Privacy Policy

Last updated: 2026-05-23

This page describes what information Baruch Econ & Finance Studio (the "Service") collects from students, how it is stored, who can see it, and your rights regarding it.

1. What we collect

The Service intentionally collects the minimum information needed to operate. When you create an account we store:

• Your email address (held only in the authentication system; not duplicated into the application database — only an HMAC-SHA256 derivative is kept for "is this email already registered?" lookups).
• An account identifier (random UUID).
• An account role (student, instructor, or admin).
• An optional display name you set.
• The timestamp at which you accepted the Terms of Service.

When you use the Service we additionally store:

• Per-lesson progress markers ("started" / "completed").
• Quiz attempts: your answers, score, and submission timestamp.
• For staff disclosures only: an audit record containing the actor's ID, the action taken, the target student's ID, and a salted HMAC of the actor's IP address and User-Agent (the raw IP and User-Agent are not stored).

2. What we do not collect

We do not collect Social Security numbers, dates of birth, home addresses, phone numbers, government IDs, or payment information. We do not embed third-party advertising trackers on authenticated pages.

3. FERPA notice and non-waiver

The Service treats quiz attempts, lesson progress, and any related records as education records under the Family Educational Rights and Privacy Act of 1974 (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99) when the Service is used as part of an institution- authorized course. Where the Service operates as a "school official" under § 99.31(a)(1) of the FERPA regulations, it does so under the direct control of the contracting institution and is bound by the no-redisclosure terms of the underlying Data Privacy Agreement.

Nothing in this Privacy Policy or in the Terms of Service requires or permits a student to waive any right granted to them by FERPA. Any clause that purports to do so is void and severable from the rest of these terms. If you believe your FERPA rights have been violated, you may file a complaint with the U.S. Department of Education's Student Privacy Policy Office.

4. Who can see your records

• You can see your own profile, lesson progress, and quiz attempts at any time via your dashboard.
• Instructors can see lesson progress and quiz attempts only for students who are enrolled in their own courses (this is enforced in the database by row-level security joining on an enrollment record).
• Administrators (the project owner only) can read all records. Every administrator and instructor read of an individual student's record is recorded in an audit log retained for the life of the underlying education record.
• Nobody else. We do not sell, rent, or share records with advertisers, data brokers, or any third party except as required by law.

5. How long we keep records

• Inactive accounts (no sign-in for 24 months) are automatically deleted, along with all associated lesson progress and quiz attempts.
• Quiz attempts older than two academic years are purged unless explicitly retained by an instructor.
• Audit log records are retained for as long as the underlying education record they reference, per FERPA § 99.32.

6. Your rights

You can at any time:

• Access your records via the dashboard.
• Update your display name from your account settings.
• Delete your account and all associated data via the "Delete account" flow under your dashboard. This action is irreversible and completes within 30 days.
• Export your records — contact us and we will provide a machine-readable copy within 30 days.

Students who are residents of California (CCPA / CPRA), the European Union (GDPR), or other jurisdictions with comparable data-protection laws have the same access, update, deletion, and portability rights described above. Where the Service is acting as a school official under FERPA for records covered by FERPA, that statute controls.

7. Security

• All data is encrypted in transit (TLS) and at rest (AES-256, via our database provider Supabase).
• Per-row access control is enforced in the database via PostgreSQL row-level security, not in application code alone.
• IP addresses and User-Agent strings in our audit log are stored only as HMAC-SHA256 values using a server-side secret — a leak of the application database alone cannot enumerate them.

8. Children under 13

The Service is not directed to children under 13 and is not designed to comply with the Children's Online Privacy Protection Act (COPPA). By creating an account you affirm you are 18 years of age or older, or that an adult has set up the account on your behalf.

9. Changes to this Policy

We may update this Privacy Policy. Material changes will be announced on the Service at least 30 days before they take effect. The "Last updated" date at the top of this page indicates the current version.

10. Contact

Questions about this policy, requests to exercise your rights, or reports of suspected privacy violations may be sent to the project owner at privacy@example.com. We will respond within 30 days.

This policy is a starting template and is not legal advice. If you are an institution adopting Baruch Econ & Finance Studio for credit-bearing coursework, please review with your own counsel and Data Privacy Officer before signing a Data Privacy Agreement.