Privacy Policy

1. Introduction

My TEK Lab, Inc. ("we," "us," or "our") operates this platform. We are committed to protecting the privacy of all our users, especially children. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Our platform is designed for students, educators, and families. We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA) and other applicable privacy laws.

1a. What We Never Do

These hold for every user, of every age:

• We do not sell or rent anyone's personal information.
• We do not show ads, and we do not use personal information for targeted or behavioral advertising.
• We do not share personal information with anyone for their own marketing.
• We do not use third-party analytics, tracking pixels, or advertising cookies, and we do not track anyone across other websites or apps.
• We do not build profiles of users for any purpose other than running the platform for them, their teachers and their parents, such as showing a student their own progress.
• We do not use students' work or personal information to train AI models.

2. Information We Collect

Account Information

• All accounts: Username, display name, hashed password, account type (child, teen, adult, or teacher), and grade level.
• Teen and adult accounts: Email address (for verification and account recovery).
• Child accounts (under 13): No email address is required. A parent or guardian email may be provided to enable social features.
• Teacher accounts: Email address and associated classroom information.

Date of birth: when an account is created directly on our signup page, we collect the user's date of birth. We use it only to set the correct account type (child, teen, or adult) and to keep the experience age-appropriate (for example, which safety settings and notification rules apply). It is never displayed publicly, never used for advertising, and never shared. Accounts created by a teacher or through a school sign-in may not include a date of birth; those accounts use the grade level provided instead.

User-Generated Content

• Projects created within our tools (saved data, assets, and configurations).
• Comments, project notes, and remix notes.
• Likes and other social interactions.

Activity Data

• Experience points (XP), badges, streaks, and other gamification data used to track learning progress.
• Login timestamps and session information for authentication purposes.

3. Children's Privacy (COPPA)

We are especially committed to protecting the privacy of children under 13:

• Child accounts do not require an email address to sign up.
• Social features (commenting, sharing, liking) require a verified parent or guardian email.
• We do not engage in behavioral tracking or targeted advertising of any kind.
• We do not sell, rent, or share children's personal information with third parties for marketing or advertising purposes.
• Teachers and parents can manage child accounts, including controlling social feature access and requesting data deletion.

3a. Badge Kits and Learning Kits (No Account Needed)

Our badge kits (for scouts) and learning kits (for families and classes) can be used without an account. For a kit, we keep only:

• The email address of the adult who pays (a parent, guardian, troop leader or teacher), so we can send the link that opens the kit and the link to the certificate. Kits unlocked with a code from a troop or group pack store no email.
• The name typed for the certificate. The page asks for a first name and last initial. It is printed on the certificate and kept with the certificate's number so the certificate can be downloaded again and checked.
• The work the learner chooses to print on the certificate's work page (their plan and notes from the kit).
• A record of the purchase: which kit, the price, the date, any discount code, and Stripe's payment reference. Card details go to Stripe and never reach us.

A learner's progress through a kit is kept in their own browser (local storage), not on our servers. The public check at /verify shows only the name on a certificate, the kit, and the date it was completed.

Anyone with a certificate's link can delete its record from the certificate's page: the name, the work and the email are removed, and the number then checks as removed. A purchase that is started but never paid is deleted after two days. Parents and guardians may also ask us to delete a kit record by contacting us.

3b. Schools and Student Records

When a school or teacher uses the platform with students, we act as a "school official" under the Family Educational Rights and Privacy Act (FERPA): we use student information only to provide the platform to that school, under the school's direction.

• Student records stay under the control of the school and the student's family. We use them only to run the class and the student's account.
• For students under 13 using the platform at school, a teacher or school may consent on parents' behalf for this educational use, as COPPA allows. We use that information only for the school's educational purpose.
• A school or teacher can ask us at any time for a copy of its students' data or for its deletion (Section 10).

4. How We Use Information

We use the information we collect to:

• Authenticate users and maintain account security.
• Store and retrieve user projects.
• Track learning progress through gamification (XP, badges, streaks).
• Moderate user-generated content for safety.
• Send email verification and account recovery messages (teen/adult accounts only).
• Enable classroom management features for teachers.
• Process payments for subscription plans and kits, and send the links that open a kit and its certificate.

5. Content Moderation

To maintain a safe environment, we use automated content moderation:

• User-generated text (comments, project names, notes) is analyzed using machine-learning-based moderation (OpenAI Moderation API) to detect harmful content.
• We send the text alone, with no username or account details attached. Under OpenAI's terms for its API, this text is not used to train their models.
• We also use a local profanity filter as an additional safety layer.
• Content that violates our guidelines may be automatically blocked or flagged for review.

6. AI Helper (Optional, On-Device)

The platform includes an optional AI helper that students can use for creative coaching with their art, code, and ideas. It is designed with privacy as the starting point:

• The AI model runs entirely in the student's own web browser, on their device. It is not a cloud service.
• Nothing a student types, draws, or speaks to the helper is ever sent to us or to any third-party AI provider. Those conversations stay on the device, and we cannot access them.
• The helper is unavailable to child accounts that are not connected to a parent or teacher. For all other students it begins at the strictest safety setting.
• Parents and teachers can disable the helper, restrict it so it accepts no typed free-text, or adjust its safety level at any time.
• If a student's messages suggest they may be in crisis, the connected parent or teacher is alerted so a trusted adult can help. These safety checks also run on the device.

7. Third-Party Services

We use the following third-party services in limited, specific ways:

• Stripe: Payment processing for subscriptions and kits. Stripe is PCI-compliant. We do not store credit card numbers or payment details on our servers.
• Google OAuth: Optional sign-in method. We receive only basic profile information (name and email) if a user chooses to sign in with Google. For a child under 13, we keep only the account number Google uses to sign them in, not their name, email or picture. Teachers can also choose to bring in a Google Classroom roster (Section 7a).
• Google email delivery: our emails (account verification, password resets and notices) are sent through Google Workspace's mail servers.
• OpenAI Moderation API: automated text moderation (Section 5). Only the text is sent, with no username or account details.
• Amazon Web Services: our servers and file storage, in the United States.
• Code libraries and fonts: some pages load open-source code and fonts from public content delivery networks, such as cdnjs, jsDelivr and Google Fonts. Like any web request, these receive your browser's IP address and type; no account information is sent to them.
• Lesson videos: our course videos are hosted on our own servers. If a lesson ever plays a video from YouTube or Vimeo, it loads in YouTube's privacy-enhanced (no-cookie) mode or with Vimeo's do-not-track setting, which limit what those services collect.

We do not use any analytics, advertising, or tracking services. We do not display ads on our platform. For kits we count, per day, how many browsers open a kit's page, start a checkout and finish each step; these are totals with no names, emails or account details attached, and they stay on our servers.

7a. Google Classroom Roster Import (Teachers)

A teacher can choose to bring the students from one of their Google Classroom classes into a class here. Only the teacher signs in to Google for this, and only when they press Connect Google Classroom.

• What we read: the names and sections of the teacher's active Google Classroom classes, and, for the class the teacher picks, each student's name and Google account ID. We do not request or receive students' email addresses, and we do not access Google Drive, Gmail, or any coursework. Google may include a link to a student's profile picture, which we do not keep.
• What we keep: for each student the teacher adds, an account here with the student's first name, their first and last name visible only to their teachers, and their Google account ID, so the student can also sign in with Google. The list of the teacher's Google Classroom classes is shown to the teacher and not stored.
• The teacher's Google access: read-only and used for that visit only. The access token is held in the teacher's temporary server session for at most 30 minutes and is never saved to our database. We do not keep ongoing access. Teachers can also remove the permission at any time in their Google Account, under Third-party apps and services.
• Sharing: we do not sell this information, share or transfer it to anyone, use it for advertising, or use it to train AI models. It is used only to set up and run the teacher's class.
• Deletion: when an imported student's account is deleted, its names and Google account ID are deleted with it. Teachers can request deletion of the accounts they created, as described in Section 10.
• Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Cookies & Local Storage

We do not use tracking cookies. Our platform uses:

• localStorage: To store authentication tokens (JWT) for keeping you logged in, user interface preferences (such as theme settings), and a learner's progress through a kit.
• Kit cookies (first-party only): one that remembers a kit was unlocked in this browser, so the learner can come back to it, and one that lasts until midnight so a visit to a kit's page is counted once a day. Neither is shared with anyone or used to follow you to other sites.
• We do not use third-party cookies, tracking pixels, or any form of cross-site tracking.

9. Data Security

We implement industry-standard security measures to protect your data:

• All connections use HTTPS encryption.
• Passwords are stored only as one-way hashes (Argon2id) and are never stored in plain text.
• Authentication uses JWT tokens with expiration times.
• Database access is restricted and credentials are stored securely.
• Database backups are encrypted with a key that is kept offline.

If a security breach affects personal information, we will notify the affected users, and the schools and parents of affected students, without undue delay and as the law requires.

10. Data Retention & Deletion

• Users can delete their own projects at any time.
• We keep account information while the account exists. Account deletion is available on request: contact us at the address below, and within 30 days we will delete the account, its personal data, and its projects from our systems. Parents, guardians, and teachers may request deletion on a student's behalf.
• Teachers can create and manage student accounts for their classrooms, remove students from a classroom, and request deletion of student accounts they created.
• Parents and guardians may request deletion of their child's data by contacting us.

11. Parent & Guardian Rights

Parents and guardians of children under 13 have the right to:

• Review their child's account activity and projects.
• Disable social features (commenting, sharing, liking) for their child's account.
• Turn the on-device AI helper on or off, restrict it so it accepts no typed questions, or set its safety level for their child's account.
• Request a copy of their child's personal information.
• Request deletion of their child's account and all associated data.

To exercise any of these rights, please contact us using the information below.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when the policy was last revised. If we make a material change, we will post it here and tell users with a notice on the platform, and by email where we have one, before it takes effect. We will not use children's personal information in a materially different way without the consent COPPA requires.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights regarding personal data, please contact:

My TEK Lab, Inc.
PO Box 1051, Minneola, FL 34755
Email: info@myteklab.com