1. Introduction

Welcome to Argraide. We are committed to protecting your privacy and handling your data responsibly. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Platform.

Our Core Privacy Principle: We practice data minimization by design. We collect only the information necessary to provide our services. Students are never asked for a name, email address, phone number or any other contact detail. The sections below say exactly what we do keep, where it is stored, which service providers touch it, and for how long.

2. Information We Collect

2.1 Teacher / Creator Accounts

For educators who create accounts, we collect:

Account Information: Email address, username, and password (stored as a one-way hash, never in plain text).
School (optional): The school or district you type at signup, used to tailor curriculum suggestions. The lookup field is powered by Google Maps.
Profile Information: Display name, profile picture (optional), and teaching areas.
Usage Data: Activities created, session information, and feature usage.
Payment Information: For Marketplace sellers, payment details are securely processed through Stripe. We do not store full payment card details.

2.2 Student Accounts (Zero-PII Architecture)

Students are never asked for personal information. A student joins a class with a class code, receives a randomly generated username, and chooses a three-emoji code (e.g., 🚀🦁🍕) that acts as their password. The code is stored only as a one-way hash. No names, emails, phone numbers, or other contact details are collected.

The data associated with a student account is:

Class membership (which class codes they joined).
Learning progress: scores, completion status, per-question results including attempts and how close a wrong answer was, hints used, and time spent. This is what teachers see in their class dashboard. The answer a student typed or picked is never stored: results record whether it was right and how close it was, not what it said.
AI helper summaries: when a teacher has the in-activity helper turned on and a student uses it, an AI-written summary of the help session (topics asked about, what helped) is kept for the teacher. The conversation itself is not stored. See Section 2.4.
Preferences the student sets: language, theme, read-aloud voice and speed, text size, high contrast, reduced motion and whether timers are shown. They exist so every activity respects the student's own settings.
Cosmetic and motivation data such as avatar choices, XP, streaks and sign-in counts.

Optional teacher nicknames. A teacher may attach a nickname (often a first name) to a student in their class roster so they know who is who. The nickname is encrypted in the teacher's browser with a key generated on that device; we store only the ciphertext and never receive the key, so we cannot read the nickname. Teachers can copy the key to another device or forget it. If the key is lost, the nicknames cannot be recovered by anyone.

Live sessions. Students can also join a teacher's hosted session with a join code and a name of their choosing, without an account. The join screen asks for a first name or a nickname, never a full name, and a student who leaves it blank gets a made-up name like “Calm Badger”. The name and the student's responses are visible only to the hosting teacher: during the session, and for 7 days after it closes (when the teacher ends it, or when a self-paced link expires; a classroom link stays open for at most 24 hours), so the teacher can review who needed help. Then every name a student typed is replaced by “Player 1”, “Player 2” and so on in join order (a made-up name holds nothing personal and stays), so the teacher's review and exports keep per-player results without any typed name. Thirty days after the session, everything that could identify a participant is deleted automatically: typed responses, drawings, the AI helper summaries for those participants and the device token stored with the player record. What stays is anonymous: each Player number's answers marked right or wrong, attempts and scores, so the teacher can look back over the school year. Those are deleted one year after the session. If a self-paced link is left open, the 30 days count from when each response was sent and each name was typed. Sessions held before this policy was updated keep the rule they started under: everything is deleted 30 days after the session. The student's own browser keeps a random device token, used only so a refreshed phone can rejoin as itself, and remembers the name for 12 hours.

What a response can contain. Students never write sentences or paragraphs in an activity: the platform limits every answer box in an activity to 40 characters, enough for a word, a number or a short term. Some hosted activities collect a response for the class to discuss, such as a one-word answer or a drawing on a shared canvas. Those responses are stored with the session so the teacher can review them, and are deleted 30 days after the session. Outside hosted sessions, no typed answer is ever stored.

2.3 Automatically Collected Information

Technical Data: Browser type, device information, and operating system.
IP addresses are not attached to any account or analytics record. They are used transiently to rate-limit AI endpoints and prevent abuse, and those logs are purged within hours.
Cookies: Session cookies for authentication and preferences. A student's sign-in cookie holds only their generated username and account id; it lasts up to a year on that device or until they sign out, so on shared devices students should sign out. Trying the builder without an account sets a random guest token for 30 days. See Section 5 for details.

2.4 AI Processing

Argraide is built on AI models from third-party providers. Here is exactly what is sent to them:

Activity generation: the teacher's prompt, curriculum text, uploaded images, and the activity code being built. No student data is involved.
Translation and images: activity text and image prompts authored by the teacher or the builder.
In-activity helper (optional): when a student asks the helper a question or presses a hint button, the request includes the student's typed question, the text currently visible on their screen, and their progress in that activity (for example, right and wrong counts and hints used). It never includes a name, username, email or account identifier.

Teacher control. The in-activity helper can be switched off for any activity by its teacher; when it is off, no student text is sent to an AI provider. A school or board admin can also switch it off for every activity their teachers assign or host, from the organization's settings; a board's switch covers all its schools, and no teacher can turn it back on. Translation can be switched off for the whole organization the same way.

Read-aloud. The speaker buttons inside activities play a natural voice generated by Google (Gemini) from the activity's own text (prompts and feedback lines), cached so each sentence is generated once. The cache holds activity text only and is readable by anyone with its address, which is why nothing a student types or draws is ever sent for speech.

The providers we use for these requests are Google (Gemini), OpenAI and Anthropic, through their business APIs, which under their published terms do not use API inputs to train their models. Student text is never sent to any other provider.Argraide does not use student data to train AI models.

3. How We Use Your Information

We use collected information to:

Provide and improve the Platform's functionality.
Process Marketplace transactions and Creator payouts.
Facilitate Community Impact Grant donations to charitable organizations.
Communicate important updates about your account or the Platform.
Send teachers onboarding tips and activity recommendations by email (see Section 5.2). Students never receive email from us.
Ensure security and prevent fraud.
Comply with legal obligations.

We do NOT:

Sell your personal information to third parties.
Use student data for advertising or marketing.
Share data with third parties for their marketing purposes.

4. Community Impact Grants & Charitable Donations

Argraide donates 1% of annual platform profits to charitable causes aligned with UN Sustainable Development Goals. Teachers vote annually to determine which SDGs receive funding. In connection with these donations:

Donations are made by Argraide on behalf of the global teaching community.
We may share aggregate, non-personal statistics about total donations and supported SDGs.
No personal information about individual Creators or students is shared with charitable organizations.

5. Cookies & Tracking

We use cookies for:

Essential Cookies: Required for authentication and core functionality.
Preference Cookies: Remember your settings (e.g., dark mode, language). When you browse the Library without signing in, a cookie on your device also remembers up to 24 activities you opened (their ids and when), so you can find them again; it lasts six months from your last visit and holds nothing about you.
Analytics Cookies: Help us understand how teachers use the Platform. On student, play, join and live-session pages, analytics is limited to anonymous page counts: no session recording, no automatic event capture, no IP address, no person profile and no student identifier.

We do not use cookies for behavioral advertising or cross-site tracking.

5.1 Privacy-Hardened Analytics

We use PostHog for product analytics, configured in “Zero-PII Mode” with the following privacy protections:

No IP Address Collection: IP addresses are explicitly disabled and never stored.
Anonymous Identifiers Only: Users are identified solely by anonymous database UUIDs — never by name, email, or username.
Masked Session Recordings: All form inputs and screen text are masked in any session replays, appearing as asterisks (****).
No Copy-Paste Capture: Text that users copy or paste is never recorded.
Student Data Protection: On student, play, join and live-session pages, session recording and automatic event capture are switched off, no IP address is attached and no person profile is created. Only anonymous page counts and a handful of counter events (for example, that a student signed in) are recorded, with no student identifier of any kind. Events recorded on our own servers for student actions are stored with no user attached.

This configuration ensures that even in the event of a data breach at our analytics provider, no information about any student could be exposed, because no student identifier is ever transmitted.

5.2 Email Communications

Teacher accounts receive transactional email (sign-in links, receipts, assignment notifications) and, unless you opt out, occasional onboarding tips and activity recommendations. Every such email carries a one-click unsubscribe link, and you can manage each category at Email preferences. Email is delivered through Resend. Students have no email address on file and never receive email.

6. Children's Privacy & COPPA

Protecting children's privacy is paramount. Our Platform is designed to comply with the Children's Online Privacy Protection Act (COPPA) by not collecting contact information from children under 13 and by operating under the school-consent model, where the school consents to a student's use of the Platform for educational purposes and notifies parents as part of its normal technology communications.

For detailed information, please review our COPPA Compliance Statement.

7. Data Security

We implement industry-standard security measures to protect your data:

All data is encrypted in transit using TLS (1.2 or higher, 1.3 where supported) and at rest with AES-256.
Passwords and student emoji codes are hashed with bcrypt.
Database row-level security ensures teachers can only reach their own classes and students their own records.
Access to personal data is restricted to authorized personnel only.
Dependencies and access are monitored continuously. An independent penetration test is on our roadmap; until it is complete we answer security questionnaires on request.

7.1 Where Data Lives

Our database and file storage run on Supabase in AWS Canada (Montreal, ca-central-1). AI requests described in Section 2.4 are processed by providers in the United States and never include student identifiers. Analytics on student-facing pages is limited to anonymous counts (Section 5.1).

8. Data Retention

We retain your information only as long as necessary to provide our services:

Active Accounts: Data is retained while your account is active.
Teacher Accounts: You can delete your account from Settings at any time. Your name, username, bio and avatar are removed immediately and the account is closed. Activities you published stay in the library without your name. Your sign-in email remains in our authentication records so the account cannot be re-registered by someone else; write to the address below to have it removed, which we do within 30 days.
Student Accounts: A student can delete their own account from their dashboard at any time, and a teacher or school can ask us to delete any student or class. Progress records and AI helper summaries are removed with the account.
Live Sessions: Names a student typed stay visible to the teacher for 7 days after the session closes, then are replaced by “Player 1”, “Player 2” and so on; a made-up name (like “Calm Badger”) holds nothing personal and stays. Typed responses, drawings, device tokens and the AI helper summaries for those participants are deleted automatically 30 days after the session. The anonymous per-Player results (answers marked right or wrong, attempts, scores) are deleted one year after the session. See Section 2.2.
AI Helper Conversations: Not stored. Only the summary described in Section 2.2 is kept, with the student's progress.
Product Analytics: Teacher-page analytics events are retained as aggregate product data with no student information.

9. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data.
Object to or restrict certain processing.
Data portability (receive your data in a structured format).

To exercise these rights, contact us at support@argraide.com.

10. Third-Party Services

We use the following third-party services:

Supabase: Database, file storage and authentication (hosted in AWS Canada, Montreal). Holds student progress records.
Vercel: Application hosting and content delivery. Stores no student data.
Stripe: Subscription and payout processing for teacher accounts.
PostHog: Product analytics, configured with privacy-hardened settings that disable IP collection and mask all text; on student-facing pages it receives anonymous counts only (see Section 5.1).
Resend: Email delivery to teacher accounts.
Google Maps: The school lookup field on teacher signup.
Google (Gemini): Activity generation, translation, image generation, read-aloud speech for activity text, and the in-activity helper (see Section 2.4).
OpenAI and Anthropic: Activity generation and automated quality review of generated activities.

We also hold evaluation API keys for two further model providers, DeepSeek and Moonshot AI. Neither is enabled for any task today, and neither can receive student text: the in-activity helper is restricted in code to the three providers above. If either is ever enabled for activity building, this list is updated before that happens.

These services have their own privacy policies governing their use of data. Our configuration of these services prioritizes privacy and minimizes data exposure.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or prominent notice on the Platform. The “Last Updated” date at the top reflects the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: support@argraide.com

Privacy Policy