Privacy Policy

1. Introduction

ClassQuest™ ("we," "our," or "us") is committed to protecting the privacy and security of student data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our classroom gamification platform.

This policy applies to teachers, students, parents, and administrators using ClassQuest.

2. Information We Collect

2.1 Teacher Information

• Name and email address
• School name and grade level (optional)
• Payment information (processed securely by Stripe)
• Classroom configuration and settings

2.2 Student Information (Educational Records under FERPA)

• Display Name: Chosen by student or teacher (may be pseudonym)
• Authentication: Username and encrypted password (if using student accounts)
• Game Data: XP, level, HP, gold, team assignment, role selection
• Activity Data: Ability usage, challenge completions, boss battle progress
• Behavioral Data: Rewards and consequences recorded by teacher

Important: We do NOT collect:

• Student email addresses (unless voluntarily provided for account creation)
• Social security numbers or government IDs
• Precise geolocation data
• Photos or videos of students
• Academic grades or test scores (unless teacher manually enters as XP)

3. How We Use Information

We use collected information solely for legitimate educational purposes:

• Provide and improve the ClassQuest platform
• Enable classroom gamification and behavior management
• Allow teachers to track student progress and engagement
• Process payments for subscription services
• Provide customer support
• Comply with legal obligations

We do NOT use student data for: Advertising, marketing to students, building student profiles for non-educational purposes, or selling student information.

4. FERPA Rights and Protections

4.1 School Official Status

ClassQuest acts as a "School Official" under FERPA 34 CFR § 99.31(a)(1). We have legitimate educational interests in student data and use it only to perform institutional services and functions for which the school would otherwise use its own employees.

4.2 Parent/Student Rights

Under FERPA, parents and eligible students (18+ or in postsecondary education) have the right to:

• Inspect and Review: Request access to student educational records
• Request Amendment: Ask to correct inaccurate or misleading information
• Consent to Disclosure: Control disclosure of personally identifiable information
• File Complaint: Submit complaints to the U.S. Department of Education

To exercise these rights, contact your school administrator or email us at privacy@classquest.org

4.3 Data Access and Deletion

Parents and eligible students may request:

• Export of all student data in machine-readable format
• Correction of inaccurate information (via teacher)
• Deletion of student account and data (within 30 days of request)

5. Information Sharing and Disclosure

5.1 Who Can Access Student Data

• Teachers: Full access to their own classroom data
• Students: Access to their own profile and stats
• School Administrators: With proper authorization from the school
• Parents: Upon verification and request through the school

5.2 Third-Party Service Providers

We share data only with service providers who:

• Are contractually obligated to protect student data
• Use data only to provide services to ClassQuest
• Comply with FERPA and applicable privacy laws

Current service providers:

• Stripe: Payment processing (teacher subscriptions only)
• Cloud Hosting: Secure data storage and platform infrastructure

5.3 We Do NOT Sell or Rent Student Data

ClassQuest will never sell, rent, or trade student information to third parties for marketing or advertising purposes. Student data is used exclusively for educational purposes.

6. Data Security

We implement industry-standard security measures to protect student data:

• Encryption: All data transmitted via HTTPS/TLS encryption
• Password Security: Passwords hashed using Argon2 (military-grade)
• Access Controls: Role-based permissions and authentication
• Secure Infrastructure: Enterprise-grade cloud hosting with redundancy
• Regular Audits: Ongoing security assessments and updates
• Data Backups: Regular encrypted backups for disaster recovery

While we strive to protect all data, no system is 100% secure. We will notify affected users of any data breach within 72 hours of discovery.

7. Data Retention and Deletion

• Active Accounts: Data retained while account is active
• Inactive Accounts: Data deleted after 2 years of inactivity
• Upon Request: Student data deleted within 30 days of verified deletion request
• Teacher Account Closure: All associated classroom data deleted within 30 days
• Backups: Deleted data purged from backups within 90 days

8. Children's Privacy (COPPA Compliance)

ClassQuest complies with the Children's Online Privacy Protection Act (COPPA). We collect minimal personal information from children under 13, and only with school authorization acting in loco parentis (in place of parents) for educational purposes.

Parents may review their child's information, request deletion, or refuse further collection by contacting their child's teacher or school.

9. International Users

ClassQuest is operated in the United States. If you are located outside the U.S., please be aware that information we collect will be transferred to and processed in the United States. By using ClassQuest, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered teachers at least 30 days before taking effect. Continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy questions, data access requests, or FERPA-related inquiries: