Privacy Policy

Effective date: October 29, 2026
Last updated: October 29, 2026

This Privacy Policy explains how 12 Stones Holdings LLC, a Virginia limited liability company doing business as ToShay: Homeschool Exchange ("ToShay," "we," "us," or "our"), collects, uses, and shares information when you use the website at https://homeschool.exchange (the "Service"). It should be read together with our Terms of Use.

We have tried to write this in plain language. If anything is unclear, email support@homeschool.exchange and we will explain.

---

1. Information you give us

Account information. When you sign up, we collect your email address and password. Passwords are hashed by our authentication provider; we never see or store your password in readable form.

Profile information. You may add a display name, a general location, and a short bio, all of which other users can see. You may also save the grades and subjects you teach. Those are private: only you can see them, and we keep them so we can suggest relevant curriculum in the future. Your profile also stores your email notification preferences.

Listings. Item details such as title, author, publisher, curriculum name, ISBN, subject, grade range, condition, price, listing type, exchange method, pickup area, description, and photos you upload. Before a photo is uploaded, your browser resizes it and removes embedded metadata, including GPS location data, so your photos do not reveal where they were taken.

Book lookups. If you look up a book by ISBN, the details returned (such as title, author, publisher, a summary, and a cover image) are saved with your listing if you choose to use them. Summaries are shown in an "About this book" section, and cover images are labeled "Stock image."

Wanted ads. Details of materials you are looking for, such as title, subject, grade range, and description.

Messages. The content of messages you send to other users through the Service, along with the sender, recipient, time sent, whether the message has been read, and the listing or wanted ad it relates to.

Ratings and sales. When you mark a listing sold, we record which buyer you chose, or that it was sold elsewhere, and when. If you rate a seller, we record your stars, any tags you choose, your comment, when you posted and last edited it, and which listing and seller it is for. We also record that we sent you a rating request email for a listing, so we never send it twice.

Curriculum reviews. If you add a book, we record its details (such as title, author, publisher, year, ISBN, subject, curriculum, and where its cover image comes from), that you added it, and when. If you review a book, we record your bookmark rating, the grade you used it with, how long you used it, your tags, your review text, and when you posted and last edited it. If you comment on a review, we record your comment and when you posted it. We also record that we sent a reviewer an email about a comment, so we never send it twice.

Reports. If you report a listing, wanted ad, conversation, rating, curriculum review, or comment, we record who made the report, what was reported, the reason, and any details you provide. We also email each new report to our own support inbox so we see it promptly. That email includes the reason, your details, the display names of the people involved, and a copy of what was reported if it is public, such as a listing, review, or comment. It never includes the text of private messages.

Section interest. If you click "Notify me" on a section of the Service that is not yet available, we record which sections you asked to hear about. You can remove yourself at any time from the same page.

Support correspondence. If you email us or use our contact form, we keep what you send: your message, your email address, your name if you give it, the topic you choose, the page you came to the form from, and, if you are signed in, which account sent it.

Copyright notices. If you send us a copyright infringement notice or counter-notice, we keep it, including the name, address, phone number, and email address in it. If a notice is sent about your content, we may share it with you, and if you send a counter-notice, we may share it with the person who sent the original notice, as the Digital Millennium Copyright Act process requires.

2. Information collected automatically

Server logs. When you visit the Service, our hosting provider logs standard technical information including IP address, browser type, device type, referring page, pages requested, and timestamps. This is used for security, debugging, and understanding traffic volume.

Bot protection. Our login, signup, forgot-password, and contact forms use Cloudflare Turnstile to check that a real person is using them. Turnstile looks at technical signals from your browser and device to do this. It does not show ads or build advertising profiles.

Contact form limits. If you use the contact form while signed out, we store a coded form of your IP address with your message, not the address itself, only to limit how many messages one connection can send. A daily cleanup removes it once it is more than 30 days old, so we keep it for no more than 31 days.

Usage statistics. We use Vercel Web Analytics to collect anonymous, cookie-free usage statistics, such as page views, referring sites, country, and device type, to understand how the Service is used.

Cookies. We do not use advertising trackers or third-party analytics cookies. The cookies we set are those necessary to keep you signed in and to keep the Service functioning. You stay signed in until you sign out, including after you close your browser.

Browser storage. We use your browser's local storage for a few conveniences that stay on your own device:

• An unfinished listing, wanted ad, or curriculum review, so you do not lose your work if the page closes. These drafts are tied to your account and are removed when you publish them, clear the form, or sign out.
• Recent ISBN lookup results, kept for up to one day so repeat lookups are faster.
• Whether you have dismissed the beta notice.

Display name history. When you change your display name, we keep a record of your previous names and when they changed. This record is not shown to you or other users. We use it to investigate impersonation and abuse.

3. How we use information

We use the information described above to:

• Create and maintain your account and keep you signed in
• Display your listings, wanted ads, and public profile to other users
• Deliver messages between you and other users
• Email you when you receive a new message, unless you turn this off
• Show sellers' ratings, and email you once with a link to rate the seller when a seller chooses you as the buyer, unless you turn this off
• Show curriculum reviews and comments, and email you when someone comments on your review, unless you turn this off
• Send account email such as signup confirmations, password resets, email address change confirmations, security codes, and notices when your password or email address changes
• Let you know when sections you asked about become available
• Respond to support requests and messages sent through the contact form
• Review reports and copyright notices, and investigate fraud, abuse, impersonation, or violations of our Terms of Use or Community Guidelines
• Maintain the security and reliability of the Service, including preventing automated abuse
• Comply with legal obligations

We do not sell your personal information. We do not share it with advertisers, and we do not use it to build advertising profiles.

4. What other users can see

Anyone browsing the Service can see your listings and wanted ads, including item photos, descriptions, prices, and any pickup area or general location you provide. Your display name is visible on your listings, wanted ads, and messages, and your bio is visible on your profile.

Your email address is not shown to other users. They contact you through the Service's messaging system rather than by email. The grades and subjects saved on your profile are also private.

If you rate a seller, your stars, tags, comment, display name, and the month you posted it appear on that seller's ratings page once the rating is final, 12 hours after you post it. Anyone can see them, including people who are not signed in. Until then only you can see it. If you sell, your average rating, number of ratings, tag counts, and final ratings are public. The buyer a seller chooses is visible only to that seller and that buyer.

If you review a book or comment on a review, your review or comment appears with your display name on that book's page. Anyone can see it, including people who are not signed in, and it may appear in search engine results such as Google. A book page also shows its average rating, number of reviews, and tag counts. Who added a book is not shown.

Please treat anything you put in a listing, a wanted ad, your bio, a rating comment, a curriculum review, a comment on a review, or a photo as public. Avoid including your home address, phone number, or other details you do not want visible to strangers.

5. About your messages

Messages between users are stored in our database. They are not end-to-end encrypted.

This means that we, as the operator, are technically able to read them. We do not read messages routinely or for any commercial purpose. We may access them when investigating a report of harassment or fraud, when you ask us for support that requires it, when required by law, or where necessary to protect someone's safety.

Messages cannot be deleted by the sender or the recipient once sent. This keeps a record available if a problem needs to be reported.

When you receive a new message, we may send you an email that includes the sender's display name and a short preview of the message. You can turn these emails off on your profile page or with the unsubscribe link in any notification email.

When a seller chooses you as the buyer, we send you one email with the seller's display name, the listing title, and a link to rate them. You can turn this off on your profile page ("Email me when a seller picks me as the buyer") or with the unsubscribe link in that email. It is separate from message emails.

When someone comments on your curriculum review, we may send you an email with the commenter's display name, the book's title, a short preview of the comment, and a link to it. You can turn this off on your profile page ("Email me when someone comments on my curriculum review") or with the unsubscribe link in that email.

Do not use the messaging system to share passwords, bank or card numbers, Social Security numbers, or similarly sensitive information.

6. Service providers

We rely on a small number of third parties to operate the Service. Each has access only to what it needs, and each has its own privacy policy.

If we add providers, such as a payment processor, we will update this list.

We may also disclose information if required by law, subpoena, or court order, or where we believe in good faith that disclosure is necessary to protect our rights, investigate fraud, or protect the safety of any person.

If the Service or 12 Stones Holdings LLC is ever sold or transferred, user information may transfer as part of that transaction. We would notify you before your information becomes subject to a different privacy policy.

7. Payment information

The Service does not currently process payments. Buyers and sellers arrange payment directly with each other, and we do not collect card numbers, bank details, or other payment information.

If we add payment processing in the future, we will update this policy before that feature takes effect.

8. Data retention

We keep account information for as long as your account is active.

Listings and wanted ads you remove are hidden from other users but kept with your account, so you can see them on your My listings page. Messages, reports, and ratings are kept for safety and record-keeping. Support correspondence, including contact form messages, is kept so we have a record of what we were asked and how we answered.

When your account is deleted, we delete your account record, profile, display name history, listings, wanted ads, uploaded photos, section interest, ratings other users posted about you as a seller, the record of who bought your listings, and the records of rating request and review comment emails sent to you. Some information is kept after deletion:

• Messages you sent remain in the other user's conversation history, since they are part of that person's record too. They are no longer linked to your account.
• Ratings you posted stay on the seller's ratings page, shown as from "Deleted user," and are no longer linked to your account.
• Curriculum reviews and comments you posted stay on the book's page, shown as from "Deleted user," and are no longer linked to your account. After that they can no longer be edited or deleted through the Service, so if you do not want them kept, delete them before your account is deleted. Comments other users left on your reviews stay with the reviews.
• Books you added stay on the Service, since other users' reviews may be attached to them. They are no longer linked to your account.
• Reports you made, and reports about your content, conversations, ratings, reviews, or comments, are kept for our safety records, but they are no longer linked to your account or to the reported content or rating.
• Support email and contact form messages you sent are kept as support correspondence. Contact form messages are no longer linked to your account.
• Copyright notices and counter-notices we received or sent are kept as records of how we handled them.

Backups and server logs may retain copies of deleted information for a limited period, typically a few weeks, until they are replaced. Where we are required to retain records for legal, tax, or fraud-prevention purposes, we keep only what is necessary for that purpose.

9. Your rights and choices

You can view and update your profile, listings, wanted ads, and curriculum reviews at any time while signed in, delete your reviews and comments, and turn message, rating request, and review comment emails on or off on your profile page. To delete your account, email support@homeschool.exchange from the email address on your account, and we will delete it.

You may also request access to the personal information we hold about you, request correction of inaccurate information, request deletion, and appeal a refusal of any of these requests.

Some state privacy laws, such as those in Virginia, California, Colorado, Connecticut, and Utah, give residents rights like these. We extend them to all users, regardless of where they live, because it is simpler and fairer than doing otherwise.

To make a request, email support@homeschool.exchange. We will respond within 45 days. We may need to verify your identity before acting on a request, which usually means confirming control of the account email.

We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of in that respect.

10. Security

We use HTTPS for all traffic, rely on our authentication provider for password hashing and session management, and use database-level access rules so that users can only read and change their own data. We also use bot protection and limits on login and signup attempts and on contact form messages, and our backups are encrypted.

No system is perfectly secure. We cannot guarantee that unauthorized access will never occur. Use a strong, unique password, and tell us at support@homeschool.exchange if you suspect a problem with your account.

11. Children

The Service is for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us at support@homeschool.exchange and we will delete it.

12. Changes to this policy

We may update this policy as the Service changes. When we do, we will update the "Last updated" date above. If the changes are material, we will make a reasonable effort to notify you through the Service or by email.

13. Contact

Questions, requests, or concerns about privacy:

12 Stones Holdings LLC dba ToShay: Homeschool Exchange
8401 Mayland Dr Ste A
Richmond, VA 23294-4648
Email: support@homeschool.exchange