Privacy, in plain English
Squishy Math School is a times-tables game for classrooms. It needs a tiny amount of information to work, and nothing more. Here is exactly what that is, why we keep it, and what we will never do with it.
What we will never do
- We never sell, rent, or share student data. Not with advertisers, not with "partners," not with anyone.
- We never show ads, and we never use student information to market anything to anyone.
- We never ask children for an email address, a phone number, a photo, a location, or a birthday.
- We never build profiles of students for any purpose other than showing their teacher how they are doing with multiplication.
- We never use third-party analytics, tracking pixels, or social-media buttons on any page a student sees.
What we collect, and why
Teachers create accounts for their students. Students never sign up on their own.
| Information | Who provides it | Why we need it |
|---|---|---|
| Student display name (we suggest a first name and last initial, like "Anna K") | The teacher | So the teacher's class list and the student's own screen say who is who. |
| Username and PIN | Generated by us, or chosen by the teacher | So a student can log in. PINs are stored scrambled (hashed) for login; the teacher can see the starting PIN in order to print login cards. |
| Game progress: which tables were practiced, right and wrong answers, stars, collected characters, coins, hats, and the like | Created by playing | So progress is saved between sessions and so the teacher can see which facts a student finds tricky. |
| Class membership and assignments | The teacher | So assignments reach the right students and results roll up to the right class. |
| Teacher name, username, and password (hashed) | The teacher or the school admin | So teachers can log in and manage their classes. |
| Roster spreadsheets uploaded by a teacher | The teacher | Read once to create accounts, then discarded. We keep only the name, username, and PIN columns we used. |
That's the whole list. A student's activity is stored with a timestamp so the teacher can see recent work and so we can spot problems, and that is the only "log" of a student we keep.
Cookies
One cookie, called sms.sid. It remembers that you are logged in so a student does not have to type a PIN every time on a shared iPad. It contains a random ID and nothing about you. It lasts up to a year, or until you log out, and it is never used for tracking.
The game also stores a copy of your progress on the device itself so it works offline; that copy stays on the device.
Who can see what
- Students see their own progress and, if their teacher turns it on, a class leaderboard showing first names, chosen avatars, and points.
- Teachers see everything about the students in their own classes, and nothing about other teachers' classes.
- The school admin (the person who set up your school's copy) can see all classes and users at that school, add or remove teachers, and log in as a user to help them.
- Us: the people who run the service can access the database to fix problems. We look only when we need to, and we do not browse student data.
Where it lives and how it's protected
Everything is stored on Render servers in Oregon, USA, in an encrypted database with automatic backups. Connections use HTTPS. Passwords and PINs are hashed with bcrypt. The service is written to keep each school's data separate.
Two outside services are involved in showing pages, and neither receives student data: Google Fonts delivers the typefaces, and cdnjs delivers a small spreadsheet-reading library on the teacher dashboard only. Your browser requests those files directly, which tells those services your IP address, the same as loading any website.
Deleting data
- A teacher can remove a student or delete a class at any time. Removing a student deletes their account, progress, and results immediately.
- A school admin can delete any user.
- If your school stops using Squishy Math School, tell us and we will delete the school's data within 30 days. Backups age out on their own within 30 days after that.
- Parents and guardians can ask their child's teacher or school to see or delete their child's information at any time. Schools can also email us directly.
Children, schools, and the law
Squishy Math School is built for use in school, under the school's authority. Schools provide consent for their students to use it, as they do for other classroom tools, and the information we collect is used only to provide the service to the school. We do not collect more than what is needed for that, and we do not use it for anything else. This is how the U.S. children's privacy law (COPPA) allows schools to consent on behalf of parents, and it is consistent with how student records are treated under FERPA. If your district needs a signed data-privacy agreement, ask and we will work through it with you.
If something goes wrong
If we ever discover a breach that affects student data, we will tell the affected schools promptly, explain what happened in plain language, and say what we are doing about it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and the date below, and we will tell school admins by email before the change takes effect. We will not quietly weaken any promise on this page.
Questions
Email hello@squishymathschool.com. A real person reads it.