Bundled Privacy Policy
Last updated: October 2026. Version 2026-10-27-v2. Effective October 27, 2026.
What changed in this version: we now save your ZIP code to show how far providers are from you, save the providers you follow, and support notifications, reports and blocking. We updated sections 2, 3, 4, 5, 8 and 9 to match.
The short version
- Bundled is for parents and guardians who are 18 or older and live in the United States. Children do not have accounts.
- We collect what you give us to find and contact providers: your name, email, ZIP code, the age ranges you are looking for, and your answers about what you want.
- When you send an inquiry, the provider sees your name, the email you enter, your message and a copy of your answers. Some answers can be sensitive (for example, that your child's special needs were not supported), but every question has an answer that reveals nothing sensitive.
- We record which provider pages and posts you open, so providers can see how many families saw them. Providers see counts, never who.
- Reviews you choose to share show publicly without your name, as "A parent" with how long you have been with the provider.
- Bundled staff can see your account, answers, ZIP code, follows, reports, inquiries and reviews, for safety and support.
- We do not sell your information, we do not use it for advertising, and we never use it to train AI models.
- You can delete your account in the app at any time. Reviews you chose not to share are deleted with it; reviews you shared stay on the provider's page without your name, email or contact email.
1. Who we are and what this policy covers
"Bundled," "we" and "us" mean Bundled Inc., a company organized in Delaware. This policy covers the Bundled iPhone app for families; the provider console at providers.bundled-edu.com, where education providers manage their page; our website at bundled-edu.com, including its forms and any public provider pages; and emails and support conversations with us.
Bundled is offered only in the United States, and we store information in the United States.
A "provider" is a microschool, co-op, learning pod, tutor, camp or other program listed on Bundled. Providers are independent businesses. What a provider does with information you send it is covered by its own privacy practices.
2. Information we collect
2.1 From families (the app)
Your account. Your first and last name, your email address and a password, which we store only in a scrambled (hashed) form.
Your answers about what you are looking for. During onboarding (and later in Account) you answer these questions. Every list includes a choice that reveals nothing sensitive (such as "Prefer not to say" or "Other"):
- the age ranges of the children you are looking for. We do not ask for your child's name or birth date;
- the kinds of programs you want (for example School, Learning support, Tutoring or Summer camp);
- your program preferences and one to five top priorities, from a list that includes "Learning differences support," "Neurodivergent support," "Social-emotional," "Identity & belonging" and "Faith-based";
- three family values, ranked, from a list that includes Faith and Diversity;
- how you plan to pay (ESA, another program, scholarship, paying directly, or prefer not to say);
- where your child is now (for example, district public school or homeschool); and
- what isn't working for your child now, from a list that includes "Special needs not supported," "Unhappy, anxious, or disengaged" and "Social environment / bullying."
Your ZIP code. The app asks for your ZIP code and whether online programs work for you, and we save both. We use your ZIP code to show how far providers are from you, to sort and filter providers by distance, and to show the right words about school-choice funding in your state. We never share it with providers.
Joining your provider. When you join a provider with its link or code, we record which provider and when, and we may ask what led you to it and why you stay, from a list and in your own words. The list includes "Our child's learning differences were not supported" and "Social or emotional needs were not being met."
Inquiries. When you reach out to a provider, we collect the name and email you type, what you are interested in (enrolling, a tour, questions, or talking to a family) and your message. We attach a copy of your answers described above, fixed when you send it.
Reviews. If you are enrolled with a provider through Bundled, you can review it. A review collects your answers to the review questions (such as your relationship to the child, how long you have been with the provider, how you pay, where your child was before, what mattered to you and a 0 to 10 score), an optional public comment, whether you are willing to talk with families considering the provider and, if so, a contact email, your sharing choice with the exact words of the question you answered, and your account email.
Following providers. When you follow a provider, or join one, we save that, so its posts appear in your Feed. Providers see how many families follow them, never who.
Notifications. If you allow notifications, your iPhone gives us a notification token, which we use only to send you the notifications you allow. It does not reveal your name or contact details. You can turn each kind off in Account, then Settings, or turn all of them off in iPhone Settings.
Reports and blocks. If you report a post or a review, we save your report: what you reported, the reason you chose and any details you add. If you block a provider, we save that. It disappears from your Feed and Discover, you get no notifications about its posts, and you stop following it. You can still open its page to unblock it. The provider is never told that you reported or blocked it, or who you are.
Page and post views. When you open a provider's page or one of its posts, we record that your account opened it, at most once a day, only to show the provider how many families saw its page and its latest post.
2.2 From providers (the console and the website)
- Account: the provider's name, the sign-in email and a password (stored hashed).
- The provider page: everything the provider adds, such as its address (the street can be hidden), programs, schedule, cost, its leader's or contact person's name, role and photo, its website, photos and posts.
- Private details: a private contact email and phone number, and up to five email addresses that receive inquiries (each confirmed by email first). These are not published.
- Confirmations: that every adult who works with children in its program has passed a background check; for each gallery photo that shows people and for each post with photos, that it has permission from the parent or guardian of every child shown; and whether it says it accepts school-choice funding (shown as reported by the provider).
2.3 From visitors to our website
- Forms. The waitlist forms (name, city and state, email, and for providers the organization and role) and the About page contact form (name, email and message) are sent to Google Forms and stored in Google Sheets.
- The older provider profile builder and family review form. Before the app, providers built draft profiles on bundled-edu.com, and some families answered a review form there; that form is no longer available. What was entered on either (including, for the family form, answers about children's experiences, funding and what mattered) is stored with Supabase, a database service. The profile builder saves progress, including a sign-in token, in your browser's local storage until you clear your browser's site data.
- Analytics. Our home and About pages use Vercel Web Analytics, a visit counter that does not use cookies and does not track you across other websites.
- Fonts. Some website pages load fonts from Google Fonts and from Fontshare (Indian Type Foundry). Your browser then sends your IP address to those services.
2.4 Information created when you use Bundled
- Request logs. Our application's request logs record the time, the page or function called and the result, without your IP address, device type or search terms.
- Security and delivery records. To slow down abuse, we keep short-lived records of sign-in and join-code attempts (for join codes, a scrambled form of the IP address), and we queue emails and notifications briefly while they are sent.
- App updates. Each time the app opens, it checks for updates with Expo, our app-update service. The check sends a random number created when the app was installed, plus the app and phone software versions. It is not linked to your account.
- Emails we send you and messages you send us, such as support requests and reports.
We do not collect your precise location (we use the ZIP code you enter instead), contacts, photos or camera, or any information from other apps on your phone.
3. How we use information
- To run Bundled: create your account, show you providers and posts, send your inquiries and reviews, and let providers manage their pages.
- To match providers to what you want. Your top priorities decide the check marks you see. Your priorities and your distance from each provider decide the order of providers in Discover.
- To send the notifications you turn on, such as a new post from a provider you follow.
- To email you about your account and activity: sign-up codes, password resets and alerts, a notice if someone tries to sign up with your email, account deletion, and notices about a provider you joined. Providers also get emails about inquiries and to confirm the addresses that receive them. We do not send marketing email; if we ever do, we will ask first, and every message will let you unsubscribe.
- To keep Bundled safe: review new provider pages, handle reports, take down content that breaks our rules, and prevent fraud and abuse.
- To show providers their reach, as counts only, never who (followers, page views and post views).
- To give providers combined summaries of their enrolled families' answers: the age ranges and values families chose, and what led them to the provider and why they stay. A summary shows nothing until at least 3 families have joined. After that, an answer shows only when at least 5 families share it, without counts. Your own words are never shown.
- To fix problems, improve Bundled, meet legal obligations and enforce our terms.
No sale, no advertising. We do not sell personal information, use it for targeted advertising, or let any other company track you through our app. If that ever changes, we will update this policy first and give you a way to opt out (or ask for consent where required).
No AI training. We never use your personal information to train artificial intelligence models, including large language models.
4. Who can see your information
| Information | Who can see it |
|---|---|
| Your name and email | You and Bundled staff. A provider sees the name and email you type in an inquiry, and the contact email you give in a review if you say you are willing to talk to families. |
| Your answers | You and Bundled staff. A provider you send an inquiry to sees a copy with your inquiry. Your provider sees combined summaries, as described in section 3. |
| Your ZIP code | You and Bundled staff. Not shared with providers. |
| Providers you follow | You and Bundled staff. Providers see only how many families follow them. |
| Reports and blocks | You and Bundled staff. The provider or person concerned is never told who reported or blocked them. |
| That you joined a provider | You, Bundled staff and that provider. The provider sees the date you joined and a label for your family, which is never more than the family name you choose or your last name followed by "Family" (for example, "Smith Family"). Some families show simply as "A family." |
| Inquiries | You, Bundled staff, and the provider you sent it to, in its console and by email to its sign-in address or up to five confirmed addresses. Its replies come to your email. |
| Reviews | If you choose to share, your comment shows publicly on the provider's page as "A parent" with how long you have been with the provider, without your name. If you choose not to share, only Bundled staff read it. Providers never see your review's other answers; Bundled staff can read them all. If you said you are willing to talk with families, your provider sees that and your contact email, whatever your sharing choice. |
| Provider pages and gallery photos | Anyone. Public posts: anyone signed in to Bundled. Private posts: the provider's enrolled families and Bundled staff. |
Bundled staff. A small number of staff can see account details, answers, ZIP codes, follows, reports, inquiries, reviews and providers' hidden street addresses, to review pages, answer support requests and handle reports and safety issues.
A note on small providers. Many providers are small. Even without your name, a provider may be able to guess who wrote a review, or whose answers appear in a summary, especially soon after you join. Please write with that in mind.
5. Companies that help us run Bundled
Our service providers. Microsoft Azure, Resend, Vercel and Supabase process information only to provide their services to Bundled, not for their own purposes. Each is bound by terms that require it to give the information the same or equal protection as this policy does.
| Company | What it does for us | What it receives |
|---|---|---|
| Microsoft Azure (United States, Central US region) | Hosts our servers, database, photo storage, logs and uptime monitoring | Everything stored in the app and console |
| Resend | Sends our emails | Email addresses and the contents of each email, including an inquiry and its answers sent to a provider |
| Vercel | Hosts the provider console, the staff site and bundled-edu.com; counts website visits | Website requests and form submissions passing through it |
| Supabase | Stores the older website profile builder and family form | What was entered on those forms |
Other companies. These companies receive the limited information below, under their own terms and privacy policies.
| Company | What it does | What it receives |
|---|---|---|
| Expo (650 Industries) | Delivers app updates and sends our notifications to Apple | A random install number and software versions with each update check. If you allow notifications, your phone's Apple push token, to create your notification token. For each notification: that token and the notification's text (such as a provider's name and a post title). Never your name, email or answers. |
| Apple | Distributes the app through the App Store | What Apple collects under its own privacy policy |
| Stores waitlist and contact forms (Google Forms and Sheets); serves fonts on some website pages | Form answers; visitors' IP addresses when fonts load | |
| Fontshare (Indian Type Foundry) | Serves a font on some website pages | Visitors' IP addresses when fonts load |
We may also share information:
- with the provider you choose to contact or join, as described in section 4;
- if required by law, a court order or a valid legal request, or to protect the safety of anyone, including children;
- with our lawyers and accountants, under a duty of confidentiality; and
- if Bundled is involved in a merger, acquisition or sale of assets, with the new owner, which must honor this policy for information collected under it.
6. Sensitive information
Some answers can reveal a child's disability or learning differences, mental or emotional wellbeing, religion, or use of public school-choice funding. We use these answers only to show you providers, to send them with your inquiries as you direct, and, for answers you give when you join a provider, in that provider's combined summaries under the limits in section 3. We never use them for advertising.
Sending an inquiry shares your answers with that provider. That is what the Send button does.
Your choices. You can stop us using a sensitive answer at any time by changing it in Account (pick another option). Inquiries you send after that won't include it. Inquiries you already sent keep the copy the provider received. To remove an answer you gave when you joined a provider, write to support@bundled-edu.com.
Consumer health data. If you live in Washington, Nevada or Connecticut, some of these answers may be "consumer health data" under those states' laws. Our Consumer Health Data Privacy Policy, at bundled-edu.com/health-data and linked from our home page, explains how we handle it.
7. Children's privacy
Bundled is for adults. Only adults 18 or older may create a family account, and only adults acting for a provider may create a provider account. Children do not have accounts.
We do not knowingly collect personal information from children under 13. Please do not include your child's name, health details or other identifying information in your messages or reviews. If you believe a child under 13 has given us personal information, contact us and we will delete it.
Providers may post photos that show children. Before a provider publishes a photo that shows people, it must confirm that it has permission from the parent or guardian of every child shown. If you see a photo of your child that you did not allow, use Report on the post (for a post photo) or write to support@bundled-edu.com, and we will review it and remove it if the provider cannot confirm permission.
8. How long we keep information
| Information | How long |
|---|---|
| Account, answers, ZIP code, follows, blocks, enrollments | Until you delete your account |
| Notification tokens | Until you sign out or delete your account, or until Apple or Expo tells us the token no longer works |
| Reports you make | Kept while we need them to keep Bundled safe. If you delete your account, we remove your account from the report; the email our staff received keeps your account number for up to 2 years. |
| Inquiries | Until you delete your account. Copies already emailed to the provider stay in the provider's email. |
| Reviews you chose not to share | Until you delete the review or your account |
| Reviews you shared | Until you delete the review. If you delete your account, they stay on the provider's page without your name, email or contact email. |
| Page and post view records | About 13 months, or until you delete your account if sooner |
| Request logs | 30 days |
| Security and delivery records | 30 days or less |
| Database backups | Up to 35 days, then overwritten |
| Photos | A photo removed from a provider page stays in our storage until the provider asks us to delete it. A deleted photo is kept as a recoverable copy for 14 days. |
| Website forms (Google, Supabase) | Until you ask us to delete them |
| Support and report emails | Up to 2 years |
9. Your choices and rights
See and change your information. You can change your name, answers and ZIP code in the app's Account tab. To unblock a provider, open its page and tap Unblock. You can turn notifications off in Account, then Settings, or in iPhone Settings. Providers edit their page in the console.
Delete your account. In the app: Account, then Settings, then Delete account. You confirm with your password. Your account is deleted right away, you are signed out, and we email you to confirm. Deleting removes your account, your answers, your ZIP code, your place at your provider, your follows and blocks, your notification tokens, your inquiries, your notices, your page and post view records, and reviews you chose not to share. Reviews you shared stay on the provider's page, without your name, email or contact email. Messages you sent to another person stay in that person's conversation, shown without your name. Reports you made are kept as safety records, no longer linked to your account. Reports other people made about your account are kept as safety records. Emails already sent, such as your inquiry in a provider's inbox, are outside our control. Backups are overwritten within 35 days.
Provider and staff accounts cannot be deleted in the app or console. Write to support@bundled-edu.com from the account's email, and we will reply before anything is removed. If you answered questions on bundled-edu.com, write to us and we will delete those answers too.
Withdrawing your agreement. You can stop us using a sensitive answer as described in section 6, or end all use of your information in the app by deleting your account.
Your privacy rights. Wherever you live in the US, you can ask us to:
- confirm whether we process your personal information and give you access to it;
- give you a copy in a portable format;
- correct it;
- delete it;
- stop using your sensitive answers; and
- opt out of sale, targeted advertising and profiling that has legal or similarly significant effects. We do none of these, so there is nothing to opt out of today.
Some state laws, including Connecticut's Data Privacy Act, give residents these rights; we offer them to everyone. Write to support@bundled-edu.com from the email address on your account, or use the in-app options above. We may ask you to confirm the request from that address. We will reply within 45 days, or tell you if we need up to 45 more. Using these rights costs nothing and won't change how we treat you. If we decline a request, we will tell you why, and you can appeal by replying with "Appeal" in the subject; we will answer within 60 days. If we deny your appeal, you can contact your state attorney general (for Connecticut, https://portal.ct.gov/ag). An authorized agent may make a request for you with your signed permission.
Nevada. Nevada residents can send a request to opt out of the sale of covered information to support@bundled-edu.com. We do not sell covered information.
10. Do Not Track and tracking by others
Bundled does not track you across other websites or apps, so our sites and app work the same whether or not your browser sends a "Do Not Track" signal. We do not allow other companies to collect information about your activity on Bundled across other websites or apps over time, except that some website pages load fonts from Google Fonts and Fontshare (section 2.3).
The app does not use Apple's advertising identifier and does not ask for permission to track you.
11. Cookies and similar technologies
The app, the provider console and our server do not use cookies. The console keeps your sign-in only in the browser tab's memory. The app keeps your sign-in in your iPhone's secure Keychain; iOS may keep it even if you delete the app, so sign out first if you want it gone. Our website uses local storage as described in section 2.3, and no advertising cookies.
12. Security
We use measures such as encrypted connections (HTTPS), hashed passwords, access limited to people who need it, and removing hidden location and camera data from photos. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
13. Changes to this policy
When we change this policy, we post the new version here with a new version and "Last updated" date. If a change is significant, we will tell you in the app or by email before it takes effect, and ask for your agreement again where the law requires. If a change would let us use information we already have in a new way, we will ask for your agreement first. The previous version is linked at the end of this page, and earlier versions are available on request from support@bundled-edu.com.
14. Contact us
- Privacy questions and requests: support@bundled-edu.com
- Mail: Bundled Inc., 430 Scarecrow Court, Hockessin, DE 19707