For schools and teachers
Student Data Privacy Notice
What we collect about your students, why, who receives it, how long we keep it, and how you delete it. Read this before you add students; your consent in School settings refers to this version.
Who is responsible
The school controls its students’ information. The Typing Cat acts for the school as a “school official” under FERPA: we use student records only to provide the typing lessons the school has chosen, under the school’s direction, and we never pass them on except to the service providers listed below, who are bound to the same use.
For students under 13, the school gives consent under COPPA on behalf of parents. That consent covers only use for the school’s educational purpose. We do not use student information for advertising, marketing, profiling or training AI models, and we never sell it.
What we collect
| Information | About whom | Why |
|---|---|---|
| First name and last initial | All students | Show the student to their teacher |
| Buddy picture, avatar | All students | Picture sign-in and the class page |
| Two sign-in pictures | Students without email | Sign-in; printed on the teacher’s login cards |
| Email address | Only students who sign in with email or Google | Sign-in |
| Class and school membership | All students | Put work and results in the right class |
| Typing results: speed, accuracy, time, lessons finished | All students | Lessons, assignments and reports |
| Accuracy per key (not the text typed) | All students | Difficult-keys report and drills |
| Assignment progress and teacher messages | All students | Assignments and nudges |
| Pages visited in the app, with no third-party tracking | All students | Fix problems and improve lessons |
| Sign-in time, IP address and browser | Students with their own account | Account security |
We do not collect students’ dates of birth, home addresses, phone numbers, photographs or the text they type. Students without email have no email address with us at all.
What we never do with it
- No adverts, ever: not while the student has a seat, and not after the school releases it.
- No marketing email to students.
- No third-party analytics, advertising or session-recording scripts on students’ or children’s pages.
- No public profile or place on public leaderboards. A class leaderboard shows only first name and initial, and only if the teacher turns it on.
- No sale, rental or sharing of student information.
Who receives it
Only these service providers, and only to run the service:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database and sign-in | All account and learning data |
| Vercel | Hosting | Requests, including IP address, in server logs |
| Sentry | Error reports (no session recording for students or children) | Technical error details, with sending of names and emails switched off |
| Resend | Email address and message, only for people with an email address |
The full list is on the subprocessors page. Schools with a signed agreement hear about a new provider that would receive student data as their agreement requires.
How long we keep it
A login the school created is deleted 60 days after the student is in no active class. All of a school’s data is deleted 60 days after its plan ends. Details for every kind of data are in the retention policy.
Deleting and exporting
A school admin can delete one student’s data from the student’s menu, or all of the school’s data from School settings. The data is removed from our live systems, and the school receives a deletion certificate listing what was removed. Copies in our database provider’s backups expire on its backup schedule.
A school admin can export everything we hold about a student, so the school can answer a parent who asks to see or correct their child’s records. Parents make those requests to the school; if a parent contacts us, we pass the request to the school.
Security and breaches
Connections to the site use HTTPS, our database provider encrypts the data it stores, and we encrypt sign-in pictures and Google Classroom tokens again ourselves. Access inside our team is limited to the people who run the service, and staff look-ups of an account are logged. If student data may have been exposed, we tell the school as the school’s agreement and the law require, so the school can inform families.
Agreements
We work with districts on the Student Data Privacy Consortium’s National Data Privacy Agreement for their state. Ask about an agreement. Where a signed agreement and this notice differ, the agreement wins.
Version 2026-10-24. Questions: info@thetypingcat.com. See also the privacy policy.