on the device up to 7 days)
• Text transcripts of what Lantern hears (stored on your device only — never in our cloud; shared transiently with Anthropic for the post-session analysis described in §5; deleted on your deletion request)
• Books, worksheets, and handwritten work shown to Lantern
• A unique device identifier so the app works
• Notes Lantern writes about how the session went, including a weekly progress summary written for you

We do NOT collect: your child's last name, home address, phone number, school name, social media accounts, or any biometric identifier (voiceprint, face embedding, fingerprint).

3. What happens to your child's voice

Your child's spoken audio streams live to OpenAI's Realtime API (model gpt-realtime-2) to power the back-and-forth conversation, and separately to Deepgram to convert speech to text for the reading assessment. Neither provider uses your child's voice to train AI. OpenAI keeps voice inputs and outputs for up to thirty (30) days for abuse monitoring and then deletes them (its Realtime service also holds up to about one (1) hour of audio to keep a multi-turn conversation going); Deepgram does not keep the audio after transcribing it. We do not store raw voice audio in our own cloud, and we never create a voiceprint of your child. (Google's Gemini Live is our standby conversational provider; if we ever switch to it, your child's voice would stream to Google under the same commitments.)

Research-cohort exception: if you opt in to our research cohort, a copy of your child's reading-session audio stays on your local device — never our cloud — to help us improve Lantern's reading help. You can turn off the cohort opt-in at any time from the consent dashboard at https://consent.lanternlearning.io; withdrawing files a deletion request that our team completes within thirty (30) days, with email confirmation.

4. What stays on your device vs. goes to our cloud

Your child's voice is not stored in our own cloud, but it is processed by OpenAI and Deepgram as described in §3 — OpenAI keeps voice inputs and outputs up to thirty (30) days for abuse monitoring, then deletes them. During reading practice the device also keeps a short local recording, deleted automatically within a day or two. Camera frames and handwritten work images are uploaded to Google for text recognition (OCR); a copy stays on the device as shown above.

5. Who else sees the data

Five core service providers:

• OpenAI — real-time spoken conversation (your child's voice). No training on API data; inputs and outputs kept up to 30 days for abuse monitoring, then deleted.
• Deepgram — speech-to-text for the reading assessment. Audio not retained after transcription.
• Google — text recognition (OCR) on the camera images of pages and handwritten work; also our standby conversational provider (Gemini Live — your child's voice would stream to Google only if we switch to that standby). No training on input.
• Anthropic (Claude) — session analysis. No training on input.
• Supabase — cloud database for summaries and account info.

A complete subprocessor list is at subprocessors.md.

None of these providers use your child's data to train AI, for advertising, or for any purpose beyond providing the service to us.

6. How long we keep things

7. Your rights as the parent

You can:

• See and export the data this service holds about your family as a JSON + CSV bundle (consent dashboard → Your data → Generate export)
• Correct any of it (email privacy@lanternlearning.io — we correct within seven (7) days)
• Delete any or all of it (consent dashboard → Your data → Delete; our team completes deletion within thirty (30) days, with email confirmation)
• Pause your child's profile at any time (consent dashboard → Your data → Pause)
• Withdraw voice-retention consent at any time (consent dashboard → Your consent → toggle off)
• Email privacy@lanternlearning.io with questions; we respond within seven (7) days for COPPA-related requests

8. AI disclosure

Lantern talks to your child using OpenAI's real-time voice model (gpt-realtime-2) for the spoken conversation; Anthropic's Claude analyzes each session afterward; and Google performs text recognition (OCR) on the page and handwriting images. None of these providers train their models on your child's sessions. Lantern's responses are generated fresh each session and are not stored long-term by these providers beyond OpenAI's up-to-30-day abuse-monitoring window (your device keeps the session transcript, as described in §2). We never derive a voiceprint of your child.

Full AI disclosure: ai-disclosure.md.

9. The permission we need from you

By completing the consent wizard at https://consent.lanternlearning.io, you give Scout permission to:

• Collect the information described above
• Use it to operate Lantern for your child
• Share the limited pieces described in §5 with our service providers

We will not collect, use, or share your child's information for any other purpose without obtaining renewed consent from you.

10. If you change your mind

Sign in to the consent dashboard at https://consent.lanternlearning.io at any time to pause your child's profile (reversible) or ask us to delete all of your child's data permanently. We acknowledge COPPA-specific deletion requests within seven (7) days; our team then completes deletion of our cloud systems within thirty (30) days and confirms by email. Data on the Lantern device itself is erased as part of that same process, or when the device is returned and re-flashed — reset instructions come with the confirmation email if you keep the device. Non-COPPA privacy requests are acknowledged within ten (10) business days and completed within thirty (30) days.

You can also email privacy@lanternlearning.io with any request.

If you do not return a signed consent form within thirty (30) days of receiving our welcome packet, we will delete the email address and contact information we collected from you, as required by 16 CFR §312.4(c)(1)(vi).

11. How we keep this safe

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Our service providers are SOC 2 Type II certified. Access to production data is restricted to a small number of authorized Scout engineers, with audit logging.

Full security disclosure: security.md.

12. Children's Privacy Policy

For the full Children's Privacy Policy, see childrens-privacy.md.

13. Questions or complaints

Email privacy@lanternlearning.io for direct questions. To file an independent complaint, contact:

Scout is not currently a member of an FTC-approved COPPA Safe Harbor program.

You may also file a complaint directly with the Federal Trade Commission at https://reportfraud.ftc.gov or with your state attorney general.

Questions? Email privacy@lanternlearning.io. To file a complaint, contact the FTC at reportfraud.ftc.gov or your state attorney general.