Privacy policy

Last updated: October 26, 2026 · Products: CenterFlow (centerflowapp.com) and the CenterAide browser extension (formerly Class-Navi+)

This policy describes how CenterFlow LLC, an Indiana limited liability company (“CenterFlow,” “we,” “us”), collects, uses, and shares information when you use our websites, apps, and browser extensions, including check-in, Student Roster, the account hub, and the CenterAide Chrome extension for Kumon Class-Navi and KSIS. It applies alongside the Terms of Service.

Information we collect

• Account data: Email address and authentication data via Supabase when instructors sign up or sign in, including Google sign-in where you choose it.
• Center operations data: Student roster details, attendance events, worksheet levels, staff accounts, kiosk settings, and family contact details that instructors or staff enter or sync to run their learning center. Instructors control this data; CenterFlow processes it on their behalf.
• Synced roster data: If your center connects ClassNavi or KSIS, we receive the student list and study information those features import. Our browser extension reads those pages in your own signed-in browser session and sends only roster and study data to CenterFlow, never your browsing history and never your Kumon password. The extension is the only way we sync this data.
• CenterAide extension activity: Most of the extension works in your browser on the Kumon page you are viewing. To share them across a center's laptops, it keeps a grading log, follow-up notes, a change log, study patterns and center settings on our servers, identifying students by their Kumon student ID or login ID rather than by name. For billing it reports a count of subject enrollments, plus your center id and center name. The CenterAide privacy policy describes this in full.
• Kumon credentials: We do not ask for, receive, or store your ClassNavi or KSIS password. Syncing happens entirely through the extension, using the session you are already signed in to on your own machine.
• Parent text messages: If a center turns on parent texts, we store the parent or guardian phone numbers the center enters, a record of the consent the center collected (who recorded it and when), each text we send with its delivery status and cost, and any STOP, START or HELP replies. See parent texts.
• Billing data: Subscription status and Stripe customer identifiers when billing applies. Full payment card numbers are handled by Stripe and never touch CenterFlow servers.
• Technical data: Standard server logs (IP address, browser type, timestamps) used for security, rate limiting, and debugging.

How we use information

• Provide attendance and roster features to your center
• Authenticate users and enforce access permissions between centers, staff, and families
• Keep your roster in sync with the systems you connect
• Process payments and support billing inquiries when applicable
• Respond to support requests and improve reliability and security

We do not sell personal information, and we do not use student or family data for advertising or profiling.

Text messaging

Phone numbers are used only to send the attendance alerts a family agreed to receive from its center. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except our messaging provider (Twilio) as needed to deliver the messages. Reply STOP to any text to opt out at any time.

Cookies and local storage

We use cookies and browser storage only to keep you signed in, remember preferences such as theme and kiosk settings, and cache pages so the apps load fast. We do not use advertising or cross-site tracking cookies.

Service providers

We use trusted processors to run the Service: Supabase (authentication and database), Stripe (payments, when used), Cloudflare (hosting and content delivery), Twilio (delivering parent text messages), and Resend (transactional email such as sign-in codes). They process data only to provide their service to us. We may also disclose information if required by law, or to protect the security of the Service and its users.

Data retention and deletion

We retain account and center operations records as long as needed to provide the Service and meet legal obligations. Instructors can export their roster at any time and may request deletion of their account and their center’s data by contacting support; we delete or de-identify it within a reasonable period after closure, except records we must keep (such as billing records).

Security

All traffic is served over HTTPS. Passwords are stored only as salted hashes, and API access is scoped per center. No method of transmission or storage is 100% secure, but we review and improve our practices on an ongoing basis, and we will notify affected centers of any breach as required by law.

Children

CenterFlow is intended for adult instructors, staff, and parents/guardians; children are not end users of the Service. Student information is entered or synced by centers to operate their programs, and each center is responsible for its notices to families. We collect no information directly from children, and we process student data only on the center’s instructions.

Your choices and rights

• Instructors can view, correct, export, or delete their center’s data from the apps or by contacting support.
• Parents and guardians should direct questions about their student’s records to their center, which controls that data; we will assist the center in honoring such requests.
• Depending on where you live, you may have additional rights to access, correct, or delete personal information. Contact us and we will honor them as the law requires.

Changes to this policy

If we make material changes, we will update the date above and give notice in the app or by email before the changes take effect.

Contact

Privacy questions: support@centerflowapp.com.