Ranked #34 of 42 in Education
Red Flags
2"We may aggregate and/or de-identify any information collected through the BEGiN Services or other communications with you so that such information can no longer be linked to you or your device ('Aggregate/De-Identified Information'). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties at our discretion."
The company claims unrestricted rights to aggregate and de-identify user data and share it with any third party for any purpose, with no limitations โ raising concerns about how robustly data is actually de-identified.
Warnings
8"Advertising Partners. We may disclose information about your interaction with our Services with partners in relation to personalizing advertising and integrations. Third Party Partners to Provide Co-Branded or Jointly Offered Products and Services... Your information may be collected directly by, or disclosed with the Partner, as well as with any participating sponsors or advertisers of such Services."
The policy permits sharing user data with advertising partners, co-branding partners, sponsors, affiliates, and service providers, creating a broad web of third-party data sharing for personalization and marketing purposes.
"These third parties may use cookies, web beacons or other tracking technologies to collect information about your use of the Services and your activities across other websites and online services, which they may associate with persistent identifiers. Sometimes, these identifiers may be derived from a hashed or encrypted version of personal information such as your email address. We may use this information to measure the performance of our advertising as well... In addition, sometimes we or an advertising partner may tailor advertising to you across different devices."
The policy acknowledges cross-device and cross-site tracking using persistent identifiers (including hashed email addresses) to build profiles and deliver targeted advertising across websites and devices.
"We also may collect your device's IP address when you use the BEGiN Services as well as the city, state, county, and ZIP code associated with that information. ... We may also collect different types of information about your location, including general location information (such as your IP address and ZIP code) and we may use that information to customize the Services with location-based information and features."
The policy collects geolocation data derived from IP addresses, including city, state, county, and ZIP code, and the California disclosure table lists 'precise location information' as sensitive personal information collected.
"We collect technical information associated with the device(s) you use to access the BEGiN Services, including information related to your browser and operating system, IP address (the Internet address of your computer), unique device identifiers, mobile advertising Id, and other information such as your device type. We also collect a variety of information to better understand your use of our BEGiN Services. This may include the webpages, screens, or features of the BEGiN Services you use, how much time you spend there, date, time and use, how you engage with the BEGiN Services."
The policy collects extensive device data including unique device identifiers, mobile advertising IDs, browser fingerprinting data, and detailed usage patterns โ notably for a children's education service.
"We reserve the right to update or modify this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of the BEGiN Services, or advances in technology. When we do so, we will post the updated Policy on the BEGiN Services with a new 'Last updated' date... Your use of the BEGiN Services following any such change constitutes your agreement that all information collected from or about you after the revised Privacy Policy is posted will be subject to the terms of the revised Privacy Policy."
The company reserves the right to change the privacy policy at any time, and treats continued use of the service as acceptance of the new terms, without requiring explicit consent for changes.
"We will retain your information for as long as necessary to fulfill the purposes described above, or as needed to comply with applicable legal obligations. We also retain and use your information as necessary to resolve disputes, protect us or our users, and enforce our agreements."
The retention policy is vague with no specific timelines, retaining data indefinitely based on broad justifications like 'legitimate interests' and 'resolving disputes,' and the HOMER policy similarly states data is kept for as long as there is a 'business need.'
"This website uses cookies, plugins, web beacons and/or pixels to help keep track of items you put into your shopping cart including when you have abandoned your cart and this information is used to determine when to send cart reminder messages via SMS. ... If you consent in accordance with the HOMER Messaging Terms & Conditions, you agree to receive recurring automated promotional and personalized marketing text (e.g., SMS and MMS) messages from HOMER."
The service tracks cart abandonment to send SMS reminders and uses automated recurring promotional text messages, which can function as dark patterns nudging users toward completing purchases or maintaining subscriptions.
"To keep your or your child's information accurate, current, and complete, delete your or your child's information, or restrict us from further collecting or using your child's information, please contact us through the app or at privacy@homerapp.com. ... We also need to take reasonable steps to verify your identity before responding to a request, which may include, at a minimum, depending on the sensitivity of the information you are requesting and the type of request you are making, verifying your name and email address."
There is no self-service account or data deletion option; users must email support and go through an identity verification process, and the policy notes that certain information may be exempt from deletion requests.