Privacy Policy

Our Commitment

This privacy policy explains what data we collect, how we use it, and the rights you have. We comply with the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA).

Information We Collect

Data Type	What	Why
Account Information	Name, email address, and profile picture (from Google Sign-In)	To create your account and identify you
Student Writing	Essays, responses, and drafts submitted through assignments	To provide AI-powered feedback and track progress
Progress Data	Scores, completion status, time spent, and skill mastery levels	To show progress to students and teachers
Class Information	Class name, class code, teacher-student associations	To organize students into classes and deliver assignments
Usage Data	Pages visited, features used, browser type	To improve the product and fix bugs
Language & Accessibility	English language proficiency level, home language (if provided by teacher)	To provide appropriate scaffolding and language support for English Language Learners
Learning Preferences	Interest categories selected by the student (e.g., sports, animals, science)	To personalize assignment topics and content

What We Do NOT Collect

• Passwords (authentication is handled entirely by Google)
• Payment or financial information
• Location data
• Social media profiles
• Advertising identifiers

How We Use Student Data

Student data is used exclusively for educational purposes:

• AI Feedback — Student writing is sent to our AI sub-processor to generate personalized, standards-aligned feedback. Our sub-processor does not use this data to train AI models. See our sub-processor list for the vendor name, processing location, and the categories of data sent.
• Progress Tracking — Scores and completion data are shown to the student and their teacher(s).
• Teacher Reports — Teachers see aggregated and individual student progress to identify who needs help.

FERPA Compliance

Under FERPA, schools control student education records. As a school-authorized service provider, we:

• Act under the direct control of the school regarding student data
• Use student data only for the educational purposes authorized by the school
• Do not disclose student data to unauthorized third parties
• Comply with school requests to access, correct, or delete student records
• Maintain reasonable security measures to protect student data

Schools may request a Data Processing Agreement (DPA) template that formalizes these commitments. The template is a starting point intended for legal review with district counsel.

COPPA Compliance

Our platform serves students as young as grade 2 (approximately age 7). For students under 13:

• Schools act as the authorized agent for parental consent under COPPA, as permitted when the data is used solely for educational purposes
• We collect only the minimum data necessary for the educational service
• We do not require students to provide more information than is reasonably necessary
• Parents may contact us or the school to review, correct, or delete their child's information

Data Security

We protect student data with industry-standard security measures:

• Encryption in transit — All data is transmitted over HTTPS (TLS 1.2+)
• Encryption at rest — Database hosted on managed PostgreSQL with encryption at rest
• Authentication — Google OAuth 2.0 (no passwords stored)
• Access control — Students can only access their own work; teachers can only access their own classes
• Security headers — Content Security Policy, HSTS, XSS protection, and other HTTP security headers
• Session management — Sessions expire after 8 hours of inactivity; cookies are HttpOnly and Secure

AI Sub-Processor

We use a third-party AI provider ("our AI sub-processor") to generate coaching feedback on student writing. The vendor's identity, processing location, and the categories of data we send are published in our sub-processor list.

What we send

We do not transmit student names, email addresses, or account identifiers to our AI sub-processor. Submitted content is associated only with an opaque token internal to our system.

Training and model improvement

Student writing submitted for coaching feedback is processed by our AI sub-processor solely to generate that feedback. It is not used to train, fine-tune, or improve any AI model. Our agreement with the sub-processor prohibits training on submitted content, and we have not opted in to any data-sharing programs.

Retention by the sub-processor

Our AI sub-processor may retain submitted content for up to 30 days for safety and abuse monitoring, after which it is deleted. This retention is required by the sub-processor's safety policy and is not used for model improvement, advertising, or any commercial purpose.

Security

Data in transit is encrypted using TLS 1.2 or higher. Data at rest with our AI sub-processor is encrypted using AES-256. Our sub-processor maintains SOC 2 Type 2, ISO/IEC 27001:2022, and ISO/IEC 27701:2019 certifications, and publicly states support for customer compliance with FERPA, GDPR, and CCPA.

California obligations

Our written agreement with the sub-processor extends California's SOPIPA and AB 1584 protections to processing performed on our behalf: no targeted advertising directed at students, no profiling outside the educational service, and no sale of student data.

Cookies

We use a small number of cookies that are essential for the service to function:

• Session cookie — Keeps you signed in during your session. HttpOnly, Secure, and SameSite=Lax. Expires after 8 hours of inactivity.
• Google Analytics cookies — Used by GA4 to distinguish users and collect anonymous usage statistics. No personally identifiable information is stored. You can opt out using the Google Analytics Opt-out Browser Add-on.

We do not use advertising cookies, tracking pixels, or any third-party cookies beyond those listed above.

Data Retention and Deletion

• Student data is retained for the duration of the school's use of the platform
• Schools may request deletion of all data associated with their classes at any time
• Individual student accounts can be deleted upon request from the school or parent/guardian
• When data is deleted, it is permanently removed from our active database and backups within 30 days

Third-Party Services

Service	Purpose	Data Shared
Google OAuth	Authentication (sign-in)	Name and email, provided by user during sign-in
AI sub-processor (see sub-processor list)	AI inference for coaching feedback	Student writing content and assignment context, associated only with an opaque internal token (no student names, email addresses, or account identifiers)
Render	Application hosting	All application data (encrypted at rest)
Sentry (optional)	Error monitoring	Technical error details (no student writing content)
Google Analytics (GA4)	Anonymous usage analytics	Aggregated page views and feature usage (no student writing content, no personally identifiable information). See Google's privacy policy.

We do not use advertising networks or social media tracking pixels. Google Analytics data is used solely to understand aggregate product usage and improve the service.

Your Rights

For schools and teachers:

• Request access to all data associated with your classes
• Request correction of inaccurate student information
• Request deletion of all class and student data
• Export student progress data (CSV format)
• Request a Data Processing Agreement

For parents and guardians:

• Request to review your child's data through the school
• Request correction or deletion of your child's data
• Withdraw consent for data collection (which may require the student's removal from the platform)

Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will notify schools of material changes at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

Contact Us

If you have questions about this privacy policy or want to exercise your data rights, please contact us: