Privacy Policy

Who this policy covers

Planted Seed Christian Academy ("Planted Seed") operates an early-learning program in Indiana that participates in the federal Head Start program. Bloom is the software Planted Seed uses to enroll families, communicate with parents, log children's days, and comply with federal recordkeeping requirements. This policy explains what personal information Bloom collects, how it's used, and how it's protected.

Data we collect

• Parent and guardian information — name, email, phone, mailing address, relationship to child, and the information required by Head Start ERSEA (household size, income range, housing status).
• Child information — name, date of birth, gender, OMB race categories, Hispanic/Latino indicator, primary language at home, allergies and medical notes, photo (optional).
• Attendance and daily activity — drop-off and pickup times with the authorized guardian who performed each, diapers, naps, meals eaten, mood observations, and teacher notes for each day your child is enrolled.
• Documents you provide — custody orders, Individualized Education Programs (IEPs), immunization records, physical exam forms, and other enrollment paperwork.
• Account data — your email address, a bcrypt hash of your account password (we never store the plaintext), and your chosen 4-digit pickup PIN (also stored as a bcrypt hash).
• Device push tokens — when you enable notifications in the Bloom mobile app, we store an Expo push token so we can notify you of new activity, messages, and attendance events.

How we use your data

Your data is used only to operate Planted Seed's program and to meet the federal reporting requirements the program is subject to:

• Enrollment, attendance, and ERSEA selection tracking.
• Head Start Program Information Report (PIR), CACFP meal-claim reporting, and health-screening compliance.
• Day-to-day communication — messages between parents and teachers, activity updates with photos, daily logs.
• Safety — verifying that the person checking a child in or out is an authorized guardian.

We do not sell personal data. We do not share personal data with advertisers or data brokers.

Service providers

Bloom runs on a small number of specialized processors who act strictly as data processors under Planted Seed's direction:

• Supabase — primary database and file storage, hosted in the United States.
• Vercel — web hosting for the administrative dashboard.
• Expo — mobile app distribution and push notification relay.
• Resend — transactional email delivery.
• Twilio — transactional SMS delivery.

These providers are contractually bound to use your data only for the service they provide to us and to safeguard it according to industry standards.

Children's data

Bloom is used by Planted Seed specifically to manage care of enrolled children. Information about children is entered by authorized staff or by the child's parent/guardian. Access to a child's records is restricted to (a) Planted Seed staff with a legitimate operational need, and (b) the child's parents and authorized pickup persons. Access is enforced at the database level using row-level security rules.

Photos of children are only captured with consent recorded at enrollment, and parents may withdraw consent at any time by contacting the school.

Security

Passwords and pickup PINs are stored as bcrypt hashes. All data in transit is protected by TLS. Uploaded documents and photos are stored in private storage buckets that require a signed URL to access; signed URLs expire within an hour. Administrative access to the database requires a separate service-role credential that is never exposed to client applications.

Your rights

You may request a copy of the personal information Planted Seed holds about you or your child, request corrections, or request deletion (subject to Planted Seed's regulatory obligations to retain certain records). Contact the school office at office@plantedseed.app.

SMS messaging

Details specific to SMS — what messages are sent, how consent is collected, how to opt out — live on our SMS messaging policy page.

Contact

Questions about this policy go to office@plantedseed.app.