| Student accounts | None Teachers are the only account holders. A student has no email, no password and no profile. A student on a teacher's roster gets a 4-digit student number, typed with the class code to reach the work their teacher assigned; the class code alone reveals no names. For a class too young to type a number, the teacher may instead let students tap their name, shown as first name and last initial. Every other student activity works without any sign-in at all. |
|---|
| Rostering / SIS sync | No SIS sync Teachers may type a class roster themselves - each student's first name and, optionally, last name - so they can assign lessons and videos to particular students. We store that roster, teacher-owned under row-level security like everything else. We do not import rosters from Google Classroom, Clever, ClassLink or any SIS. Teachers can post assignments to their own Google Classroom: that connection runs through the teacher's Google account, we list the courses the teacher teaches and create the coursework item, which links students to the Prodigies student page for the matching PK-5 class. We remember which PK-5 class each course belongs to by storing Google's course id, and nothing else from Classroom: no Classroom roster, student ids or names. |
|---|
| Assignments & scores | Teachers can assign games and activities. A student may choose to send a finished score to their teacher's class: we store first name + game + score, scoped to the class code, teacher-owned under the same RLS isolation and retention windows as compositions. The class leaderboard shows a score only if the teacher published it (or opted the class into a live leaderboard at creation), and is reachable only with the class code. Nothing is collected unless the student submits. |
|---|
| Assessments | Teachers can assign an assessment to a class. A student opens it with the class code, types a first name or nickname (40-char max), and answers; we store each answer and its score against that name. This is the one place we keep a per-question record for a named child, because that is what a standards-mastery report is. It is scoped to the class, teacher-owned under the same row-level-security isolation as everything else, and never shown on a leaderboard or in a gallery. Answer keys are held server-side and are never sent to a student's browser. Some question types are scored by the teacher rather than the computer; their judgement and any note is stored alongside the answer. Assigning requires the teacher's attestation that the school holds any required parental consent. |
|---|
| Student PII collected | A first name or nickname (40-char max), plus the work itself, in the three activities that submit: Bell Composer (an optional title and the notes), game score submission (game and score), and assessments (each answer and its score). Separately, a teacher-entered class roster: each student's first name and, if the teacher adds it, last name (40-char max each), with what the teacher assigned to whom. Names are used only to organise that teacher's class and show them each student's work; a school that prefers not to use names may enter a student number or nickname instead. Each rostered student also gets a 4-digit student number for signing in with the class code. The full last name is never shown to anyone but the teacher. That is the complete list. No emails, birthdates, photos, location, or behavioral profiles. We also keep a random per-browser identifier on assessment attempts so one shared iPad is not mistaken for one confused child and a page refresh does not lose a student's answers; it is not linked to a person and is never shown to anyone. |
|---|
| Who can see student work | Only the class's teacher, unless the teacher publishes it to a class gallery reachable only with the class code. Assessment results are teacher-only with no publish path at all. Access is enforced by database row-level security and routinely verified against the live database. |
|---|
| Third parties on student pages | Vimeo only Student-facing pages load resources only from our domain and our database provider, plus Vimeo when a teacher has assigned a video: its thumbnail shows in the student's list, and the player loads when they open it ("Do Not Track" on). No third-party fonts, analytics, pixels, or ad tech. |
|---|
| Retention | Teachers can delete any submission or class at any time. Unpublished student submissions auto-delete after 180 days, published after 365 days, and assessment attempts with all their answers after 365 days. Deleting a class's assessment results deletes every answer in them; a class that still holds results cannot be deleted out from under them by accident. Class rosters are kept until the teacher removes a student or deletes the class. |
|---|