Children's Privacy Notice (COPPA)

Application: Grade AI

Last updated: 12 October 2026

1. Who we are

• Operator: Martin Sixta
• Email: privacy@gradeai.ch

The operator's full contact details, including the postal address and phone number, are in section 5a. Grade AI has no other operator: nobody else collects or maintains personal information from children through it.

One person operates Grade AI. Write to that address with any request under this notice; we answer within 30 days, and sooner where the law requires it.

2. How a student gets in, and what we ask of them

No child creates an account here. Accounts — with an email address and a password — are for teachers, and only for adults: the application asks for a date of birth before any account is created, including sign-in with Google and with Apple, and refuses below 18. The date of birth stays on the device; only the yes/no outcome reaches our server.

A student signs in with an ID and a PIN instead. The teacher's class has a code and a switch that turns joining on and off again. While it is on, the student enters the class code, writes their own name, and chooses a six-digit PIN; they receive an ID and use the ID and the PIN from then on. Anyone who knows an active code can get into the class — which is why the terms require the teacher to issue the code only to their own students and to switch it off once the class is in, and why a teacher can revoke anyone's access to their class. A name on the class list that already has its own PIN cannot be taken over by anyone else. Before joining, the student sees the class name and the teacher's name, so they can tell the code comes from their own teacher.

A forgotten PIN: any teacher who has the student in one of their classes can issue a new single-use one. As soon as the student signs in with it, the previous PIN stops working and the student chooses a new one. We record who issued a temporary PIN and when.

We ask a child for two things: their name and the PIN they choose. The application matches the name to the teacher's class list; if it is not there, it adds it to the list as a new student, and the teacher sees it. We do not ask for an email address, a phone number, or anything else that could be used to contact them outside school, and there is no way for a child to be reached through the application. The PIN is stored only as a one-way hash and is used for nothing but letting that student see their own grades. Six digits are not many, so after five wrong attempts sign-in is locked for 15 minutes and the teacher sees it.

Everything else we hold about a student is entered by the teacher, acting for the school, and is limited to:

No photograph of the answer sheet, or any crop of one, ever leaves the device. Only the read result is stored. We collect no location, no contacts, no photo library, no microphone, and no advertising identifiers — the application does not ask the operating system for them at all.

2a. Persistent identifiers, email from a child, and child-generated content

Persistent identifiers. COPPA treats a persistent identifier — a cookie, an advertising ID, a device fingerprint, an IP address — as personal information in its own right. We collect none from a student in order to recognise or track them. No analytics or advertising script runs in the mobile application, the application never asks the operating system for an advertising identifier, and we have no crash reporting. All that remains on a student's device is the sign-in token, so they do not have to type the PIN every time; it serves nothing else and is combined with nothing.

There is one exception and we would rather state it plainly: the IP address. Like every service on the internet we see it on an incoming request, a student's request included. We use it for a single purpose — it becomes a counter key, so that the application cannot be flooded from one place and nobody can guess at another child's PIN indefinitely. What it produces is a row saying "this address, this minute, this many requests"; there is no student name beside it, no student ID, nothing else, no profile is built from it, and it is gone at the nightly clean-up at the latest, that is within 24 hours. For IPv6 addresses we keep only the first half. On student paths the address is never narrowed to one particular device anyway — a whole class sits behind one school address.

That is our own counter. The services the application runs on see the IP address too, for the same internal operations: Firebase sign-in, which Google runs in the United States, keeps it for a few weeks for security, and the Cloudflare server sees it on every request that passes through it. In Firebase sign-in a student is only an ID — no name.

This is precisely what COPPA permits without parental consent as support for the internal operations of the website or online service under § 312.5(c)(7), which covers protecting the security and integrity of the service and its users. We use that address for nothing else: no advertising, no analytics, no recognising a child on a later visit.

Fonts are bundled into the application. Until 12 October 2026 they were loaded from Google Fonts, which saw the device's IP address; that no longer happens.

The device fingerprint against repeated free trials does not touch students. It is checked only when a trial is activated on an account — and only an adult may create an account (section 2).

Bot protection does not touch them either. Google reCAPTCHA runs only in the signed-in part of the website, not in the mobile application, and students do not join a class through the website.

A student has no email address with us, and we never ask for one. They get into the application with an ID and a PIN (section 2); there is no email field for them anywhere.

Should one write from their own private address anyway — support receives such an email once in a while — we answer it and then delete the address. We do not store it, do not add it to any list, and do not use it to contact them on our own initiative. Were the correspondence to continue, we would tell the school. This is the one-time-response exception under COPPA § 312.5(c), not a channel we open to a child.

Child-generated content. A student types two things into the application, once, when joining a class: their own name and a six-digit PIN. After that they only fill in answers on a paper sheet and look at the result in the application. There is no free-text field, no way to upload a photograph or a file, and no way to reach another user. There is therefore nothing here through which a student could reveal more about themselves than the teacher entered on the class list.

Were we ever to change that, we would not launch it without verifiable parental consent. We would send direct notice to the school and to parents — exactly what is collected, what for, how to give consent, and how to withdraw it — and until consent arrived we would collect nothing. No such feature exists today, and the school authorization in section 3 covers everything the application does.

3. School authorization instead of parental consent

Grade AI is sold to teachers and schools for classroom use. Under the FTC's school-authorization approach for education technology, a school may authorize the collection of student data for a school-authorized educational purpose in place of individual parental consent.

What the school authorizes. The teacher who creates an account states that they have the school's permission to use Grade AI with their class and is answerable for that statement (Terms of Use, section 3b). The statement is recorded with the time and the version of the text agreed to. The Data Processing Agreement forms part of the terms and is entered into on behalf of the school.

The purpose is limited to grading and record-keeping for the class. We do not use student data for any commercial purpose. Specifically, we do not:

• show advertising of any kind, to anyone;
• sell, rent, or share student data;
• build profiles of students for marketing or for any purpose other than teaching, or use their data for marketing (class averages, progress and ranking are shown to the teacher alone);
• use student data to train artificial-intelligence models;
• send a student's name, or anything else identifying a student, to the artificial intelligence.

Student records are never used for advertising — not ours, not a third party's, and not for any behavioural targeting of students or their parents. There is no advertising in the application at all.

We never disclose student records except (i) on the instruction of the teacher or the school, or (ii) where the law or a lawful court order requires it.

We will not change how student records are used or shared without prior notice to the school and its agreement. Until the school agrees, the version it accepted continues to apply.

When the school treats us as a "school official" under FERPA, we accept what that role requires: we act under the school's direct control with respect to the use and maintenance of education records; we use them only for the purpose for which the school disclosed them; we do not re-disclose them except as FERPA permits (34 CFR § 99.33); and we return or delete them on the school's instruction.

The school stays in control. The school may inspect what we hold about its students, correct it, have it deleted, and refuse any further collection — see section 6.

Parents: your first point of contact is the school, because the school decides what happens with its students' data. If the school cannot help, write to us at the address in section 1 and we will act on it. So that a child's data does not go to someone who is not their parent, we confirm the relationship through the school before we disclose or delete anything.

3a. State student-privacy laws

Most states have laws on student data held by operators of K-12 services — California's SOPIPA and many modelled on it. We follow their core rules everywhere in the United States, not only where a particular state requires it. We do not:

• use student information for targeted advertising, on our service or anyone else's;
• build a profile of a student for any purpose other than the school's educational purpose;
• sell or rent student information;
• disclose student information except on the school's or teacher's instruction, to the vendors in section 5 so the service can run, or where the law requires it.

We protect student information with reasonable security measures (section 8) and delete it at the school's request, within 15 days.

Some states and districts require their own signed agreement — for example New York (Education Law § 2-d, with its Parents' Bill of Rights) or Illinois (SOPPA), or districts using the Student Data Privacy Consortium's National Data Privacy Agreement. A teacher's acceptance of our terms does not replace such an agreement. If your district needs one, have it write to us at the address in section 1 and we will review it.

4. Artificial intelligence, and what it never sees

The artificial intelligence in Grade AI does exactly one thing: it writes test questions for a teacher from a topic or from material the teacher uploads. It runs at Anthropic PBC in the United States.

It is never given anything about a student. Not a name, not an email address, not an account identifier, not a class, not a result. An earlier version of Grade AI explained a student's own mistakes to them; that feature was removed in its entirety on 5 September 2026, and an automated check keeps it from coming back.

Grading is not done by artificial intelligence. Reading the pen-filled circles is ordinary image processing (contours and pixel thresholds — no model, no learning), and the grade is a fixed formula over the correct answers. No automated decision with legal or similarly significant effect is made about a student. The teacher decides the grade.

One thing to know as a school: a teacher may attach photographs, PDFs, or documents of their own for question generation, and those attachments go to Anthropic. Their content is not inspected — only file type and size. The application tells the teacher, right at the upload button, not to include student names, filled-in tests, or other people's textbooks, and the terms oblige them not to. Metadata (capture location, time, device model) is stripped from photographs before they are sent.

5. Who else receives data, and why

The current list is kept public at Who we pass data to. Each of these acts on our instructions under a written agreement and may not use the data for its own purposes.

RevenueCat and the app stores (Apple, Google Play) receive nothing about students. They deal only with the teacher's subscription; the application does not start the store at all when a student signs in. Apple and Google sell the subscription as independent businesses under their own terms, not on our instructions.

5a. Operator contact details

• Martin Sixta, Czech business ID (IČO) 30034299
• Zbyslavova 1674, 272 01 Kladno, Czech Republic
• Phone: +420 777 002 227
• Email: privacy@gradeai.ch

Parents and schools can contact this operator about anything concerning student data.

6. Rights of the school and of parents

A school, or a parent through the school, may:

• review the student data we hold,
• have it corrected,
• have it deleted, and
• refuse further collection — after which the teacher removes the student from the class list and nothing more is collected.

How. The teacher can delete a class, a student, or the whole account from inside the application, and it deletes for real — classes, tests, grades, and the sign-in account. A school can also write to us and we will carry out the deletion; we do not require the request to come through the teacher.

Deleting the account deletes the data. We do not keep a copy to make a later request easier; the only copy is the weekly backup of the database, which deletes itself after 7 days (section 7).

7. How long we keep student data

COPPA requires this to be written down and public, and it is:

Student data is kept for a shorter period than the teacher's account. The account itself survives three years of inactivity so that a teacher returning from leave has something to come back to; the children's data does not, because that reason is about the teacher, not about them.

We do not keep student data indefinitely, and we do not keep it for any purpose other than the one it was collected for. When the school's purpose ends, the data goes.

8. Security

We maintain a written information-security program for children's personal information, with a named person responsible for it, an assessment of risks, safeguards matched to those risks, and a review at least once a year. The program also covers the vendors listed in section 5.

In practice: everything travels over HTTPS; database rules mean a teacher reaches only their own classes and a student only their own grades; passwords are stored so that the original cannot be recovered; account identifiers in server logs are shortened; only the operator's own account gets into the admin panel, and only with two-step verification.

No security is absolute. If a breach affects student data, we notify the school without undue delay and within 48 hours at the latest of becoming aware of it, so the school can notify parents. Where a state breach-notification law sets its own requirements, we meet those as well.

9. Changes

If we change this notice in a way that materially affects student data, we will notify schools before the change takes effect. The date at the top always says when it was last changed.

Contact: privacy@gradeai.ch — Martin Sixta