We take privacy and compliance seriously. This guide summarizes how PlayAndLearnTech meets key legal requirements for an educational typing app.
Key Documents
Data We Collect & How We Handle It
- Account info: Name/username, email, password (securely hashed). A student's last name may be stored as a single initial only.
- Typing practice data: Scores, WPM, accuracy, progress
- Class organization: the grade a teacher's class is in, where the school provides it
- Basic technical data: Device type, IP address (for security)
- Advertising data: Google AdSense processes ad-serving data to display ads (see Advertising below). No student names, usernames, IDs, grades, scores, or progress are ever shared with advertisers.
We use trusted services (Google Firebase and PostgreSQL) that follow strong security standards, and Google AdSense to serve the ads that keep the app free. We do not sell student data, and we never share student identifiers with advertisers or any other third party.
Data Minimization for Roster Uploads
Schools create classes by uploading a roster exported from their student information system. Those exports routinely contain far more about a child than an educational typing app has any business holding — and for districts, this is usually the single biggest question about adopting a new tool.
Columns discarded automatically include student email addresses, student ID numbers, dates of birth, middle names, guardian names, phone numbers and email addresses, acceptable-use-policy status, enrollment status, and special education, IEP, Section 504, English-learner (ML) and critical-alert flags.
This is enforced in two independent places, so a fault in either one alone does not result in data being stored:
- In the browser: the parser builds each row from a fixed list of fields and never constructs the others, so the request body cannot contain them.
- On the server: every submitted row is rebuilt from the first and last name alone before it is read, stored, logged or echoed back in an error. Data outside the list cannot be stored even if a modified client sent it.
Optional last-initial storage. The system can additionally be configured to reduce a student's last name to its first initial at the moment the account is created, so the full surname is never written to the database. Districts that want the strictest possible footprint can ask for this; it applies to newly created students, and student sign-in is unaffected because usernames have always been generated from the initial.
Schools remain the system of record. We hold none of the information above, so it cannot be requested from us, breached from us, or disclosed by us.
Regulatory Compliance
COPPA (Children’s Online Privacy Protection Act)
We comply with COPPA. The app is designed for school use. We do not knowingly collect personal data from children under 13 without appropriate parental or school consent. Students and signed-out (anonymous) users are shown only restricted, non-personalized (contextual) ads with Google's child-directed treatment applied — no advertising profiles are built, and no student names, usernames, IDs, grades, scores, or progress are ever sent to advertisers.
COPPA's data-minimization principle is enforced in code rather than by policy alone: we collect only what the app needs to function, and a roster upload cannot deliver more than that. See Data Minimization for Roster Uploads.
FERPA (Student Education Records)
Schools that use PlayAndLearnTech do so under the school-official exception, and the district remains the system of record for its students. Two practices keep our footprint inside that arrangement:
- We do not receive education records. The most sensitive fields a roster export contains — special education, IEP, Section 504, English-learner designation, critical alerts, dates of birth and guardian contact details — are discarded in the browser and never transmitted. We cannot disclose, lose, or be compelled to produce information we never received.
- What we do hold is narrow and directory-level: a student's first name, a last name (optionally reduced to an initial), a generated username, the grade of their class, and their own typing practice results.
Student data is never used for advertising, never sold, and is kept entirely separate from billing — a subscription is attached to the adult who bought it, never to a student. Schools may request access to, correction of, or deletion of their students' records at any time.
GDPR (EU/UK Users)
We respect user rights including access, correction, and deletion of data. We only process data needed to provide the service.
CCPA/CPRA (California Users)
California residents can request access to, correction of, or deletion of their data. We do not sell personal information. As with COPPA, students and signed-out visitors receive only non-personalized (contextual) ads, and no student identifiers are ever shared with our advertising provider.
Advertising
PlayAndLearnTech is supported by advertising through Google AdSense. We apply strict, role-based rules so advertising stays school-safe — see the Privacy Policy's Advertising & Cookies section for full details.
- Students & signed-out visitors: restricted, non-personalized (contextual) ads only, with Google's child-directed treatment applied. No advertising profiles are built, and no student names, usernames, IDs, grades, scores, or progress are ever shared with advertisers.
- Teachers/admins: non-personalized ads by default; may optionally opt in to personalized ads for their own account only, from Privacy Settings on the dashboard, and can withdraw at any time with immediate effect.
- Blocked categories (all users): adult content, gambling, alcohol, tobacco/vaping, cannabis, dating, weapons, excessively violent content, political ads, crypto/high-risk financial products, weight-loss products, supplements, "make money online" schemes, and mature-rated apps.
- Cookies: Google AdSense may set ad cookies or read device identifiers to serve, cap, and measure ads. For students and signed-out visitors, this is limited to what non-personalized ads require.
- Managing ads: teachers/admins can change their ad preference at any time in Privacy Settings, and every ad includes a "Report this ad" link.
- School/district control: districts can request that ads be disabled entirely for their deployment, or request no student advertising, no behavioral advertising, or additional category restrictions.
We never sell student data. Google AdSense ad-serving is currently the only third-party data processing beyond the hosting services listed above — we do not run a separate analytics/tracking service.
Security Practices
- Passwords are securely hashed
- Data is transmitted with HTTPS encryption
- We use enterprise-grade hosting (Firebase)
- Regular security maintenance
Data Retention
- Active accounts: Data kept while the account exists
- Inactive accounts: Deleted after 24 months
- Advertising data: Google AdSense retains ad-serving data under Google's own policies; we do not operate a separate analytics service
In Case of a Data Incident
We will investigate promptly, contain any issue, and notify affected users and authorities as required by law. Contact us at playandlearntech@gmail.com.
Contact & Support
Email: playandlearntech@gmail.com
Company: PlayAndLearnTech, LLC • Utah, USA
We aim to respond to privacy or compliance questions within 30 days.