Privacy and data practices

What this site stores, what it sends away, who can see it, and how it is deleted. Written from the site's code, not from a template.

Qué guarda este sitio, qué envía fuera, quién puede verlo y cómo se borra. Está escrito a partir del código del sitio, no de una plantilla.

For students and families / Para estudiantes y familias

You do not need an account. There are no student passwords and no student email addresses. Your work stays in your own browser unless a tool says otherwise. No necesitas una cuenta. No hay contraseñas ni correos de estudiantes. Tu trabajo se queda en tu propio navegador, a menos que una herramienta diga otra cosa.
Use your first name and last initial. Some tools ask for a name so your work has a label. Please type a first name and the first letter of your last name, like "Jordan N." Do not type a full last name, an address, a phone number or an email address into any box. Usa tu nombre y la inicial de tu apellido. Algunas herramientas piden un nombre para poner etiqueta a tu trabajo. Escribe tu nombre y la primera letra de tu apellido, por ejemplo "Jordan N." No escribas el apellido completo, una dirección, un teléfono ni un correo en ninguna casilla.
No ads, and no cookies on student pages. We checked 18 student pages in a test browser and the site set zero cookies. There are no ad networks and no tracking companies. The site counts how many times a page is opened, but those counts have no name, and the count is skipped when your browser sends "Do Not Track" or "Global Privacy Control." Cloudflare, the company that hosts the site, also counts page visits and page speed for the site's operator (Cloudflare Web Analytics). It sets no cookies and does not know who you are. Sin anuncios y sin cookies en las páginas de estudiantes. Revisamos 18 páginas de estudiantes en un navegador de prueba y el sitio no puso ninguna cookie. No hay redes de anuncios ni empresas de seguimiento. El sitio cuenta cuántas veces se abre una página, pero esos conteos no tienen nombre, y no se cuenta si tu navegador envía "No rastrear" o "Control Global de Privacidad". Cloudflare, la empresa que aloja el sitio, también cuenta las visitas y la velocidad de las páginas para el operador del sitio (Cloudflare Web Analytics). No pone cookies y no sabe quién eres.
Teachers see class progress. After a student types a name, some lessons send the name, class period, and which questions were tried to the teacher's records. Only a teacher with the teacher key can read those records. Los maestros ven el progreso de la clase. Cuando un estudiante escribe un nombre, algunas lecciones envían el nombre, la clase y las preguntas intentadas a los registros del maestro. Solo un maestro con la clave puede leerlos.
AI helper buttons send what you type to an AI company. When you press a tutor, hint, translate or "check my work" button, the words you wrote, or a photo of your paper, go to an AI service so it can answer. This site does not save them. The AI company has its own rules, which this site cannot show you. Do not put your full name or private information in a message or in a photo. Los botones de ayuda con IA envían lo que escribes a una empresa de IA. Cuando usas un botón de tutor, pista, traducir o "revisa mi trabajo", las palabras que escribiste, o una foto de tu papel, van a un servicio de IA para que pueda responder. Este sitio no las guarda. La empresa de IA tiene sus propias reglas, que este sitio no puede mostrarte. No pongas tu nombre completo ni información privada en un mensaje ni en una foto.
Microphone recordings stay on your device. The recording tools keep your voice in the browser so you can play it back. They do not upload it. Some browsers turn speech into text using the browser company's own service. That is the browser's choice, not this site's. Las grabaciones del micrófono se quedan en tu dispositivo. Las herramientas de grabación guardan tu voz en el navegador para que puedas escucharla. No la suben. Algunos navegadores convierten la voz en texto con el servicio de la empresa del navegador. Eso lo decide el navegador, no este sitio.
Family homework is optional and ungraded. The link you can copy from a homework page carries only the route you picked and the language. It does not carry answers, photos or voice notes. A photo or voice note you add to the family reflection is kept only on that device. La tarea familiar es opcional y sin calificación. El enlace que puedes copiar de una página de tarea lleva solo la ruta que elegiste y el idioma. No lleva respuestas, fotos ni notas de voz. Una foto o nota de voz que agregues a la reflexión familiar se guarda solo en ese dispositivo.
How to delete. On your device: use the buttons on the curriculum data page, or clear this site's data in your browser settings (that removes everything, including names). On the server: ask your teacher, who passes the request to the site's operator. Today the operator does this by hand. Cómo borrar. En tu dispositivo: usa los botones de la página de datos del currículo, o borra los datos de este sitio en la configuración del navegador (así se borra todo, incluidos los nombres). En el servidor: pídeselo a tu maestro, que envía la solicitud al operador del sitio. Hoy el operador lo hace a mano.

For district reviewers

Source for every row: docs/privacy/data-map.md (file and line citations, the test method, and the full list of findings). "Measured" means observed in a headless browser on 2026-10-16; "read" means taken from the cited code; the code was at branch feat/award-gold-wave (from origin/main aa873132f0). The site is hosted on Cloudflare Pages; data is kept in Cloudflare D1. Student-facing pages are open and anonymous; teacher pages and APIs need a shared teacher password or key.

Resumen en español para revisores: las tablas siguientes están en inglés. Cubren los datos guardados en el navegador, los servicios del servidor, las llamadas a servicios de IA, los pedidos a terceros, la retención y lo que todavía no está hecho.

Data stored in the browser

Browser storage by purpose
Purpose	Examples of keys	Holds	Sent to a server?
Student label	`nt_student`, `edupulse_student_name`, `nsr:identity`	Typed name and class period	Yes, by lesson telemetry and (see gaps) the hub progress sync
Saved work	`nsr:rec:`, `rma_`, `hw_state_lesson_*`	Answers and progress	No. The Save/Resume engine defaults to local storage only.
Device id	`nt_anon_id`	Random id such as `anon-1a2b3c4d`	Only as the result label of one pre-test page
Preferences	`nt-lang`, `nt-calm-mode`, `neft-theme`	Language, display and accessibility choices	No
Skill signal	`nt-signal:v1`	Standard codes and misconception tags, no names	No (read: the file says it never uses the network)
Family homework	`hw_route_`, `hw_lang_mode`, `hw_parent_signoff_`	Route, language, optional partner name, note, photo, voice memo	No

Cookies: none on student pages (measured on 18 pages). A teacher sign-in receipt cookie exists on teacher pages only.

Data sent to the site's server

What each server endpoint receives and stores
What	Fields	Who can read it	Kept for
Page-view counters	Path, dwell time, device type (desktop, tablet, mobile). No name, id or IP.	Teacher key	No limit set (daily counters)
Lesson telemetry	Lesson, standard, student name and section when known, events	Teacher key	No limit set
Game scores	Game, standard, points, counts, optional save code. No name column.	Teacher key	No limit set
Class roster	"First L." and section, set by the teacher	Anyone with the class join code (rate-limited); teacher edits	Until the teacher deletes it
Support tools list	Section and initials map to generic tool names such as "calculator"	Teacher key for the full record; public lookup returns tool names only	Until the teacher deletes it
Class Boss, Class Pulse	Counts per misconception tag; device hashed to one of 64 buckets; a minimum-cohort floor hides small groups	Public aggregate	Weekly counters
Small-group rooms	Room code, seat number, short answers. No names.	Students in the room	4 hours
Showcase	Caption, explanation, standard, consent record	Public only after a teacher approves	Until a teacher removes it
Family conference requests	Guardian name, student first name, email, note	Teacher; also emailed to the teacher's school address through Cloudflare's email service	No limit set
Rate-limit records	IP address in a 5-minute bucket for failed save-code and support lookups	Server only	Rolling window; old buckets are deleted during later lookups

Text and images sent to AI services

AI calls: what is sent and to whom
Feature	Sent	Name added by the site?	Service	Stored by this site?
Tutor, hints, translate	Problem text and student work (each up to 2,000 characters), up to 8 earlier messages	No	Anthropic (Claude Haiku)	No
Photo coach, handwriting reader	A photo of handwritten work, up to about 3 MB	No (a name written on the paper would be in the photo)	Anthropic	No
Reasoning check	A prompt and the student's written reasoning	No	Anthropic, or Cloudflare Workers AI as a fallback	No
Teach the Machine	The student's explanation turns	No	Anthropic, then Cloudflare Workers AI, then a scripted offline character	No
Study pack	Notes the student pastes, and a question	No	Anthropic	No

Whether an AI key is switched on in production, and Anthropic's and Cloudflare's retention terms, cannot be checked from the code and are not stated here. When no key is set, the tutor answers "offline" and the lesson continues.

Requests to other websites

The repository's script ledger is pinned at zero third-party scripts and its check passes. That check only looks at script tags. A wider scan found requests the ledger cannot see:

Google Fonts on the Monster Math Academy page, the Family Jeopardy page and two Lesson 3-2 simulator pages (measured on the first). Google receives the visitor's IP address and the page address.
A QR image from api.qrserver.com on one teacher projector tool, and optional CoinGecko and World Bank data requests the student starts in the correlation activity.

What the code does for each privacy principle

Principles: supported by the code and not yet done
Principle	The code does	Not yet done
Collect little	No student accounts, passwords or email. Roster uses "First L." Counters carry no person key. Game scores have no name column.	The Save/Resume panel still asks for "first and last name."
Tell people	This page, the privacy summary and the curriculum data page (English).	AI buttons show no notice at the moment of sending. Browser speech recognition is not described in the lessons.
Limit who sees it	Teacher data needs the teacher key or password. Aggregates hide small groups. Family weekly reports need a save code. The showcase needs teacher approval and fails to anonymous.	One shared key for all teacher tools, accepted in the web address. Public lookups by section and initials.
Protect children	No ads, no cookies on student pages, Do Not Track and Global Privacy Control respected for counters, microphone audio stays local.	No age or parent-consent step in the code.
Delete	Rooms and shared points expire on their own. Teachers can delete a roster. Students can export their own progress file and clear curriculum data on their device.	No retention schedule or deletion script for progress, telemetry, scores and saves. Device clearing on the curriculum data page is partial.
Outside vendors	Cloudflare hosts everything. AI calls go to Anthropic (and Cloudflare Workers AI as fallback).	No vendor agreements are kept with the code.

Known gaps we are working on

These come from reading and testing the code on 2026-10-16. They describe today's behaviour and will change as each is fixed.

The curriculum hub sends a typed name and section to a separate service run by the same operator (neft-school-hub-api) when a student marks lessons complete.
Some name boxes invite a full name. The intended pattern is "First L."
One pre-test page can send a typed name as its result label.
AI features have no on-screen reminder not to type private details, and the endpoint has no sign-in.
Google Fonts requests on four pages.
No automatic deletion for server records, and device clearing is incomplete.
Family conference requests keep a parent email address with no stated retention.

What we do not claim

This page does not say the site complies with COPPA, FERPA, the Maryland Student Data Privacy Act or any other law. It lists behaviour so a school's own reviewers can judge it.
No signed data privacy agreement, vendor questionnaire, independent audit or penetration test is part of this repository.
Production settings, secrets and stored rows were not inspected for this page. Statements about them are marked as not verifiable.

Questions or requests to see or delete a student's saved work: ask your teacher, who passes them to the site's operator. Last checked against the code: October 16, 2026.

Preguntas o solicitudes para ver o borrar el trabajo guardado de un estudiante: pregunta a tu maestro, que las pasa al operador del sitio. Última revisión con el código: 16 de octubre de 2026.