Prodigies PK-5 (pk5.prodigies.com) is a teacher-facing curriculum portal. Teachers hold the accounts; student activities work without sign-in and collect a first name at most. This page is written to be copied straight into your vetting document; print it if that's easier.
| Student accounts | None today Teachers are the only account holders. Every current student activity works without sign-in, a profile, or a password. If we introduce optional student sign-in for future features (e.g. progress tracking or gamification), it will follow the same data-minimization and school-consent model described here, and this page and our privacy policy will be updated before launch, schools get notice first. |
|---|---|
| Rostering / SIS sync | No roster access We never upload, sync, request, or store student rosters, and there is no SIS integration. Teachers can post assignments to their own Google Classroom: that connection runs through the teacher's Google account, we only list the teacher's active courses and create the coursework item, and we never call roster endpoints or store any Classroom student data on our servers. |
| Assignments & scores | Teachers can assign games and activities. A student may choose to send a finished score to their teacher's class: we store first name + game + score, scoped to the class code, teacher-owned under the same RLS isolation and retention windows as compositions. The class leaderboard shows a score only if the teacher published it (or opted the class into a live leaderboard at creation), and is reachable only with the class code. Nothing is collected unless the student submits. |
| Student PII collected | One optional activity (Bell Composer) lets a student submit work to their teacher with a first name or nickname (40-char max) and an optional title. That is the complete list. No emails, last names, birthdates, photos, location, or behavioral profiles. |
| Who can see student work | Only the class's teacher, unless the teacher publishes it to a class gallery reachable only with the class code. Access is enforced by database row-level security and routinely verified against the live database. |
| Third parties on student pages | None Student-facing pages load resources only from our domain and our database provider, no third-party fonts, scripts, pixels, or ad tech. |
| Retention | Teachers can delete any submission or class at any time. Unpublished student submissions auto-delete after 180 days, published after 365 days. |
| COPPA | School-consent model: before creating a student-facing assignment, the teacher attests the school/district holds any required parental consent, with our privacy policy as direct notice. Parents may review, delete, and refuse further collection, through the school or directly. |
|---|---|
| FERPA | Where submissions are education records, we operate as a school official under the school's direction and control: service-provision use only, no re-disclosure, deletion or return on request. |
| Data privacy agreement | Available We sign DPAs on request, including for state requirements (IL SOPPA, NY Ed Law §2-d, CT). Email hello@prodigies.com. |
| Advertising / data sales | Never No advertising on the portal, no targeted advertising, no sale of any user data, no profiling, and no use of student data to train AI models. |
| Breach notification | Affected schools are notified without unreasonable delay so they can meet their own obligations. |
| Teacher authentication | Email/password or Sign in with Google (OAuth). Teachers are the only users with credentials. |
|---|---|
| Hosting & data location | Application on Vercel; database and auth on Supabase (Postgres), hosted in the United States. |
| Encryption | TLS in transit across the site (HSTS enforced); encrypted at rest by our database provider. |
| Access control | Postgres row-level security on every table: each teacher reads only their own classes; anonymous visitors read nothing. Verified with an automated test suite against production. |
| Security headers | Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy are enforced site-wide, inspect them live with any header checker. |
| AI features | A curriculum assistant for teachers only (students have no access), proxied through our server to Anthropic. Teachers are instructed not to enter student PII. Not used to train models. |
| Subprocessors | Supabase (database/auth), Vercel (hosting), Anthropic (teacher AI assistant), Vimeo (video on teacher pages), Google (fonts on teacher pages; Classroom only when a teacher connects their own Google account). |
Questions beyond this page, pen-test summaries, architecture details, or your district's own questionnaire, go to hello@prodigies.com; completed questionnaires come back same week.