Your Data, Our Promise

All data is encrypted both in transit (TLS 1.3) and at rest (AES-256). Access is controlled through role-based permissions, and we follow FERPA guidelines for educational data protection. Only you and authorized personnel (like your teacher, if enrolled in a class) can view your individual progress.

Account data is retained while your account is active and for 30 days after deletion request. Payment records are kept per legal requirements (typically 7 years).

Access follows the principle of least privilege. Only authorized team members with a legitimate need can access user data. Teachers can see progress for their enrolled students only.

We will notify affected users within 72 hours as required by law. Notification will include what happened, what data was affected, steps we're taking to address it, and actions you should take. We maintain incident response procedures and conduct regular security reviews.