DRAFT — ATTORNEY REVIEW REQUIRED BEFORE PUBLISHING. This text was prepared as a plain-language starting point. It is not legal advice and has not been reviewed by a lawyer. Items marked “REVIEW” are decisions for Jonathan and an attorney.
Last updated: [DATE — set on publication]
SchoolGradesUp (“we”, “us”) is a learning website at schoolgradesup.com where students practise school subjects and parents see their progress. Many of our users are children, so we try to collect as little as possible and explain it plainly.
REVIEW: COPPA requires the notice to name every operator collecting children’s information, with a name, physical address, phone number and email. Fill in: [OPERATOR LEGAL NAME], [MAILING ADDRESS], [PHONE], privacy@schoolgradesup.com (confirm this mailbox exists).
| Information | Whose | Why |
|---|---|---|
| Name, email address, password (stored by Google Firebase Authentication — we never see the password), or Google account name and email if you use “Continue with Google” | Parents and students | To create and sign in to the account |
| Role (parent or student), avatar emoji, grade level | Parents and students | To show the right dashboard and lessons |
| Quiz scores, XP points, levels, badges, trophies, streaks, daily results, lesson activity dates | Students | To show progress to the student and their linked parent |
| Family invite code and parent–child link records | Parents and students | So a parent can see only their own child’s progress |
| Goals (“assignments”) a parent writes, including any reward or note text | Parents (shown to their child) | To set learning goals |
| A confirmation that a parent account holder said they are an adult (the birth year typed in is checked but not stored) | Parents | To keep children out of parent accounts |
| Settings saved only in your browser (for example reminder times and quiz attempt counts) | Anyone using the site | To make the site work on that device; not sent to us |
We do not ask for home addresses, phone numbers, photos, voice, location or school names, and there is no chat or messaging between users.
REVIEW: confirm no analytics are running (the Firebase config contains a measurement ID, but the analytics library is not loaded in the current code). Confirm what server logs Netlify and Google keep (IP addresses, browser type) and how to describe them.
We do not show ads, sell personal information, or share it for advertising. We do not use children’s information to build marketing profiles.
REVIEW: confirm each provider’s data-processing terms are accepted in their consoles, where data is stored, and whether Google Fonts should be self-hosted to avoid sending visitors’ IP addresses to Google.
Children’s accounts are meant to be set up and supervised by a parent or guardian. New student sign-ups are currently paused while we build a way for parents to create their child’s account and give consent first. Existing student accounts keep working.
A child’s account is only connected to a parent after the child’s account sends a request using the parent’s invite code and the parent approves it on their dashboard.
REVIEW (legal decisions, not made here): which verifiable parental consent method to use (FTC-approved options under 16 CFR 312.5) and how to handle the student accounts created before consent was collected (notify parents, collect consent, or delete); whether the amended COPPA Rule (compliance date April 22, 2026) requires a written information-security program and data-retention policy to be described here; whether state student-privacy or children’s-privacy laws apply (e.g. Texas SCOPE Act / HB 18, California, others).
A parent or guardian can:
REVIEW: identity checks before deletion or disclosure, response time to promise, and whether to offer a downloadable copy of a child’s data.
We keep account and learning information while the account is open. When an account is deleted we delete its profile, scores, progress, trophies, goals and link records.
REVIEW: set a written retention period (for example, delete inactive child accounts after N months) and backup deletion timing.
Data is stored in Google Firebase and protected by access rules so that users can only see their own data, and parents only their linked children’s. Connections use HTTPS. No system is perfectly secure; if we learn of a breach affecting your information we will tell you as the law requires.
REVIEW: breach-notification obligations and wording.
If we change this policy in a way that affects children’s information, we will tell parents and, where required, ask for consent again.
Email privacy@schoolgradesup.com (REVIEW: confirm mailbox) · [MAILING ADDRESS] · [PHONE]