Student data

The short version

The platform has never held real student financial data and is not designed to. Every balance, transaction, paycheck and bill in it is generated by a simulation from a seed.

That is not a policy we could relax under pressure. There is no integration through which real financial data could arrive.

FERPA — school official model

Where a school or district uses the platform, we act as a school official with a legitimate educational interest under FERPA, performing an institutional service the school would otherwise perform itself.

We use education records only for the purposes the school directs, remain under the school’s direct control with respect to those records, and do not redisclose them except as the school instructs or the law requires.

The school remains the owner of its records. We are a processor of them.

COPPA — school consent model

For students under 13, we rely on the school to provide consent on behalf of parents, which COPPA permits where the service is used solely for an educational purpose and the data is not used commercially.

We do not use student information for advertising, for building profiles for non-educational purposes, or for any commercial purpose beyond providing the service.

What we collect, and what we do not

Collected: the minimum needed to run a class — a display name, a grade band, a class assignment, lesson progress, assessment responses and scores, and simulation activity.

Not collected: real financial account information, government identifiers, biometric data, precise location, browsing behaviour outside the platform, or webcam or microphone recordings. We do not use webcam proctoring and will not.

No advertising identifiers or third-party analytics trackers are present.

Retention and deletion

Records are retained for as long as the school’s agreement is in force, and deleted on the school’s instruction or at the end of the agreement.

[SLOT — DEFAULT RETENTION PERIOD. Should be set in the district agreement rather than asserted here; commonly 30 to 90 days after termination for return-then-delete.]

A parent or eligible student who wants access to or deletion of their records should ask their school first, since the school controls them. We will also act directly on a school-verified request: privacy@example.invalid.

Sub-processors

We use third parties for hosting and infrastructure only. [SLOT — CURRENT SUB-PROCESSOR LIST. To be published as a maintained list with locations and functions, updated on change, and referenced by the district agreement.]

No sub-processor is permitted to use student data for its own purposes.

District agreements

We will sign a district data protection agreement, a state student privacy addendum, or an equivalent instrument. Send yours to support@example.invalid and it will go to counsel rather than into a queue.

Incidents

If student data were ever exposed, we would notify the affected school without undue delay and give it what it needs to meet its own notification obligations.

[SLOT — NOTIFICATION WINDOW. To be fixed in the district agreement; typically 72 hours.]