Privacy Policy

Information We Collect

We collect information needed to provide classroom learning, account access, support, billing, security, and service improvement. This may include:

• Account and profile information, such as name, email address, role, school, and account status.
• School and classroom information, such as school names, invite codes, class names, class join codes, enrollments, and teacher assignments.
• Learning content and activity, such as questions, subject areas, student answers, grading results, teacher feedback, appeals, response times, review schedules, mastery data, XP, game activity, and classroom analytics.
• Uploaded or generated content, such as question images, teacher question banks, short-answer responses, and AI-generated question drafts.
• Authentication and technical information, such as session tokens, IP address, user agent, device and browser information, logs, cookies, and security telemetry.
• Billing and subscription information for paid teacher or school accounts, such as Stripe customer, subscription, invoice, and payment status identifiers.

How We Use Information

We use information to:

• Authenticate users and keep accounts secure.
• Operate classroom workflows, including class enrollment, question assignment, practice sessions, grading, appeals, and teacher dashboards.
• Schedule spaced repetition reviews and show students and teachers learning progress.
• Provide AI-assisted grading and question generation when those features are used.
• Process subscriptions, invoices, account credits, and payment emails.
• Provide support, troubleshoot errors, prevent abuse, monitor reliability, and improve Habident.

Student Data and Children Under 13

Habident is intended for school-directed educational use. When students under 13 use Habident as part of a classroom activity, we rely on the school or district to authorize use of the service where the Children's Online Privacy Protection Act permits schools to act on behalf of parents for educational purposes.

Student personal information is used only to provide, support, secure, and improve the educational service authorized by the school. We do not sell student personal information. We do not use student records for targeted advertising.

Schools, parents, guardians, and eligible students may contact us to request access, correction, deletion, or limits on further use of student information as described below.

AI Grading and Question Generation

Habident may send question text, answer rubrics, student answers, and related classroom context to AI service providers to grade short-answer responses or generate draft questions. AI output may be reviewed, appealed, or overridden by teachers. We track AI usage metadata such as model, provider, tokens, cost, latency, and errors so that we can operate and monitor the feature.

How We Share Information

We share information only as needed to provide Habident, comply with law, protect the service, or follow school-authorized use. Recipients may include:

• School-authorized users, such as teachers, administrators, and students in the same classroom context.
• Infrastructure and database providers that host, store, secure, and transmit Habident data.
• OpenRouter and model providers used for AI grading and question generation.
• Stripe for subscriptions, customer records, invoices, payments, billing portal access, and webhook events.
• Resend for account, verification, password reset, and billing emails.
• Cloudflare R2 for question image upload, storage, delivery, and deletion.
• Sentry for error monitoring, performance telemetry, logs, and session replay diagnostics.

We require service providers to use information only for the services they provide to Habident and to apply reasonable confidentiality and security safeguards.

Cookies and Similar Technologies

Habident uses cookies and similar technologies for authentication, session management, security, user preferences, and application functionality. For example, dashboard layout preferences may be stored in a cookie. Blocking cookies may prevent some parts of Habident from working correctly.

Retention and Deletion

We retain information for as long as needed to provide the service, support classroom records, maintain security, comply with legal obligations, resolve disputes, process billing, and enforce agreements. Student information should be deleted or de-identified when it is no longer needed for the educational purpose for which it was collected, subject to school instructions and legal or operational requirements.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, or disclosure. These safeguards include role-based access controls, authentication, secure transport, input validation, rate limiting, security headers, logging, and vendor safeguards. No online service can guarantee absolute security.

Your Choices and Rights

Schools, parents, guardians, students, and account holders may request access, correction, deletion, export, or limits on further collection or use of personal information by contacting us. When a request concerns student education records, we may coordinate with the relevant school or district to verify authority and fulfill the request.

Contact us at support@habident.com.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and provide notice as appropriate for the change and the users affected.