Privacy Policy

1. Data Minimization Principle (What We Collect & Why)

We strictly practice data minimization and only collect the minimum information required to deliver classroom instruction, formative assessments, and progress tracking:

• Teacher Accounts: Full name, school or work email address, encrypted password or Google OAuth identifier, and created curriculum resources (lesson plans, quizzes, class periods).
• Student Accounts: Student name (or first name + last initial), school email address, 4-digit classroom PIN or Google OAuth identifier, assigned class period, quiz responses, and teacher-assigned IEP/504/ESL instructional accommodations.
• Optional Parent Contact: Parent/guardian email address (only when optionally provided by the teacher, student, or parent to receive progress summaries, with one-click unsubscribe in every email).

What We Never Collect: We do not collect Social Security numbers, biometric identifiers, precise geolocation, home street addresses, or behavioral advertising profiles.

2. Student Privacy, FERPA & COPPA Parental / School Consent

Quizzard operates as a School Official under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g) and complies with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506):

• School & Parental Consent: Students enroll using a teacher-issued classroom invitation code (`Join Class`). For students under 13 (or under 18 where applicable), either a parent/guardian provides consent or the school/teacher provides school-official authorization solely for educational use in the classroom.
• No Sale of Student Data: We never sell, rent, or trade student personal information, nor do we use student data for targeted advertising.
• AI Safety Guarantee: Prompts sent to our AI curriculum engine (Google Gemini API) to grade responses or generate NCSCOS lesson plans are processed strictly to serve the classroom request and are not used to train public consumer profiles on students.

3. Third-Party SDK & Subprocessor Audit

We regularly audit our third-party SDKs and infrastructure providers to ensure strict security and zero unauthorized tracking:

• Google Cloud / Firebase (Firestore & Authentication): Encrypted database storage and authentication infrastructure hosted in the United States.
• Google Gemini API (`@google/genai`): Generates standards-aligned lesson plans, DOK-leveled test items, and instant formative feedback.
• NextAuth.js & Google OAuth 2.0: Provides secure, encrypted session authentication without exposing user passwords.
• Self-Hosted Open Font License (OFL) Fonts (`next/font`): Fonts (`Inter` and `Outfit`) are bundled at build time so student browsers do not leak IP addresses to external font CDNs.

4. Data Retention & Your Right to Data Deletion

Teachers, parents/guardians, and students may inspect, export, or request permanent deletion of their account and classroom data at any time. Submit a request directly through our Data Deletion Request Portal or by emailing support@quizzard.app. Verified deletion requests are completed within 7 business days (and no later than 30 days).

5. Business & Privacy Contact Details

For any privacy, FERPA/COPPA, or security inquiries, contact the Quizzard Privacy & Compliance Officer at support@quizzard.app.