Privacy Policy

We collect only what we need to run the learning experience:

• Account data — name, email, role (student, parent, teacher, admin), and school or class association.
• Student learning data — questions attempted, answers, mastery, streaks, badges, and time on task.
• Rostering data — where a school connects Clever, Google Classroom, or ClassLink, we receive the roster fields those services provide.
• Technical data — device type, browser, and basic diagnostics needed to keep the service reliable and secure.

We use the information above only to:

• Deliver and personalize adaptive practice for each learner;
• Give teachers and administrators the dashboards and reports they need;
• Keep parents informed about their own child's progress;
• Maintain the security, integrity, and reliability of the service.

We never use student personal information to build advertising profiles or for any commercial purpose unrelated to the educational service.

We do not sell personal information. We share it only with the school or family that owns the account, and with service providers (“subprocessors”) who help us run the platform under contract — for example, cloud hosting and authentication. These providers may access data only as needed to perform their function and are bound by confidentiality and data-protection obligations.

COPPA. BrainTrail is designed for use in educational settings. For students under 13, we act as an agent of the school or the supervising parent and rely on school or verifiable parental consent for the collection of a student's personal information, consistent with the Children's Online Privacy Protection Act. We collect from children only the information reasonably necessary for the learning activity, and a parent or school can review or request deletion of that information at any time.

FERPA. When BrainTrail is used by a school, student records are the school's education records. We handle them as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act, use them only for the purposes authorized by the school, and do not re-disclose them except as directed by the school or as permitted by law.

Schools and districts that require a Data Privacy Agreement (DPA) can request one at [email protected].

We retain student learning data for as long as the account is active or as the school directs. When an account is closed, or on verified request from a school or parent, we delete or de-identify the associated personal information within a commercially reasonable period, except where retention is required by law.

We protect data in transit and at rest using industry-standard encryption, enforce role-based access controls, and take regular backups. No system is perfectly secure, but we work to limit access to personal information to those who need it to operate the service.

We use a small number of cookies that are strictly necessary to run the service — for example, to keep you signed in and to remember your school context. We do not use advertising cookies or third-party tracking cookies directed at students. Any analytics we use is limited to aggregate, privacy-preserving measurement of site performance.

Depending on your role and location, you may have the right to access, correct, export, or delete personal information. Parents and schools may exercise these rights on behalf of a student. To make a request, contact us at [email protected].

We may update this policy from time to time. We will notify registered users of material changes by email or in-app notice, and we will update the effective date above.

Questions about privacy or student data? [email protected]