Readflexes ("we", "our", or "us") provides learning tools, games, and progress-tracking for teachers and students. This Privacy Policy explains what information we collect, how we use and protect it, and the choices and rights available to schools, teachers, parents, and students. It applies to the Readflexes website and services (the "Service").
Our role and legal compliance
When student data is involved, Readflexes processes that data only on behalf of, and under the direction of, the school or district, and only for legitimate educational purposes. We design our handling of student data to comply with applicable student-privacy laws, including:
- the Family Educational Rights and Privacy Act (FERPA), under which Readflexes operates as a "school official" with a legitimate educational interest;
- the Children's Online Privacy Protection Act (COPPA) — for students under 13, we rely on the school to provide the consent COPPA permits a school to give on a parent's behalf for an educational service;
- the Protection of Pupil Rights Amendment (PPRA); and
- applicable state student-privacy laws, including Massachusetts student-record regulations (603 CMR 23.00) and M.G.L. c. 71, §§ 34D–34H.
Information we collect
Account information
- Information a teacher or account holder provides, such as name, email address, and school or organization affiliation.
Student and roster information
- Class and roster data you authorize through Google Classroom or enter directly — such as course names, student display names, and student email addresses — used to set up classes inside Readflexes. We access Google Classroom data only with your permission and only for the scopes you authorize.
Student learning data
- Learning activity and progress generated as students use the Service — for example, vocabulary sets practiced, quiz and game responses, accuracy, response times, words missed, and time engaged. This is used to provide progress tracking and to tailor practice (such as resurfacing missed words).
- Content a user creates in the Service, such as custom vocabulary sets.
Usage and device information
- Standard usage and device information collected through Google Analytics for Firebase and our own traffic measurement — such as pages viewed, features used, approximate location derived from IP address, and browser/device type — used to operate, secure, and improve the Service.
Support communications
- Messages and feedback you send to our support inbox or through in-product feedback forms.
How we use information
- Provide, maintain, and improve the Readflexes Service.
- Import and manage class rosters when a teacher connects Google Classroom or enters them directly.
- Track learning progress and personalize practice for students.
- Respond to support requests and send service-related notices.
- Maintain security, prevent abuse and fraud, and debug and improve the Service.
What we do NOT do with student data
- We do not sell student personal information.
- We do not use student data for targeted or behavioral advertising, and we do not allow our service providers to do so.
- We do not build profiles of students for any purpose other than providing the educational Service.
- We do not use student personal information to train third-party or external artificial-intelligence models.
We may create and use de-identified or aggregated data (data that cannot reasonably be used to identify a student) to operate, evaluate, and improve the Service, consistent with applicable law and any signed DPA.
Service providers (sub-processors)
We use a small number of trusted service providers to operate the Service. They are permitted to use data only to provide services to Readflexes and are bound by confidentiality and data-protection obligations. Our current sub-processors are:
| Provider | Purpose | Data location |
|---|---|---|
| Google — Firebase (Authentication, Firestore, Realtime Database, Hosting, App Check) & Cloud Functions | Authentication, data storage, real-time multiplayer, hosting, and application backend | United States |
| Google — Analytics for Firebase | Usage and performance analytics | United States |
| Google — reCAPTCHA | Bot and abuse prevention | United States |
| Google — Classroom API | Roster import (only when authorized by the teacher) | United States |
| Google — Cloud Text-to-Speech | Generating spoken audio of words and prompts | United States |
| Unsplash | Image search for vocabulary sets (image queries; no student identifiers sent) | United States |
We will maintain this list as our providers change. Student data is stored on Google Cloud infrastructure located in the United States.
How we share information
- With the school, district, or teacher that directs the student's use of the Service.
- With the service providers listed above, who are required to protect the data and use it only to provide services to Readflexes.
- If required by law, or to protect the rights, safety, and security of users, the public, or the Service.
- In connection with a merger, acquisition, or transfer of assets — in which case the successor will be bound by commitments at least as protective as this Policy and any applicable DPA, and the school will be notified.
Data security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, authentication, and App Check verification. No system is completely secure, but we work to protect data and to improve our safeguards over time.
Data breach notification
If we determine that an unauthorized acquisition, access, use, or disclosure of personal information has occurred, we will notify the affected school or district without unreasonable delay, consistent with applicable law and any signed DPA, and cooperate with the school in its response and any required notifications.
Data retention and deletion
We retain personal information for as long as needed to provide the Service, or as directed by the school or district, or as required by law. A school, district, or account holder may request access to, correction of, or deletion of personal information, and we will return or securely delete student data upon request or upon termination of the service relationship, subject to any legal retention obligations and the terms of any signed DPA.
Children's privacy
Readflexes is intended for use in schools under the direction of teachers and administrators. Student accounts and student data are created and used for educational purposes under school authority. For students under 13, Readflexes relies on the school to provide the consent that COPPA permits a school to give on a parent's behalf for an educational service. If you believe a student's information has been collected without proper authorization, contact us and we will promptly address it.
Rights of parents and eligible students
Parents and eligible students have rights regarding student records under FERPA and applicable state law, including the right to access, review, and request correction or deletion of student data. Because the school controls student records, please direct these requests to the school or district; Readflexes will support the school in fulfilling them.
Your choices
- You can update account information in the app.
- You can revoke Google Classroom access in your Google settings.
- You (or your school) can request access to or deletion of data by contacting us.
Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and notify users or schools where required. Changes will not reduce protections for student data below those required by an applicable signed DPA.
Contact us
Email: readflexes@gmail.com