Privacy Policy

1. Introduction

BrainBuzz ("we," "us," or "our") provides an educational platform that uses Artificial Intelligence to generate study puzzles. We respect your privacy and are committed to protecting the personal information of our users: Teachers, Parents, and Students (children).

This Privacy Policy describes how we collect, use, secure, and share information when you use our web application (the "Service"). BrainBuzz applies privacy protections based on the Service's educational purpose, the age and role of the user, and applicable law, including the Children's Online Privacy Protection Act (COPPA).

2. Information We Collect

We distinguish between data collected from adult account holders (Parents/Teachers) and data collected from Students.

A. Information from Parents and Teachers

When you register for an account, we collect:

• Contact Information: Name and email address.
• Billing Information: We use Paddle as our Merchant of Record. BrainBuzz does not collect or store your credit card number or financial data. Paddle provides us with a transaction ID and subscription status.

B. Information from Students (Children)

BrainBuzz is a "Mixed Audience" service. We minimize data collection from children:

• Usernames: We encourage the use of pseudonyms or first names only. Our system can auto-generate usernames to avoid collecting real names.
• Passwords: Encrypted passwords for login.
• Education Data: Puzzle progress, completion status, and answers to educational exercises.
• No Email Required: We do not require students to provide email addresses or phone numbers to use the Service.

C. Automatically Collected Information

When you use BrainBuzz, we collect technical data to ensure the app functions correctly:

• Log Data: IP address, browser type, and operating system.
• Service Activity: Account activity needed to provide requested features, such as puzzles created, assignments completed, and support reports submitted.
• Aggregate Analytics: Cloudflare Web Analytics reports aggregate page views, referrers, general browser and country information, and performance measurements. We do not configure custom behavioral events or individual visitor profiles.

We also use limited browser storage for authentication, user-requested preferences, application caching, and recording privacy choices. Cloudflare analytics uses no cookies or browser storage and can be turned off without losing access to the Service. See our Cookie & Browser Storage Policy.

D. Tutor Plus Content and Usage

When Tutor Plus is used, BrainBuzz sends the student's message and relevant learning context to an AI provider so it can answer. Depending on what the user chooses to share, that context may include visible page text, the current exercise, typed work, an uploaded image, or a whiteboard image. A web search may also send a search request to the configured AI provider.

BrainBuzz does not save Tutor Plus prompts, images, whiteboards, or responses in its application database by default. We retain limited operational records such as the account, time, credits charged, token totals, whether a web search occurred, provider status, and estimated cost. AI providers may process or temporarily retain submitted content under their own service terms, privacy policies, and abuse-monitoring practices. Users should not submit names or other personal information that is not needed for the learning request.

3. Children's Privacy (COPPA Compliance)

We comply with the 2025 updates to the COPPA Rule. We do not collect personal information from children under 13 without Verifiable Parental Consent (VPC) or School Authorization.

A. Consent Mechanisms

• Parent or Guardian Authorization: Student creation is limited to authenticated parent accounts with an active paid subscription. Before creating a student account, the adult must review a direct notice, attest that they are the student's parent or legal guardian, and affirmatively authorize the described collection and use. BrainBuzz records the authorizing account, paid-account verification method, notice and policy versions, time, IP address, and browser information as evidence of that authorization.
• Classroom Access: Teachers may only access students who have been connected to their classroom after the student account has been created through an authorized parent account. BrainBuzz does not currently use a school-only authorization flow to create student accounts.

B. No Behavioral Advertising

We do not use student personal information for targeted advertising or to build user profiles for commercial purposes. We do not sell student data.

C. Data Retention Policy

We do not retain student data indefinitely. We retain personal information only as long as reasonably necessary to fulfill the educational purpose for which it was collected.

• Retention Period: Student account information is retained while the account is active and only as long as reasonably necessary to provide the educational service, maintain security, meet legal obligations, and resolve disputes.
• Deletion: A parent may delete a student account through BrainBuzz or submit a verified deletion request. Deletion removes the account from the active application database; limited copies may remain temporarily in protected backups until those backups rotate.

4. How We Use Your Information

We use the collected information to:

• Provide and manage access to the Service.
• Generate AI-powered puzzles and provide the optional Tutor Plus learning assistant.
• Track student progress on assignments.
• Maintain the security and integrity of our Service.

Where a law requires a legal basis for processing, we rely on performing our agreement with account holders, complying with legal obligations, protecting the security and integrity of the Service, our legitimate interests in operating and improving the Service when those interests are not overridden by individual rights, and consent where we specifically request it. We use aggregate analytics only to understand and improve the Service, and visitors can object by turning analytics off through Privacy Choices.

5. Sharing Information with Third Parties (Subprocessors)

We share data only with third-party service providers deemed "integral" to the operation of BrainBuzz. We have obtained written assurances from these providers regarding their security measures.

We do not disclose personal information to third parties for marketing or advertising purposes. If this changes, we will obtain separate, specific parental consent as required by the 2025 COPPA Rule.

6. Security

We implement reasonable security procedures to protect the confidentiality and integrity of your data:

• Encryption: Data is encrypted in transit (HTTPS/TLS).
• Infrastructure: Our application is hosted on a secured Hostinger VPS using Docker containers.
• Database: We use a file-based database (SQLite) located within our secured server environment. Direct access to this file is restricted to authorized administrative personnel.

7. Your Rights

• Review and Delete: Parents and Schools may review the personal information collected from their children and request its deletion.
• Revoke Consent: You may revoke consent for further collection of your child's data at any time. This will result in the termination of the child's account.
• Analytics Choice: Visitors may turn aggregate analytics off or change their selection at any time through the Privacy Choices link in the site footer.
• Individual Privacy Rights: Depending on where you live, you may request access to, correction of, deletion of, or a portable copy of personal information, and may object to or restrict certain processing.
• No Sale or Targeted Advertising: BrainBuzz does not sell personal information or share it for cross-context behavioral advertising. If this practice changes, we will provide the notices and opt-out or opt-in controls required by applicable law.
• Requests and Appeals: Submit a request through the BrainBuzz contact form. We may need to verify your identity and authority. If applicable law gives you a right to appeal a denied request, reply to our decision and state that you are appealing it.

8. Updates to This Policy

We may update this policy to reflect changes in our practices or legal requirements (such as the COPPA Rule updates effective 2026). If we make material changes regarding the use of children's personal information, we will notify parents/schools directly and obtain new consent where required.

9. Contact Us

For privacy inquiries or to exercise your rights: