← Honey Root home

Privacy policy

Last updated: October 7, 2026

The plain-language version

Honey Root helps kids learn to read by listening to them read aloud. That means we handle something sensitive: your child’s voice. Our rules are simple. You choose how long recordings are kept, and you can change your mind at any time. We never sell data, we never show ads, and we never use your child’s voice to identify them. You can delete your child’s data whenever you want.

Who we are

Honey Root is operated by Honey Root LLC, an Illinois limited liability company. Mailing address: 672 Carriageway Drive, Buffalo Grove, IL 60089. Phone: +1 224-212-0401. For anything in this policy, contact us at hello@myhoneyroot.com. We respond to privacy requests within a few business days. Honey Root is offered to families in the United States during early access.

What we collect from you (the parent)

• Your email address and a password, for your account.
• Your child’s first name or nickname, age, and grade, plus the interests you pick so stories match what your child likes, and any reading concerns you choose to share.
• Payment details are handled by Stripe; we never see your card number. We keep the payment confirmation that serves as your consent record (see “How consent works” below).

What we collect from your child’s reading

• Audio of your child reading aloud during Honey Root activities: reading practice in sessions and, if your child plays them, voice practice games. How long recordings are kept is controlled entirely by the retention choice you make during setup (see the table below).
• What our system heard: the transcript of the attempt, word timings, and reading-error records (for example, that “mat” was read as “mit”), including corrections you confirm after a session. These structured records are how the app tracks progress; they are not audio.
• Skill progress records and parent notes built from those records.
• Session and usage records (stories read, games played, hints shown, time spent) used to run and improve the product.
• If you turn on “Tell Bloom your story”: a first name your child speaks (their own, a family member’s, or a pet’s) and a short story idea written from what they said, saved with that story so it feels like theirs. This feature is off for each child until you turn it on.

Your choice about your child’s voice

You can change this choice in your settings at any time. One rule is stronger than every tier: when your child tells Bloom a story idea out loud, the recording of their voice is never stored, on any tier. If you have turned that feature on, we do keep two things from what your child said: the first name and short story idea described above, saved with the story. No other person’s real name is ever kept, and you can see and delete any saved story, including the name and idea, from your settings.

If a recording accidentally captures another person’s intelligible words, including a family member joining in during a game, we do not use it for training and we delete any retained copy when we detect or learn of it.

What we never do

• No ads, ever, anywhere in Honey Root.
• We never sell or rent personal information.
• No ad pixels or advertising trackers on any page. We do measure our own ads from our server, and we count visits to our public pages with an analytics tool. Both are described under “How we measure our own ads” below.
• We never use your child’s audio to recognize who they are, and we never build voiceprints.
• We never let vendors train their models on your child’s data.

Biometric data. We do not collect, capture, or store biometric identifiers or biometric information, including voiceprints, as defined by the Illinois Biometric Information Privacy Act or any similar law. Recordings of your child’s reading are used to check the words they read, never to identify who is speaking, and neither we nor our service providers extract voiceprints, speaker embeddings, or other speaker-identifying features from them.

How consent works (COPPA)

Children’s-privacy law (COPPA) requires verified parental consent before a child can use an app like Honey Root. We verify with a small card charge of about fifty cents that is automatically refunded once verification completes, recorded as your consent record, as permitted by 16 CFR §312.5(b)(2)(ii). A signed-form alternative is available by email. We do not condition your child’s use of Honey Root on disclosing more personal information than is reasonably necessary to participate.

You may refuse further collection or use of your child’s information at any time. Because Honey Root works by listening to your child read, refusing audio collection means your child’s reading sessions will stop working — but your parent account stays open, your child’s existing records stay until you delete them, and you can turn collection back on whenever you like. Cancelling a subscription (if we ever have one) and withdrawing consent are separate things: cancelling does not delete your child’s data or revoke your consent record.

Who processes data for us

We share children’s personal information only with the service providers below, only so they can run Honey Root for us, under contracts that limit what they can do with it. We do not disclose children’s personal information to anyone for their own purposes — advertising, marketing, data brokering, or training their AI models — and we would never do so without asking for your separate consent first.

How we measure our own ads

We run ads for Honey Root on Google and on Meta, which owns Facebook and Instagram. If you came to us from one of those ads and then signed up, our server tells that one company two things: that the click led to a signup, and later that the account finished parent verification. With each we send the click code the company itself put in the link when you clicked, and the time. For Meta we also send the kind of browser you used. That is the whole list.

We never send your name, your email address, your IP address, anything about your payment, or anything about your child. No code from Google or Meta runs on any Honey Root page. If you did not arrive from one of our ads, nothing about you is sent to either company.

We do this so we can tell which ads bring families to Honey Root, and so Meta can show our ads to people more likely to be looking for help like this. Meta may use the fact that an ad click led to a signup, together with what it already knows about its own users, to decide who sees our ad next. We never build lists of our families for advertising, and under Meta’s terms no other advertiser may target ads using our data. In the states where Meta offers it, fourteen today including California and Connecticut, we send Meta a flag that keeps your signup out of that; Meta then uses it only to report on our ads.

Our public pages also use Google Analytics to count visits, with its advertising features turned off and addresses shortened. It does not run on any page your child sees or inside the app. You can read how Google handles that data at policies.google.com/technologies/partner-sites.

If you would rather we did not measure your signup this way, you can turn it off on our privacy choices page: sign in and choose Stop ad measurement, or email us with the subject line “Stop ad measurement.” Either way we stop sending anything further about your account. Some browsers can send a signal called Global Privacy Control. If yours sends it when you visit or sign up, we do not keep the click code from the ad, so nothing about your signup goes to Google or Meta, and Google Analytics does not load. When you delete your account we stop sending. What was already sent to Google and Meta cannot be taken back by us, and it identifies no one by name or email.

Your rights as a parent

• See it: review what we have about your child from your parent dashboard, or ask us for an export.
• Delete it: choose Delete my account on your Family page, use myhoneyroot.com/delete-account, or email us with the subject line “Delete my account.” Deletion completes within 30 days and is irreversible. Consent and payment records we are legally required to keep are retained.
• Change your mind: downgrade your retention choice at any time; downgrades stop new training-set use immediately and no later than 24 hours, and previously retained audio is deleted within 30 days with email confirmation. If you revoke by email instead of in-app, we verify and apply it within 72 hours.
• Refuse: refuse further collection at any time, as described under “How consent works” above.

If we say no to a request, you can appeal by emailing us with the subject line “Appeal”: we will answer in writing, with our reasons, within 60 days, and if the answer is still no we will tell you how to reach your state’s attorney general.

How long we keep everything else

Audio follows the table above. Nothing else is kept forever either:

• Transcripts, word timings, reading-error records, skill progress, and parent notes are kept while your child’s profile is active, so the app can keep teaching from where your child left off, and are deleted within 30 days when you delete the profile or close your account.
• Session and usage records are kept while your account is active and deleted or de-identified when no longer needed, and always within 30 days of account deletion.
• Saved stories, including a name and story idea your child spoke, are kept until you delete the story, the profile, or the account.
• Your account and consent records (email, consent record, payment confirmation) are kept for the life of your account, plus the period the law requires us to keep proof of consent and payment.

When your child’s information is no longer needed for the purpose we collected it, we delete it. If you close your account, we delete your family’s data on the same 30-day schedule as a deletion request, except records we are legally required to keep.

US state privacy rights

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act and similar state laws. We do not use personal information for targeted advertising, and we do not profile anyone in ways that produce legal or similarly significant effects. Measuring our own ads, described above, tells Google or Meta only whether an ad click led to a signup. Meta may use that to decide who sees our ads next; we never target ads at you based on what you or your child do on Honey Root, and you can opt out of ad measurement at any time, on our privacy choices page or by email. Whatever state you live in, you can access, correct, export, or delete your family’s information as described above, and we will never treat you differently for exercising a privacy right. If your state’s law gives you additional rights, email us and we will honor them.

Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Children sign in with a parent-set PIN inside a parent-controlled account; children’s surfaces carry no advertising identifiers. If a security breach affects your family’s data, we will notify you by email without unreasonable delay, and no later than 72 hours after we confirm it where feasible.

Changes to this policy

If we make a material change, we will email you at least 30 days before it takes effect. If a change affects what we collect from children or how we use it, we will ask for your consent again rather than assume it.