Trust & Security

Last updated: August 10, 2026

This page is written for school and district privacy reviews. It lists exactly what student data Teachify collects, where it is stored, who our subprocessors are, and how we protect it. For the full policy, see our Privacy Policy.

What we collect

Only what the classroom service needs. No advertising identifiers, no tracking across the web, no analytics SDKs.

  • Student identity: name, school email address, class enrollment, and (if the teacher adds it) a preferred name and guardian email
  • Student schoolwork: assignment and assessment submissions, grades and feedback, practice results (multiple choice, free response, question of the day), and code written in the built-in editor
  • Teacher accounts: name, email, school, and (only if the teacher connects Google Classroom) OAuth tokens used to sync rosters

We never sell, rent, or trade personal information, use it for advertising, or build profiles for non-educational purposes.

Where data lives

All data is stored and processed in the United States:

  • Database: Google Cloud Firestore, nam5 United States multi-region
  • Code execution and AI grading: Google Cloud Run and Vertex AI, us-central1 (Iowa)
  • Web hosting and server functions: Vercel, iad1 (Washington, DC)

Subprocessors

Teachify uses exactly two infrastructure providers. Each is bound by its data processing agreement to process data only to provide services to us. This list is posted publicly and kept current (Illinois SOPPA and similar state laws require this posting).

  • Google Cloud Platform (including Firebase): authentication, database, secure code execution, and AI grading via Vertex AI. Student work processed by Vertex AI is not used to train models.
  • Vercel: web hosting and serverless functions.

Security practices

  • No passwords stored. Sign-in is Google OAuth only; sessions are HTTP-only cookies verified on the server for every request
  • Tenant isolation. Every record is scoped to its school and teacher; every server handler verifies ownership against the signed-in identity, and database rules deny access by default
  • Encryption everywhere. TLS 1.2+ in transit, AES-256 at rest
  • Sandboxed code execution. Student code runs in isolated, short-lived containers with no access to any data
  • Least privilege. A single administrative account; no third party has production access
  • Tested rules. Database security rules are exercised by adversarial test suites before every rules deployment

Student data deletion

Schools, teachers, and parents can request deletion of a student's data at any time. A verified request permanently removes every record for that student, including submissions, results, roster entries, stored sign-in tokens, and the account itself, typically the same day and always within 30 days. Parent requests are confirmed with the student's school first, since schools control education records under FERPA. Details are in Privacy Policy §6.

Agreements for schools and districts

  • FERPA: Teachify operates as a school official with a legitimate educational interest, under the school's direct control, and uses data only for the contracted service
  • Data Privacy Agreements: we sign state versions of the Student Data Privacy Consortium's National DPA, including the General Offer exhibit so one signed agreement covers other districts in your state
  • New York Ed Law 2-d: a Parents' Bill of Rights supplement and a NIST-aligned data security plan are available on request
  • COPPA: accounts are created through schools, which provide consent in the educational context; we collect the minimum needed and never advertise to students

Contact

Privacy reviews, DPAs, and deletion requests: info@teachify.school. We respond to district privacy inquiries within five business days.