Privacy Policy & Student Data Practices

This Privacy Policy explains how Thinking Classroom Tracker ("TCT," "we," "us") collects, uses, and protects information when a teacher ("you") uses the Service, including information about students that flows through the app. It is written to align with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and general K-12 student data privacy best practices.

TCT is architected so that no student name — imported or manually typed — is ever transmitted to or stored on our servers. This is true for both ways a teacher can add a student:

Google Classroom roster import

When a teacher chooses to import a class roster from Google Classroom, the exchange happens entirely inside the teacher's own browser. The teacher's browser calls Google's Classroom API directly, using the teacher's own Google access token, to fetch student names, Google Classroom user IDs, and course information. That data goes straight from Google to the teacher's browser — it is never routed through, or seen by, our servers.

Manually-entered students

When a teacher types in a student's name by hand instead of importing from Google Classroom, that name is used only to render the roster in the teacher's own browser. The request the browser sends to our server to create that student record contains no name at all — the server receives and stores only an internally-generated student number and a null Classroom identifier. The name the teacher typed never crosses the wire to our servers.

What stays in the browser only

• All student names — whether imported from Google Classroom or manually typed by the teacher — stored locally via the browser's IndexedDB.
• Google Classroom course metadata and sync timestamps.
• The teacher's Google access token, held only in sessionStorage and cleared when the browser tab closes.

What reaches our servers

The only student-related information that ever reaches TCT's servers (hosted in Neon, a serverless Postgres provider) is:

• A student number — an opaque, sequential integer (1, 2, 3…) assigned per class period. This number carries no information about the student's identity.
• A Google Classroom identifier — Google's own opaque numeric string — present only for students imported from Google Classroom, and null for manually-entered students.
• Internal database keys (UUIDs) used to link records together.
• Rubric scores, point totals, and group assignments, all tied to the student number rather than to any name.

Our database contains no column capable of storing a student's name, first name, last name, or initials — that capability was intentionally removed from the schema. We do not store student email addresses, full legal names, grade levels, school affiliations, birthdates, or any other Google Classroom profile data on our servers. The teacher's own browser is solely responsible for mapping opaque student numbers back to the names the teacher sees on screen.

Teachers can optionally photograph whiteboard work during a session. These photos are stored in the teacher's own Google Drive, in an app-specific folder, using the Google Drive API — they are never uploaded to or stored on TCT's own servers.

• openid, email, profile — basic sign-in via Google OAuth 2.0.
• drive.appdata, drive.file, documents — optional, only used if the teacher enables whiteboard photo storage.
• classroom.courses.readonly, classroom.rosters.readonly — optional, read-only access used only if the teacher enables roster import. TCT cannot modify anything in a teacher's Google Classroom.

Information is used solely to provide and improve the Service for the teacher's own instructional purposes: generating groups, tracking formative feedback over time, and organizing photos of student work. We do not use student information for advertising or marketing, we do not build persistent profiles of students beyond the participation data tied to their opaque ID within their own teacher's classroom context, and we do not sell student information.

Where a school or district has authorized a teacher to use TCT as part of instruction, TCT operates under the school's direction as a "school official" with a legitimate educational interest, consistent with FERPA's school official exception (34 CFR § 99.31(a)(1)). We use education record information only to provide the Service and do not redisclose it beyond what FERPA permits. Schools/districts remain the owner of student education records at all times.

TCT is a teacher tool, not a student-facing service. Students do not create accounts, sign in, or interact with TCT directly at any point — the teacher is the sole user, and all roster and score data is entered or imported by the teacher acting on the school's behalf. To the extent information about a child under 13 is processed, we rely on the school's consent as the child's agent, consistent with FTC COPPA guidance for the education context.

• Application data (opaque IDs, display names, scores, group assignments) is stored in Neon, a serverless Postgres provider, in an encrypted, access-controlled database.
• All data in transit is encrypted via HTTPS/TLS, including database connections.
• Authentication uses Google OAuth 2.0 (authorization-code flow); we never receive or store your Google password.
• Access to a teacher's data is limited to that teacher's own account. TCT does not currently share data across teachers or provide district-level visibility.

We do not sell, rent, or trade student information. We do not serve ads and do not use student information to build advertising profiles, consistent with state student data privacy laws modeled on California's SOPIPA.

We share information only with service providers necessary to operate TCT (Google, for authentication, Classroom roster import, and Drive photo storage; Neon, for database hosting; our payment processor, for billing), each acting under their own privacy and security commitments, and only to the extent necessary to provide the Service. We do not otherwise share student information with third parties, except as required by law or at the school/district's direction.

Teachers can delete their account and all associated server-side data at any time from the Account page. Individual student records can be archived or deleted directly from the roster page. Browser-cached roster data (IndexedDB, sessionStorage) can be cleared by the teacher at any time and clears automatically when the browser tab closes (for the access token) or cache is cleared. A school or district may also request deletion of data associated with a teacher's account by contacting thinking-classroom-tracker-8be333c0@ctomail.io.

Teachers can view, edit, and delete the information in their roster and rubric records directly within the app at any time. Schools and districts may contact us to request access to, correction of, or deletion of student information associated with their teachers' use of the Service, consistent with their obligations under FERPA.

We will provide notice of material changes to this Privacy Policy (such as via email or in-app notice) before they take effect.

Questions about this Privacy Policy, or requests related to student data, may be directed to: thinking-classroom-tracker-8be333c0@ctomail.io.