Schools and districts
School privacy notice
How we handle school-managed accounts, classroom learning records and the copies needed to operate the service.
Version and effective date: November 5, 2026
Operator and privacy contact
Keyboard Hero is the service name. The legal operator and contact information maintained by the operator appear below.
Loading operator contact details. For a privacy question, contact Support@keyboardhero.site. Legal operator details must be completed before a district is approved for student enrollment.
Parents and eligible students may contact their school or our privacy contact about access, correction, deletion or stopping further collection. Do not send passwords, full student work or unnecessary student details in an initial email. We will coordinate an appropriate verification and secure response with the school.
Information we handle and why
| Category and source | Information and purpose |
|---|---|
| Students and classrooms | District-approved display name, login username, a salted password hash, district and class membership, and activity dates. The school supplies or approves account details; these records support sign-in, assignments and classroom access. Student accounts do not request a student email address, birth date or home address. |
| Learning work | Topic worksheet work, written responses, submission revision numbers and times, progress, and teacher feedback and review results. Students create their work and teachers add reviews so the school can provide instruction and evaluate learning. Free-text work can contain information a student chooses to type; avoid personal contact details, passwords and information about other children. |
| School staff and administration | Staff name, email, school/district membership, role, invitation and account status, credential hashes, and an encrypted authenticator secret if MFA is enrolled. These records support school administration, verified staff access and account recovery. |
| Security and operations | Session and recovery-token hashes, expiring invitation records, authentication/security events, administrative audit events and operation times. Security events can include an account identifier or hashed connection identifier. These records protect accounts, investigate problems and document authorized actions. Providers process network information such as IP addresses to deliver and secure the service. |
| Privacy and service requests | The app's request register stores the district, request type, case reference, response target, handling status and resolution time. Identity verification, assigned responsibility and follow-up require separate operator documentation. A case entry does not itself export, correct or delete a record. Supply only the minimum details needed to locate and resolve a request. Support email is a separate provider-held copy, not part of a student's worksheet. |
School-directed use and limits
We use school student information to provide the district-approved educational service, maintain accounts and security, support authorized staff, and follow the district's lawful instructions. We do not sell or rent school student information, use it for targeted advertising, build student profiles for unrelated noneducational purposes, or use school student records to train AI models.
We disclose school information only for the authorized service, to appropriately restricted service providers, at the school’s lawful direction, or where disclosure is legally required or otherwise permitted by applicable law. Service providers must be evaluated for appropriate confidentiality, security and use restrictions before they receive school information. A cookie choice does not authorize a prohibited use of school data.
For children under 13, any school authorization must cover the school-approved educational use; it is not authorization for unrelated commercial activities. The operator remains responsible for its own children's-privacy obligations. We do not treat a child accepting a notice, an email-domain match or a teacher changing a label as valid district authorization.
Who can access records and how to make a request
Students access their own classroom work. Teachers are limited to assigned classes; school administrators to their school; and district administrators to their district. Classroom work is not published to other students or the public. Authorized service operators may access records when necessary to operate, secure or support the service.
Authorized school staff can review and export a student's saved work, correct permitted account details and delete a student's login and live learning records. Destructive controls require confirmation and fresh staff credential verification. The school controls the educational record and may need to retain its own copy. This notice does not promise that every education record must be erased whenever a requester asks.
Parents or eligible students should begin with their school, or contact our privacy contact if they need help. Requests require identity verification and coordination with the school's authorized representative before records are disclosed or changed. The app tracks a case reference, response target and handling status; verification and completed actions require separate documentation. Applicable legal and district-agreement deadlines still govern. Account deletion is not a paid progress-reset purchase.
Service providers and optional features
- Render: application hosting and database infrastructure. It processes service data and network/request information. Actual processing regions, infrastructure-log retention and backup terms must be recorded in the district's provider arrangements; a deployment region alone is not a guarantee that every provider process stays in one place.
- Hostinger: account/security email delivery and the support mailbox. Staff recovery and security messages use the staff email address. Do not email student work or unnecessary student identifiers for support.
- Browser or device speech service: optional read-aloud uses the device's available voices. An online voice can send marked, publicly authored lesson text to its speech provider. Student answers and teacher feedback are excluded from the reader's selected text. A voice provider may still process connection metadata; the school should approve the device/service configuration. OpenAI narration is not part of the current school reader.
- Backup storage: Render-managed disk snapshots are already active and stored within Render. Keyboard Hero also stores encrypted application backups in a private Cloudflare R2 bucket restricted to the United States. Daily backups and 30-day application retention are configured. One encrypted offsite upload, read-back and isolated database recovery drill passed on November 5, 2026; these checks do not establish repeated scheduled success or full hosting recovery. Current approval checks require that additional copy, a verified retrieval and an isolated recovery drill before a new district can be activated. Provider identity, location, access, expiry and retrieval checks must be documented before a separate provider is used for school data.
Stripe processes independently purchased family payments, not school classroom learning records through the school purchase APIs. School accounts do not offer individual soundtrack purchases or paid student resets.
School sessions suppress optional visitor analytics. School entry and classroom routes do not require optional analytics to function. The public site's cookie notice explains any separately opted-in visitor analytics, IP-location processing and browser storage: Cookies & visitor privacy. These analytics are not linked to classroom progress.
Retention, return and deletion
We keep information only for its identified educational, security or service purpose. The district must agree to a suitable schedule before activation. The family 12-month inactivity rule and parent warning-email process do not apply to school classroom records.
| Record | How retention is handled |
|---|---|
| Live student account and work | The district-approved inactivity period is shown in the classroom. Scheduled cleanup deletes live student records and sessions after that period without student activity. Authorized requests and school offboarding use separate deletion controls; an inactivity timer is not a substitute for acting on an authorized deletion request. |
| Staff and invitations | Disabling staff revokes their access credentials and sessions. Scheduled cleanup erases staff account contact/credential details after 90 days disabled; an opaque inactive class-owner record can remain where needed to preserve a class. A teacher name already included in student feedback remains with that learning record until the record is deleted. Existing historical disabled records begin this 90-day period when the new lifecycle controls are introduced. Scheduled cleanup removes used or expired invitations 30 days after use or expiry. |
| School audit and deletion evidence | School audit events and minimal deletion/revocation evidence have a 365-day cleanup schedule for security and recovery reconciliation. Deletion evidence stores hashed identifiers, action and time, not a student's name or learning work. The separate security-audit cleanup schedule is also 365 days. Cleanup failures can delay removal and require operator follow-up. |
| Encrypted application backups | Application-managed backup copies have a finite configured expiry, shown in Site Admin. They are not instantly rewritten by deleting one live student record. A recovery drill works on an isolated copy, removes restored access credentials and reconciles current deletions/revocations. It never overwrites the live database. Provider-managed snapshots are separate and require provider handling. |
| School downloads | Once authorized staff export a file, the school controls that copy. Keep exports in approved storage and delete them under the school's schedule; the account deletion button cannot erase a file on somebody else's device. |
| Support email, infrastructure logs and provider copies | These copies are not erased by the live-account button. Their retention and deletion responsibilities must be recorded with the relevant provider and district. Contact our privacy contact for a complete request covering these copies. We do not represent a local backup drill as proof that every provider copy has been erased. |
At service termination, the district and operator coordinate the agreed return/export window, revoke access, remove live school records and handle remaining copies under the agreed finite schedule. Any legal retention exception must be documented, limited to its purpose and communicated where required. Restoring an older database must not silently reactivate deleted students or revoked access.
Security, recovery and incidents
School accounts use separate first-party session cookies, role-scoped access and password hashing. Sessions end after 15 minutes without authenticated activity, after eight hours at the latest, or on sign-out. Districts newly approved through Site Admin require enrolled MFA for staff classroom access and new staff enrollment. Existing staff can complete enrollment in Account security before classroom access. This does not mean every legacy or operator account has enrolled; the district's required authentication and recovery arrangements must be verified before activation.
School worksheets and answers are saved to the school account, not the public media cache. Public media can remain cached in a shared browser profile after sign-out; cache controls and limits are explained in the cookie notice. Do not store exports, passwords or private records in the public media library.
School approval requires a documented security and incident-response process, assigned responsibilities and review of safeguards. The operating register records checks and their scope. Backup and recovery results are labeled by what was actually tested. An isolated database drill does not prove full infrastructure recovery, offsite recovery, a penetration test or legal compliance.
If a suspected incident involves school information, the operator investigates, limits exposure and coordinates with the district's designated contact. Notification and cooperation follow applicable law and the signed district agreement. Report a concern to our privacy contact; do not include passwords or a full student record in the report.
Policy and service changes
The version date above identifies this notice. Material changes to school-data uses, recipients, retention or authorization are reviewed with the district before the affected change is enabled, and require any additional notice or authorization required by law or the agreement. A new feature must not expand school-data use merely because the website wording changes.
This notice describes the school-managed service. A district agreement may impose additional protections. It does not replace required direct notices, valid school/parental authorization, provider contracts or district procurement approval.