Privacy & Security for Schools

How CodeUtility for Teachers handles student data. This page sums up our Privacy Policy for teachers, schools and parents; the Privacy Policy and Terms of Service remain the full agreements.

1. What we collect from students

• Account: name, email address and, if the student chooses, a profile photo. Students sign in with email, Google, GitHub or Yandex.
• Class information: the classes a student joins and the display name the teacher sets.
• Class work: code written for assignments, runs and test results, submissions, scores and teacher feedback.
• Communication: messages between the student and the teacher, announcements and live session chat.
• Technical data: IP address, country, browser and pages visited, used for security and to keep the service running. Page visit logs are deleted after 60 days.

2. What we do not do

• We do not sell or rent student data.
• We do not show ads to students on class pages, and we do not use class data to target ads.
• We do not use class work to train AI models, ours or anyone else's.
• We do not use student data for anything other than running CodeUtility for the class.

3. AI in classes

• AI features in a class (help in the editor, AI grading, exercise writing) send only the text and code the request needs, and only to AI providers that do not use it to train their models.
• Teachers can turn off AI help for any assignment, and should review AI grades before relying on them.

4. Who processes data for us

• Amazon Web Services: hosting, storage and email (United States).
• DeepInfra and OpenAI: AI features, under terms that do not allow training on class data (United States).
• Google Analytics: usage statistics such as pages viewed and device type.
• Google, GitHub and Yandex: sign-in, only if the student chooses it.
• Paddle: payments for Teacher Pro. Paddle handles teachers' payments and never receives student data.

5. Keeping and deleting data

• Class work and messages are kept until the teacher deletes the class or removes the student, or the student leaves the class.
• Students can delete their account themselves from their profile page; their data is deleted right away.
• Teachers, schools and parents can ask us to correct or delete a student's data at any time.

6. Children under 13 (COPPA)

• Children under 13 may use CodeUtility only in a class set up by a teacher or school, who obtains any parental consent the law requires.
• We collect only what the class needs, and use it only for the educational purpose.
• Parents can review or delete their child's data through the teacher or by contacting us.

7. Schools in the United States (FERPA)

• When a school uses CodeUtility, we act as a school official with a legitimate educational interest, under the school's direct control of student records.
• We use education records only to provide the service, and disclose them only to the providers listed above or as the law requires.
• Districts that need a data privacy agreement can ask us to sign the Student Data Privacy Consortium's National Data Privacy Agreement.

8. Schools in the European Union (GDPR)

• For class data, the school is the controller and CodeUtility processes the data on its behalf.
• Schools can ask us for a data processing agreement, and students and parents can use their rights to access, correct, export or delete data.

9. Security

• All connections use HTTPS, and browsers are told to use only HTTPS (HSTS).
• Passwords are stored as one-way hashes, and payments are handled by Paddle, so we never see card numbers.
• Code runs in isolated sandboxes, separate from our website and database.
• Access to production systems is limited to the people who run CodeUtility. Please report security issues to contact@codeutility.io.

10. Questions

• Contact us at contact@codeutility.io. The full rules are in our Privacy Policy and Terms of Service.