Privacy Policy
Who we are
Seventh Period is an AI-driven STEM learning platform for students in grades 6–12, operated by SeventhPeriod, Folsom, CA, "". For any privacy question or request, contact [email protected].
Information we collect from children
We collect only what is needed to run the tutoring:
- A username and password.
- A parent’s email address, entered at sign-up.
- On the waitlist, a child enters a birth month and year, used only to tell whether they are under 13 and not stored. A child under 13 then gives a parent's email address, not their own. We store it with the fact that the child is under 13, use it only to send the invite, and delete it 30 days after the invite (or the request, if no invite is sent) if the child doesn’t sign up.
- Birth month and year, asked at sign-up. We store only whether the child is under 13 or 13 and over, not the date.
- A first name or nickname, if a parent enters one.
- Their grade.
- Persistent identifiers: an account id and a login token, and the IP address and device/browser information in our server logs.
- The answers and written explanations they type while learning.
- Messages they send to the AI tutor.
- Notes they write.
- Project write-ups.
- Ratings and comments on videos and readings.
- Their progress and mastery scores.
- A record (no text) if a safety check is triggered.
We do not collect photos, your child’s location, and we do not show ads.
How we use it
We use this information to tutor your child, adapt question difficulty to what they are ready for, and show you their progress as their parent.
Who receives it
- Amazon Bedrock (AWS) — our AI tutoring provider. It processes your child’s answers to give feedback, using Anthropic’s Claude models. It does not store or log them, does not use them to train models, and does not share them with Anthropic.
- Supabase — stores your child’s account and progress data.
- Fly.io — hosts our servers in the United States and processes data on our behalf.
- Cloudflare — hosts our website and our domain name. It sees page requests only; your child’s answers go straight to our servers, not through Cloudflare.
- Resend — sends the emails we send you (invites, notices, alerts). It receives your email address; the emails do not include your child’s name or anything your child typed.
- OpenAI — receives only the names of skills and resource titles, to find and rank learning resources. It never receives your child’s answers, name, or any other child data.
- TinyFish, Tavily and Serper — receive a topic name, subject, and school level (for example “middle school”) to search for learning resources. Jina receives only the address of a public web page to read. No child data reaches any of them.
- Videos we show are embedded from YouTube using youtube-nocookie.com, YouTube’s privacy-enhanced mode.
Parental consent
An account for a child under 13 is not used for anything until a parent or guardian reviews and signs a consent form. See the consent form. You can withdraw consent at any time from Settings in your parent portal. Withdrawing consent stops further collection and use. It takes effect at your child’s next sign-in or request; a session already open ends when it disconnects. Deleting your child’s data is a separate button in Settings.
Your rights as a parent
You can review, export, pause, or delete your child’s data, and withdraw consent, any time from Settings in the parent portal.
How long we keep it
| Data | Kept for | Purpose |
|---|---|---|
| Study plans | 24 months | Study plan from mock tests |
| Mock test answers and scores | 24 months | Mock test answers and scores |
| Mission history | 24 months | Mission history |
| In-app notifications | 12 months | In-app notifications |
| Tutor observations | 24 months | Tutor observations per mission |
| Safety events (no message text) | 24 months | Self-harm/abuse tripwire hits -- no message text stored |
| Self-rated confidence | 24 months | Self-rated confidence |
| Tutor conversations | 12 months | Tutor conversation text, for feedback in later sessions |
| Saved lessons | 30 days | Cached lesson, replayed within 2 hours |
| Grouped mistakes | 24 months | Grouped mistakes, for gap analysis |
| Diagnosed mistakes | 24 months | Diagnosed mistakes, for gap analysis |
| Notes | 12 months | Notes the student writes |
| Project write-ups | 12 months | Project write-ups and their feedback |
| Ratings and comments on videos and readings | 12 months | Ratings and comments on videos/readings |
| Videos and readings opened | 24 months | Which resources were opened |
| Answers and explanations | 24 months | Answers and explanations, for adaptive difficulty |
| Waitlist requests | 12 months | Waitlist requests and invites; deleted 30 days after an invite is used, declined or expires, or an under-13 request goes unanswered |
Accounts with no activity for 24 months are deleted. Accounts for children under 13 that have no parental consent are deleted after 14 days.
Backups are kept for up to 7 days after deletion (our database provider’s daily backups).
Security
Data is encrypted in transit. Our database is reached only by our backend server, using a server-side key that is never sent to the browser.
Do Not Track
We do not track users across other sites, so we treat all browsers the same whether or not Do Not Track is set.
COPPA statement
Seventh Period complies with the Children’s Online Privacy Protection Act (COPPA).
AI notice
Seventh Period uses an AI tutor. It may not be suitable for some minors. See our safety page for what we do to keep sessions safe.
Effective date: November 2, 2026. Notice version 2026-10-v4.