Privacy Policy

1. Who controls this data

The School is the data controller. Student accounts are created and managed by the School’s administrators and teachers — students and families do not self-register. Enrollment in the School’s normal admissions process is treated as the basis for a parent or guardian’s consent to the School’s educational use of the Platform, consistent with how the School already handles other classroom software and records.

2. What we collect

• Account information: first name, grade level, and the school-assigned login the teacher or admin sets up.
• Progress data: completed missions and lessons, challenge attempts and code submissions, XP, levels, badges, and leaderboard standing.
• Content a student creates on the Platform: project submissions, code written in the Code Lab, and posts/comments in the Community section.
• Basic technical data needed to keep accounts secure, such as login timestamps.

We do not collect home addresses, phone numbers, payment information, or precise location data. The Platform does not show advertising and does not use third-party advertising or tracking cookies.

3. How we use it

Data is used only to run the Platform: showing a student their own missions and progress, letting teachers track their class, letting admins manage courses and rosters, and keeping the leaderboard and badges working. We do not sell student data, and we do not share it with third parties except the infrastructure providers that host the Platform (database hosting and server hosting), who process it only to deliver the service and are not permitted to use it for their own purposes.

4. Where data is stored

Student and account data is stored in a managed Postgres database (Supabase) with access controls restricting each account to its own school’s and, for students, its own data. The Platform is served over HTTPS and uses a restrictive Content-Security- Policy to reduce the risk of malicious scripts.

5. How long we keep it

Account and progress data is kept for as long as a student is enrolled at the School and using the Platform. When the School removes a student’s account — for example after they leave the School — their account is deactivated and the School can request permanent deletion of their data as described below.

6. Parent and guardian access

A parent or guardian who wants to review, correct, or request deletion of their child’s data should contact the School’s administration directly, who can act on the request through the admin tools or by contacting the Platform’s maintainers.

7. Changes to this policy

If this policy changes in a way that affects what data is collected or how it’s used, the School will be notified before the change takes effect.