Privacy Policy

If you install the ClassThought mobile app and enable notifications, we store a push notification token for your device and your notification preferences. Notifications are delivered through the Apple Push Notification service (APNs) for iOS devices.

Notification content passes through Apple's notification service. Notification messages can include classroom context — for example, a student's first name and the type of activity ("submitted a reading log," "is requesting a hall pass"). This content is transmitted to Apple solely to deliver the notification to your device and appears on your device's lock screen and notification center according to your device settings.

You can disable notifications at any time in the app's notification settings or in your device's system settings. Notification preferences are controlled by each account owner: teachers control their own notifications, and notifications about a student are governed by the recipient's own settings.

5.1 Within the Service. User Content may be shared with other authorized users within the same class or Educational Institution as part of the normal operation of the Service. For example, Teachers can view Student submissions, and Students can view assignments posted by their Teachers.

5.2 Service Providers (Sub-Processors). We share information with third-party service providers who help us operate the Service. We maintain a list of these providers — including what each one does and what categories of data it may process — on our Sub-Processor List page. In summary, they include:

• Supabase — database, authentication, file storage, and real-time infrastructure (hosts all Service data);
• Vercel — web hosting and privacy-focused web analytics;
• Render — hosting for our document-conversion worker, which transiently converts uploaded Word documents into page previews (no file retention);
• Stripe — payment processing for Teacher and school subscriptions;
• Apple — mobile app distribution (App Store) and push notification delivery (APNs);
• Resend — delivery of account emails to Teachers (password resets, confirmations, security notices);
• Hostinger — email infrastructure for our administrative mailbox and communications with Teachers;
• Google — optional integrations chosen by users: YouTube video playback, Google Drive file selection, Google sign-in, and translation of user-entered text in the translation tools;
• Microsoft — Office document preview (Word, Excel, PowerPoint files are rendered by Microsoft's online viewer) and optional Microsoft sign-in; and
• MyMemory and LibreTranslate — backup translation services used by the translation tools when needed.

These service providers process information only to provide their services to us. If we add, replace, or remove a sub-processor, we update the Sub-Processor List and its "Last Updated" date.

5.3 External Content and Integrations. Some features send limited data to third parties only when a user actively uses them: text typed into the translator or dictionary tools is sent to translation services to be translated; previewing an uploaded Office document sends the file to Microsoft's viewer for rendering; playing an embedded YouTube video connects the viewer's browser to YouTube (which applies its own privacy policy); and selecting a file from Google Drive connects to Google with the Teacher's permission. These flows are described in the Sub-Processor List.

5.4 Legal Requirements. We may disclose information if required to do so by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

5.5 Business Transfers. If ClassThought is involved in a merger, acquisition, or sale of all or a portion of its assets, we will notify users of any change in ownership or uses of personal information, as well as any choices users may have regarding their personal information.

5.6 No Sale of Data. We do not sell, rent, or trade any personal information or Student Data to third parties for their commercial purposes.

6.1 Safeguards. We implement administrative, technical, and physical safeguards designed to protect against unauthorized access, alteration, disclosure, or destruction of personal information. These measures include:

• Encryption of all data in transit using SSL/TLS;
• Teacher passwords managed by our authentication provider using industry-standard hashing — they are never stored in readable form;
• Row-level security policies in our database so users can only access data they are authorized to see;
• Private, access-controlled file storage: student files, recordings, and uploads are served through short-lived signed links rather than public URLs;
• CSRF protection on all data-modifying operations; and
• Restricted access to personal information to those who need it to operate, develop, or improve the Service.

6.2 Student Classroom Credentials. Student accounts use simplified, Teacher-managed classroom credentials rather than personal passwords. By design, the managing Teacher can view and retrieve a Student's classroom password at any time — for example, to help a young student log in or to print classroom login cards. Unlike Teacher passwords, these classroom passwords are not one-way hashed because Teachers need to retrieve them for classroom management. They are protected by encryption in transit and by database access controls that limit them to the managing Teacher. Student classroom passwords should never be a password the Student uses anywhere else, and they protect access only to that Student's classroom space.

6.3 No Guarantee. No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. If we become aware of a breach affecting personal information, we will notify affected Educational Institutions and users consistent with applicable law.

7.1 FERPA. When the Service is used by an Educational Institution, we process Student Data as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act ("FERPA"). The Educational Institution retains ownership and control of all Student Data. We use Student Data only to provide the Service and as directed by the Educational Institution. (FERPA does not have a government certification program; no vendor can be "FERPA certified." Instead, we describe our actual practices in this Policy and in our Sub-Processor List so schools can evaluate them.)

7.2 COPPA. We do not knowingly collect personal information from children under 13 without appropriate consent, consistent with the Children's Online Privacy Protection Act ("COPPA").

• Students cannot create their own accounts — only Teachers can create Student accounts.
• When the Service is used in a school setting, we rely on the Educational Institution to provide consent for the collection of student personal information as permitted under COPPA ("School Consent").
• We collect from Students only the information needed to provide the classroom features their Teacher uses.
• Student accounts do not require an email address, phone number, or any payment information.
• We do not condition a Student's participation in any activity on the disclosure of more personal information than is reasonably necessary.

7.3 Parental Rights. Parents or legal guardians have the right to:

• Review the personal information we have collected from their child;
• Request that we delete their child's personal information; and
• Refuse to permit further collection or use of their child's personal information.

To exercise these rights, parents should contact their child's Teacher or Educational Institution, or contact us directly at admin@classthought.com.

7.4 Student Data Protections. We maintain the following protections for Student Data:

• We do not use Student Data for targeted advertising;
• We do not create advertising profiles based on Student Data;
• We do not sell Student Data;
• We do not use Student Data for purposes other than providing and improving the educational Service; and
• We do not disclose Student Data except as authorized by the Educational Institution, as required by law, or as described in this Privacy Policy.

8.1 Retention. We retain personal information and User Content for as long as the account is active or as needed to provide the Service. Student Data is retained for as long as the Student's account is active and the Educational Institution maintains its use of the Service.

8.2 Deletion by Teachers. Teachers may delete Student accounts and associated data from their classes at any time. Teachers may also delete their own accounts and associated data through the account settings; account deletion removes the account's records and uploaded files from our systems.

8.3 Deletion by Request. Educational Institutions, Teachers, or parents may request deletion of Student Data by contacting us at admin@classthought.com. We will process deletion requests within a reasonable timeframe.

8.4 Inactive Accounts. We reserve the right to delete account data after a prolonged period of inactivity that reasonably suggests the account has been abandoned.

8.5 Backup Copies. Deleted data may persist in our infrastructure provider's backup copies for a limited period but is not available to other users and is removed as backups age out.

We use cookies and similar browser storage technologies to operate the Service. Specifically:

• Essential Cookies: Required for the Service to function, including authentication cookies that maintain Teacher login sessions.
• Local Storage: Used to maintain login state and preferences on each device. Student sessions persist on the device (so young students don't have to log in every time class starts) until they expire or are signed out; each device session can be ended by logging out, and Teachers control Student credentials.
• First-Party Analytics: We record page views in our own database — including the page visited, IP address, approximate location (country/region/city), browser and device type, screen size, and referring page — to understand usage and improve the Service.
• Vercel Web Analytics: Our hosting provider's privacy-focused, cookie-free analytics, which reports aggregate page views and visit statistics.

Students are excluded from analytics. Both analytics systems are disabled on student surfaces: the student dashboard, the student QR login surface, and any page viewed while a student is signed in on a device are not tracked. Analytics apply to our public website and Teacher/administrative pages only. (Educational activity records — such as assignment submissions or reading scores — are classroom features described in Section 2.3, not analytics, and are unaffected.)

We do not use advertising cookies, and we do not track users across other websites. Analytics data is used only to operate and improve the Service — never for advertising or profiling. Embedded third-party content (such as a YouTube video a Teacher assigns) may set that provider's own cookies when played; see Section 5.3.

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service. Our own third-party service providers are listed on the Sub-Processor List.

When Teachers include links to external content within assignments or class materials, they are solely responsible for verifying the appropriateness of such content.

11.1 California Residents. If you are a California resident, you may have additional rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"). However, Student Data processed under a school's direction is generally exempt from CCPA/CPRA. For non-student users, you may have the right to request access to, deletion of, or information about the personal information we collect. To exercise these rights, contact us at admin@classthought.com.

11.2 State Student Privacy Laws. We work with Educational Institutions to support their obligations under applicable state student data privacy laws. If your state has specific requirements regarding student data privacy, your Educational Institution is responsible for notifying us of such requirements, and we will work with the Institution to address them.