Privacy Policy
How EconLearn protects student and educator data.
Last updated: August 27, 2026
No Ads
Ever, on any page
No Data Sales
Student data is never sold
FERPA Ready
DPA available on request
Our Commitment
EconLearn is built for students and educators. Our business model is straightforward: schools and teachers pay for classroom tools, and studying stays free for students. That means:
- We never sell student data
- We never show ads to students or teachers
- We handle all data in accordance with FERPA
Privacy is not an afterthought. It is central to how we build and operate EconLearn.
FERPA Compliance
When providing services to schools and districts, EconLearn acts as a “school official” under FERPA with a legitimate educational interest in student education records.
- We use student education records only for the purposes for which the school authorized access.
- We do not disclose student records to third parties except as required to operate the platform or as directed by the school.
- We will sign a Data Processing Agreement (DPA) or Student Data Privacy Agreement with any school or district upon request.
What Data We Collect
Account Information
Name, email address, and role (student, teacher, or administrator). Also, when supplied: the school name, a profile picture URL from Google sign-in, and, if a district ever enables Clever or ClassLink sign-in, the identifier that provider issues.
Learning Data
Quiz scores, module progress, exam results, and learning streaks.
Classroom Data
Classroom membership and assignment completions.
LMS Activity Data
For an auto-graded activity launched through LTI 1.3, we store the LMS's opaque learner, course, assignment, and gradebook identifiers, together with selected answers, the final score, and grade-sync status. We do not store the learner's name, email address, or LMS roster from these launches. Ungraded graph launches do not create a learner activity record.
Usage Data
Login timestamps and feature usage. During lockdown exams we also record integrity signals so teachers can detect irregularities: tab switches and window focus loss, fullscreen exits, inactivity heartbeats, attempts to open developer tools or picture-in-picture, and whether the exam window still fills the screen (which is how a second monitor or a resized window is detected). We record that these events happened and how many times; we do not capture the screen, the camera, the microphone, or anything outside the exam tab. For basic analytics we use Google Analytics across the site, configured with Google Signals and ad personalization disabled and IP anonymization on. We never use it for advertising, profiling, or to identify individual students, and we never sell student data. Our server also receives first-party analytics from StatsLearn, CalcLearn, PhysicsLearn, and FinanceLearn. Those sites send public route paths, safe action names, active time, scroll depth, embed loads, coarse country and device class, and hostname-only referral information. A random identifier groups events only within one browser tab. We do not receive IP addresses, query strings, URL fragments, answers, scores, calculator or financial inputs, assignment payloads, uploaded files, notes, or personal information in that Learn Network analytics stream. For visitors on institutional networks, our server resolves the network to the organization that registered it with the public internet registries (for example, a university or a school district) and records only that organization name, for aggregate reporting on where the site is used. The address itself is used for that one lookup and is never stored; home and mobile networks are not recorded at all. Separately, when a visitor arrives from one of our own search ads for teachers and then creates an account, we record that single conversion event with the ad platform so we can tell whether the ad worked. This fires only for visits that began at one of our ads, counts an event without a name attached, never uses ad personalization, and never involves student learning data.
How We Use Data
We use data to:
- Provide the learning platform and its features
- Show teachers their students' progress and performance
- Return completed LTI activity scores to the correct LMS gradebook
- Generate classroom and school-level analytics
- Improve the platform based on aggregate usage patterns
We do NOT use data for:
- Advertising of any kind
- Selling to third parties
- Profiling students for non-educational purposes
- Training AI models on student data
AI Grading of Free-Response Answers
EconLearn offers an optional AI grader for free-response questions (FRQs). It runs only when a student chooses to submit an answer for grading.
- What is sent: the answer the student submits, which may be typed text or a photo or PDF of handwritten work, together with the question prompt and its scoring rubric. The student's name, email, school, and account identifiers are not sent.
- Where it goes: to the AI provider we currently configure as the grader. As of August 2026 that is OpenAI; depending on configuration the grader may instead use Azure OpenAI, Anthropic, Google, or AWS Bedrock, in each case under settings that do not permit training on the submitted content. If the configured provider is unavailable the request may fall back to OpenRouter, which we configure to route only to model providers that do not log or train on request content; if no such provider is available the request fails rather than being sent. This page is updated when the configured provider changes.
- Training: we do not train AI models on student work, and we do not permit our AI providers to train on it.
When a signed-in student saves an attempt, we store the score and the rubric breakdown with their learning data. We do not store the submitted answer text or the uploaded image.
Teachers with classroom accounts can also submit student work (typed or photographed) to an AI-assisted scoring tool with their own rubric. The same protections apply: no student names or identifiers are sent with the work, providers may not train on it, and the AI's output is a suggestion that the teacher reviews and can override. Teachers are responsible for using this tool consistently with their school's policies.
Data Storage & Security
- All data stored in the United States via Supabase (hosted on AWS).
- Data encrypted in transit (TLS) and at rest.
- Access controls and row-level security enforced on all database tables.
Data Ownership
- Schools and districts own all student data generated through their classrooms.
- Individual students own their personal learning data.
- Data can be exported or deleted upon request.
Data Retention & Deletion
- Account data is retained while the account is active.
- Schools and districts can request bulk deletion of student data at any time.
- Accountless LTI activity records are retained while a school uses the integration and can be deleted at the school's request. The browser launch token expires after 24 hours and is stored only as a one-way hash.
- Individual users can delete their account and all associated data at any time.
- After account deletion, data is permanently removed within 30 days.
Children’s Privacy (COPPA)
EconLearn is designed for high school students, typically ages 15–18.
- We do not knowingly collect data from children under 13.
- If a school uses EconLearn with students under 13, the school must obtain parental consent in accordance with COPPA.
Third-Party Services
These are every third-party service (subprocessor) the platform uses, with the data each one receives:
Supabase (US, on AWS)
Database, file storage, and authentication. Holds account, learning, classroom, and exam data.
Vercel (US)
Application hosting and delivery. Processes every request, including request URLs and IP addresses, in the normal course of serving pages.
Vercel Analytics and Vercel Speed Insights
Aggregate page-view counts and page-load performance. Served from our own domain, set no cookies, and collect no account identifiers.
Google Analytics
Basic usage analytics across the site, configured with Google Signals and ad personalization disabled and IP anonymization on. Never used for advertising, profiling, or to identify individual students.
AI grading provider (currently OpenAI)
Grades free-response answers. Receives the answer text, or the photo or PDF of handwritten work, submitted to the FRQ grader, with no student identifiers. Depending on configuration this may be OpenAI, Azure OpenAI, Anthropic, Google, or AWS Bedrock, each barred from training on the content. See AI Grading below.
Google Ads conversion measurement
Only for visitors who arrive from one of our own search ads for teachers: if such a visit leads to a signup, a single anonymous conversion event is reported so we can measure the ad. Ad personalization is disabled site-wide, and student learning data is never involved.
OpenRouter
Backup route for the FRQ grader when the primary model is unavailable. Receives the same submitted answer or image. See AI Grading below.
Resend
Sends transactional email (pilot confirmations, account and classroom notices). Receives the recipient name, email address, and message content. No student learning data.
Stripe
Payment processing for teacher and school plans. Receives the paying adult's email and billing details. Never receives student data. Card numbers go to Stripe directly and are never stored by us.
We do not share student data with any of these services beyond what is strictly necessary to operate the platform, and we do not add a subprocessor that would receive student data without updating this page.
Your Rights, California Notices, and On-Device Data
- Access, correction, deletion: any user (or a parent/guardian, or a school on behalf of its students) can request a copy of their data, corrections, or deletion at any time via the contact below or the in-account delete option.
- California: we do not sell personal information and we do not share it for cross-context behavioral advertising as defined by the CCPA/CPRA, so there is nothing to opt out of; we treat all visitors, including those sending a Global Privacy Control signal, the same way. As a service used by California schools we also operate consistently with SOPIPA: no targeted advertising to students, no student profiling for non-educational purposes, and no sale of student data.
- On-device study data: some features (for example the personal skill report) keep their data only in your browser's local storage. That data never reaches our servers, and clearing your browser storage removes it.
- International users: EconLearn is operated from the United States and data is processed and stored in the US. If you use the site from outside the US, you consent to that processing; the rights above are available to you regardless of where you live.
Contact
For privacy questions, data requests, or to request a Data Processing Agreement:
We aim to respond to all privacy-related inquiries within two business days.
Questions about our privacy practices?
We are happy to discuss our data practices, sign a DPA, or answer any privacy questions your district may have.
Contact Us