Privacy notice

Effective November 13, 2026. Steptrail is run by PJM Designs LLC.

Who we are

PJM Designs LLC operates Steptrail. Contact: PJM Designs LLC, 5157 E Condensery Rd, Sheridan, MI 48884. Phone (616) 320-2342. Email information@pjmdesigns.biz. We answer privacy questions within 10 business days.

What we collect about children

A parent enters, and can change at any time:

• The child's first name or a nickname, grade, and learning settings (for example, the dyslexia plan, text size, letter spacing).
• An optional picture: one of our built-in characters, or a photo taken on your device. You can turn photos off in Personalize. Photos are stored on our server and shown only inside your account.
• Optional extra words from school.

While a child practices, Steptrail records:

• Each answer, whether it was right, and how long it took. This is how the lessons decide what to review and when to move up, and how the report card is built.
• Practice days and minutes, stickers earned, game scores, and one-minute check scores a parent enters.
• Optional reading recordings. In Story Time a child can tap "Read and record" to save their voice reading a page, so you can hear progress. We keep the newest 40 recordings per child and delete older ones on their own. Nothing listens to or analyzes the recordings; they are only played back to you.

Steptrail does not ask children for their full name, address, phone number, email, school, or location, and it has no chat or messaging between users. We never require a child to give more information than an activity needs. We do not make voiceprints from recordings or face templates from photos, and we do not use children's information for automated decisions or profiles beyond choosing the next lesson.

What we collect about grown-ups

• Your name, email address, and password (stored only as a one-way hash we cannot read back), and the grown-up PIN (also hashed).
• Email addresses you enter for the weekly summary.
• Questions you send us through Help and support, and our answers.
• A list of the emails we send you (address, subject and time, not the text), so we can check delivery when an email goes missing.
• If you turn on alerts on a device, the address your browser gives us for sending that device an alert.
• Your plan and payment status. Payments are handled by Stripe. We never see or store your card number; Stripe tells us only whether a payment went through.
• Our hosting company's servers record the network address of every visit, as all web servers do, to keep the service running and secure.

How we use it

Only to run Steptrail for your family: to plan each day's practice, save progress, show reports and the weekly email, keep accounts secure, take payment, and answer your questions. We may use totals with no names (for example, how many lessons were finished this month) to improve the lessons.

Who we share it with

Only the companies we need to run the service, and only what they need:

• InMotion Hosting, which runs our servers and stores the data.
• Stripe, which handles payments. Stripe gets the paying grown-up's email and payment details. It gets no information about children.

InMotion Hosting only stores and runs the service for us (support for our internal operations) and may not use the information for anything else. We do not disclose children's information to any other third party, so we never ask you to consent to that; if that ever changed, we would ask you separately first, and you could say no and keep using Steptrail. We do not share children's information with anyone else. If the law requires us to share information, for example a valid court order, we will only share what is required. If PJM Designs LLC ever sells Steptrail, we will tell you first, and the buyer must keep these promises or delete the information.

Cookies and storage on your device

We use one cookie to keep your device signed in, and small settings saved on the device (such as the color a child picked for the games). There are no advertising or tracking cookies.

How long we keep it (our data retention policy)

We keep children's information only as long as Steptrail needs it to teach and report on your child, and never indefinitely:

• Lesson answers, practice record, scores and settings: kept while the account is active, because each day's lessons are built from them. Deleted when you remove the child or delete the account, or 90 days after a trial or plan ends (we email you 7 days before).
• Reading recordings: the newest 40 per child; older ones are deleted on their own. All are deleted with the child or account.
• Photos: kept until you change or remove the picture, remove the child, or delete the account.
• An account whose email is never confirmed (no parent consent): deleted 30 days after sign-up.
• Daily backups: copies are overwritten within 14 days, so deleted information leaves the backups within 14 days.
• Grown-up information: kept with the account and deleted with it. The list of emails we sent is kept 90 days.
• Your agreement to a plan's automatic renewal terms (the date, your email and the terms shown): kept 3 years, as California law requires, even after the account is deleted. It contains nothing about children.
• Stripe keeps payment records as tax and financial laws require.

Your choices and rights

As the parent or guardian you can, at any time:

• See everything about your child on the progress and report card pages, and download all of it in Settings, "Download your data".
• Change or remove anything you entered, remove a child (Personalize, then "Remove" with the child's name), or delete the whole account (Settings, "Delete account").
• Stop us from collecting more by removing the child or deleting the account. You can also turn off photos and stop using reading recordings.
• Ask us any question about your child's information at the contact above.

Parent consent

The children's privacy law in the United States (COPPA) asks us to get a parent's verifiable consent before we collect information from children. Here is how it works:

• When you sign up, we collect only your name and email and send you a notice explaining what we collect from children, why, and that we share it with no one.
• You give consent by confirming your email through the link in that notice. Until you do, the kids' screen does not open.
• The next day we send a second email confirming your consent and how to take it back.
• If you never confirm, we delete your email and the account after 30 days.
• You can take back your consent at any time by deleting the child or the account in Settings, or by emailing us; we then delete the child's information.

Schools

When a school or district uses Steptrail with its students:

• The school is in charge of the records. We act for the school as a "school official" under the federal student records law (FERPA), use student information only to provide Steptrail to that school, and follow its directions.
• The school gives consent for students. As the children's privacy law (COPPA) allows for school use, the school agrees in place of parents, and Steptrail is used only for school purposes. Parents may ask the school to see or delete their child's records.
• Less information. For students we keep only a first name and last initial, grade, class and the practice record described above. No email, birthday, address or student ID.
• Teachers see their own classes. A teacher sees only the students in their classes; the person who runs the school's account sees every class. Changes to classes, students and teachers are logged.
• No ads, no selling, no profiles. We never use student information for advertising, never sell it, and never build profiles for any purpose other than the school's (Michigan's student online privacy law, MCL 388.1295, and the same rules everywhere else).
• Leaving. The school can download all its data at any time and delete its account; we delete student records on the school's request and 90 days after its plan ends.
• Agreements. We sign student data privacy agreements, including the Michigan agreement, on request.

Security

Every page is encrypted in transit (HTTPS). Passwords and PINs are stored only as one-way hashes. Each family's information is walled off so no other account can see it. Only PJM Designs LLC can reach the servers. We follow a written information security program for children's information: PJM Designs LLC's owner is responsible for it, we assess the risks at least once a year, test the safeguards, and update the program when something changes. If a breach ever affected your information we would tell you promptly.

Changes

If we change this notice in a way that affects children's information, we will email you before the change takes effect and ask for your consent again where the law requires it.