Privacy Policy

1. About This Policy

Badgie Academy provides a K–12 cybersecurity, AI literacy, and technology career readiness curriculum. This Privacy Policy describes how we handle information in connection with the Badgie Academy website and learning platform.

This policy describes what the software does. It does not state a legal conclusion. Every statement below is written to match the behavior of the deployed system, and is checked against the code and the database schema rather than against an intention. Where a practice is imperfect or incomplete, it is described here rather than omitted. This policy has not been reviewed by legal counsel, and Badgie Academy does not certify its own compliance with any statute — that assessment belongs to your district, your counsel, and your own review.

This policy reflects the current pilot-phase architecture. If data practices change, this policy will be updated with a new date. Schools, districts, and families are encouraged to review it before adopting the platform.

2. What Is Never Collected From Students

Students do not create accounts and do not sign in. The following is never collected from a student, by any part of the platform:

• Student names, ages, grades, or identification numbers
• Student email addresses, phone numbers, or other contact information
• Student passwords — no student password field exists anywhere in the system
• Location data
• Behavioral tracking, advertising profiles, or cross-site analytics — the platform loads no analytics, advertising, or tracking scripts of any kind

Student IP addresses are not stored. When a student joins a class or submits a lesson-check answer, the platform needs to limit how fast requests can arrive. To do that it stores a one-way scrambled value derived from the request's IP address together with a secret key held outside the database — not the address itself. The original address cannot be recovered from what is stored, and the row is deleted 30 days after it is created. See Section 10 for how that deletion runs.

The same method covers the other values used for rate limiting. When a student saves a build card, the row is keyed to a one-way scrambled form of that student's record identifier, derived with the same secret key — never the identifier itself. These scrambled values are stable: the same input always produces the same value, which is exactly what lets the platform count repeated requests from one source. So the stored value works as a label for that source while the row exists, even though the original cannot be recovered from it. It is used for nothing but rate limiting, and it is deleted on the same 30-day schedule.

This list is about students. It is not a statement about teachers or parents, who do hold accounts with passwords — see Section 4.

3. What Is Stored About a Student

Learning-Progress Data

To support the progress page, achievement center, and printable certificates, Badgie Academy stores: which lessons a learner has completed, whether each lesson-check answer was correct, points (XP) earned, and badges or certificates unlocked. This is linked only to a randomly generated code, which is saved in the student's browser — never to a student's name, email address, or other identifying information.

If a student joins a class with a teacher's join code, a nickname and an avatar are stored alongside that progress. The nickname is not free text. The platform generates it from a fixed list in the form "Brave Otter 27", and the server rejects anything that is not one of those generated combinations, so a student cannot type a real name into it even deliberately.

What a Teacher Can See

A teacher signed in to their own account can see, for each student in their own classrooms: the nickname, the avatar, how many lessons that student has completed, total points, when they were last active, and counts of skills and evidence. This is per-student, not only an aggregate class total. A teacher cannot see which answer a student chose on any individual question. A teacher cannot see students in another teacher's classrooms.

Writing Students Submit

Some activities ask a student to write about what they built — a title, a description, and a reflection. These are free-text boxes, and what a student types is stored as typed and is visible to their teacher. Nothing filters or removes personal information from them. Students are taught throughout the curriculum not to share personal information online, and the prompts do not ask for any, but the platform cannot prevent a child from typing their own name into a reflection. Teachers and parents supervising this activity should know that.

4. Teacher and Parent Accounts

What Is Stored

• Teachers: email address, a scrambled (hashed) form of the password, a display name, and optionally a school name.
• Parents: email address, a scrambled (hashed) form of the password, and a display name. If a parent creates a household to organize their learners, the household name they type is stored.
• Classroom names a teacher types are stored as typed.
• Sign-in sessions: a scrambled form of the session token with an expiry time. The token itself is never stored in the database, and the browser cookie that carries it cannot be read by page scripts.

Passwords are never stored in readable form. They are put through PBKDF2-HMAC-SHA256, a deliberately slow one-way transformation, and only the result is kept. The hosting platform caps a single PBKDF2 call at 100,000 iterations, so the transformation is applied in six chained passes of 100,000 — 600,000 iterations of sequential work for each password guess an attacker would have to make. The 8-character minimum and the rate limiting described in Section 11 apply in addition.

Rate limiting on sign-in also writes a row keyed to a one-way scrambled form of the email address, derived with a secret key held outside the database — never the address itself — and the same is done for the account identifier used to limit build-card verification. As with the student values described in Section 2, these are stable: one address always produces one value, which is what makes the limit count correctly, so the row acts as a label for that account until it is deleted 30 days after it is created.

Why It Is Collected

To let a teacher return to their own classrooms and roster, and to let a parent return to their own learners' records. There is no other use. Account information is not sold, shared, or used for advertising or marketing.

Payment Information

No payment information is stored, and no payment processor is connected to this platform. Where access is granted by a license key, only the key, who redeemed it, and when are recorded.

Account Recovery

There is currently no password-reset function. If a teacher or parent forgets their password, there is no self-service way to recover the account — email Badgie Academy and it will be handled by hand. This is a real gap and is stated here rather than left to be discovered.

5. When a Child's Record Becomes Re-identifiable

A student record on its own is a random code and a generated nickname. Nobody, including Badgie Academy, can connect it to a specific child from the database alone.

That changes when a parent links their account to a learner. A parent account holds a real email address, and the link between that account and a child's record is stored. From that point on, that child's learning history — lessons completed, points, certificates, and any writing they submitted — is reachable through the parent's account, and the parent's email address is a working way to find it. This is how the parent features are meant to work, and it is also, honestly, a re-identification path. Both things are true and both are stated here.

A student who joins only through a classroom code, with no parent account linked, remains unlinked to any real-world identity.

6. Student Safety Design

Badgie Academy does not ask children under 13 for names, emails, or other identifying details anywhere in the student experience, and no student account exists to create.

Lessons are designed for supervised classroom or home use under teacher and parent oversight. Student safety guidance in the curriculum directs students to speak with trusted adults — teachers, parents, or school counselors — and does not ask students to submit personal information through the platform. The one place a student can type freely is the build reflection described in Section 3, which is stored as typed.

7. Infrastructure and Third-Party Services

Cloudflare

Badgie Academy is hosted on Cloudflare's global content delivery network. Cloudflare may process standard web request logs — including IP addresses, browser type, and requested URLs — as part of routine hosting and security monitoring. These logs belong to Cloudflare and are governed by Cloudflare's Privacy Policy. Badgie Academy does not use them for profiling or advertising.

Google Fonts

Badgie Academy loads typography through Google Fonts, so a student's browser makes a request to Google when a page loads. Google may log that request. Nothing identifying a student is included in it. Schools that would prefer no connection to Google at all should contact us — self-hosting the fonts is possible and has not yet been done.

Read-Aloud

Read-aloud uses the speech function built into the browser or device. On some devices and browsers, that function sends the text being read to the browser or operating-system vendor to generate the audio. The text sent is lesson text; no student information is included. Read-aloud can be turned off with the checkbox on the lesson and check screens.

Analytics and Advertising

There are none. The platform loads no analytics service, no advertising network, no social-media pixel, and no third-party tracking script.

Voluntary Email Contact

When a teacher, administrator, or parent emails Badgie Academy, what they write is used only to answer them. It is not shared, sold, or used for marketing.

8. COPPA and FERPA

Badgie Academy does not certify its own compliance with either law. Compliance is a legal determination that depends on your district's circumstances, and it is not one a vendor can make on its own behalf. What follows is what the software does, so your counsel can make that determination.

COPPA

The Children's Online Privacy Protection Act restricts the online collection of personal information from children under 13 without verifiable parental consent. What the platform does: no student account exists, no student email or password field exists in any part of the system, student nicknames come from a fixed list enforced by the server, and student IP addresses are stored only as the one-way scrambled rate-limit value described in Section 2. Parent accounts, which do hold an adult email address and password, are created by adults.

Badgie Academy has not obtained a legal opinion on COPPA applicability and has not implemented a verifiable-parental-consent workflow.

FERPA

The Family Educational Rights and Privacy Act protects the privacy of student education records held by schools. What the platform does: Badgie Academy does not receive student records from schools, does not import rosters, and stores no student name or identifier supplied by a school. Progress data originates in the platform itself and is keyed to a random code.

Badgie Academy has not entered into a FERPA school-official agreement with any district and has not obtained a legal opinion on FERPA applicability. Districts that require a data agreement, a data processing addendum, or state-specific terms should contact us before deploying.

State Student-Privacy Laws

State statutes such as SOPIPA, NY Education Law 2-d, and their equivalents impose their own requirements. Badgie Academy has not been assessed against them.

9. School and Teacher Use

Teacher accounts require a sign-in. A teacher creates an account with an email address and password, and the roster, progress, and classroom-management pages return nothing without a valid session.

The teacher preview page itself does not require a sign-in, but its answer key does. Anyone who has the preview URL can open it and see the same lesson a student sees. The answer key and the facilitation notes are fetched separately and are served only to a signed-in teacher; without a session the page renders as an ordinary read-only lesson with no answers on it. Schools should still treat preview URLs as educator material.

Schools may collect their own separate data about student learning — paper records, classroom observations, school information systems — in connection with their use of Badgie Academy. Any such data collected independently by schools is governed by the school's own privacy policies, not this policy.

10. Access, Deletion, and Retention

How to Make a Request

A parent can delete their own account from the Parent Portal. The control is on the Parent Portal page and requires typing DELETE to confirm. Deleting the account also permanently deletes every learner set up at home who is not enrolled in a school classroom, along with that learner's progress, points, badges, certificates, and submitted writing. Archived learners are deleted as well. Archiving a learner hides them from the parent's active list without removing them, so a deletion can remove more learners than the active count on the My Learners page shows.

That is the only self-service deletion, and we are not going to overstate it. A parent cannot delete a learner's school classroom record, and no teacher or school account can be deleted from a page on this site. Those requests are still handled by a person, at the address above, within 30 days.

What Can Actually Be Deleted

• A single student's record. A teacher can delete one student from their roster, which removes that student's progress, points, badges, certificates, and submitted writing.
• A whole classroom. Deleting a classroom removes the classroom and every student record that belongs only to it.
• A parent's own account. A parent can delete their account, which removes the account, its sign-in sessions, its households, and the records of any learners that exist only under that account — archived learners included.
• A learner shared with a school is not removed by a parent's deletion. If a child is also enrolled in a school classroom, the school's copy of that record survives — the school is a separate holder of it, and one adult should not be able to erase another's roster.

Clearing a browser's site data discards the random code stored in that browser. That does not delete anything from Badgie Academy's database; it only makes that browser unable to reach the record again.

What Is Retained After Deletion, and Why

When a parent account is deleted, one thing is deliberately kept: the record that a license key was redeemed. The row stays, but the account it pointed to is replaced with a one-way scrambled value that identifies no one and cannot be turned back into an account. It is kept because that record is the only thing preventing a single-use key from being redeemed again by closing and reopening an account. It contains no name, no email address, and no way to reach a person. We state it because retaining anything after a deletion request should be declared, not discovered.

How Long Things Are Kept

• Student progress: until it is deleted by a request or by a teacher. There is no automatic expiry today.
• Teacher and parent accounts: until deleted by request or by the account holder.
• Sign-in sessions: they expire on their own; teacher sessions last 7 days.
• Rate-limit rows (the scrambled IP value in Section 2): deleted 30 days after they are written. The deletion is not sampled or occasional — it runs on every rate-limited request, so it happens reliably whenever the site is in use. If the platform received no traffic at all for a long period, a row would sit until the next request arrived.
• Redemption records: kept indefinitely, in the de-identified form described above.

11. Data Security

All Badgie Academy pages are served over HTTPS via Cloudflare, so connections are encrypted in transit. Security headers — including a content security policy, frame blocking, and content-type protection — are applied to every response.

Adult passwords are stored only as a slow one-way hash (PBKDF2-HMAC-SHA256, applied in six chained passes of 100,000 iterations — 600,000 iterations of work for each password guess, since the hosting platform caps a single call at 100,000). Session cookies are marked HttpOnly, Secure, and SameSite=Strict, so page scripts cannot read them and other sites cannot send them. Database queries use parameter binding rather than assembled strings. Sign-in, class-join, and answer-submission endpoints are rate-limited.

Two limits worth stating plainly. Pages still permit inline scripts and styles, which is weaker than the platform's own target and is deferred rather than fixed. And Badgie Academy has not had an independent third-party security audit or penetration test — the security work described here is internal.

12. What the Pilot Is

Known gaps as of this policy's date, stated so nobody has to find them the hard way:

• No password reset exists for teacher or parent accounts.
• Anyone can create a parent account on the public site — there is no invitation gate.
• Deletion is handled by request rather than by a self-service control.
• Student progress has no automatic expiry.
• No independent security audit or accessibility certification has been performed.
• Written reflections are stored as typed and are not filtered for personal information.

If any of these matter to your district's review, say so — direct contact with the person who builds this platform is available at BadgieIQ@proton.me.

13. Changes to This Policy

Badgie Academy will update this policy when data practices change. Schools and pilot partners will be notified of material changes by email. The most recent version is always available at this URL.

14. Contact