Trust, privacy & safety

How we protect students, families, and schools — in plain language. Last updated: September 13, 2026.

🚫🤖

We don't train AI on your dataStudent work, tutoring sessions, and teacher content are never used to train generalized AI/ML models.

🔑

You own your dataView it, export it, and delete it. Parents and schools control the children in their care.

🧒

Built for childrenCOPPA-first: parental consent & controls, no behavioral ads to kids, and we never sell personal data.

🔒

Secure by defaultEncrypted in transit and at rest, on trusted cloud infrastructure, with least-privilege access.

AI & your data

Studyfin uses AI to tutor, generate practice, and give feedback — but your data is yours.

No model training on your content. Children's work, chats, handwriting, and teacher-created materials are not used to train generalized AI/ML models — ours or third parties'.
On-device first. Where we can, the work happens on the child's own device — for example, our handwriting reader checks letters and numbers locally, with no network round-trip. AI help is an explicit, opt-in step, not the default.
Human oversight. Live tutoring is delivered by real, screened tutors; AI assists, it doesn't replace the adult in the room. For students under 13, a parent or guardian is present.
Honest content. Our state-test practice is original and independently cross-checked, aligned to each state's standards — never copied from secure or official test items.

COPPA. We collect the minimum needed to run the service, obtain parental consent for children under 13, never use children's data for behavioral advertising, and never sell personal data.
FERPA. When a school uses Studyfin, student education records are handled on the school's behalf as a school official under FERPA — used only to provide the service, never sold or advertised against.
Data minimization. We don't ask children for more than is reasonably necessary to take part, and we retain data only as long as it's needed.
Handwriting (ink). Children write by hand in Studyfin, and handwriting is unusually personal. Recognition runs on the device first, and many answers are checked without anything being transmitted. When the on-device reader can't decide, the written image is sent to our AI checker for that one request — it is not stored by Studyfin. What we keep on a child's record is numbers only: a neatness score and per-letter accuracy counts. No stroke data and no images are stored. Personalised recognition stays in that browser and is never uploaded. Read the full ink-data policy, including what we deliberately do not claim.
Full details. See our Privacy Policy for exactly what we collect, why, and your rights.

Encryption. Data is encrypted in transit (TLS) and at rest.
Trusted infrastructure. We run on Google Cloud / Firebase, with managed, regularly patched services.
Access controls. Least-privilege access to production data, server-side security rules, and audited administrative actions.
Payments. Card payments are processed by Stripe; Studyfin never stores full card numbers.

See it. Parents and schools can see the progress and activity of the children they manage.
Delete it. Delete an account and its associated personal data at any time (in-app "Delete data," or by contacting us) — unless we must retain something by law.
Handwriting & on-device data. Handwriting samples and practice data can be cleared from the device in one tap.
Contact. Privacy or data requests: open a support ticket or email our team.

For schools and districts, Studyfin supports secure, standards-based sign-in and rostering so student accounts are provisioned safely and centrally:

We believe in being straight with schools about what's in place now versus what's on our roadmap. We don't claim certifications we don't hold.

Area	Status	Detail
COPPA-aligned practices	In place	Parental consent & controls, no ads to children, no sale of personal data.
FERPA (school official)	In place	Student records used only to deliver the service to the school.
Encryption in transit & at rest	In place	TLS + encrypted storage on managed cloud infrastructure.
No AI training on user data	In place	Contractual + technical: your content isn't used to train models.
SSO / SCIM / OneRoster / LTI 1.3	In place	Google, Clever, SAML 2.0, SCIM 2.0, OneRoster, LTI 1.3.
ClassLink SSO	On roadmap	Built and wired, not yet switched on — the sign-in page says so too. Ask us if your district needs it.
SOC 2 Type II	On roadmap	Formal third-party audit planned; not yet certified.
Third-party privacy seals (e.g. Common Sense, 1EdTech TrustEd)	On roadmap	We follow their guidance and intend to pursue verification.
GDPR / CCPA data-subject requests	On roadmap	Honored on request today; a self-serve DPA/portal is planned.

Running a formal review or need a Data Processing Agreement? Book a call or open a support ticket — we'll share what your district needs.

All tutoring happens inside Studyfin — no moving sessions off-platform, no private contact details.
Tutors are screened and agree to our Code of Conduct, including mandatory reporting.
For students under 13, a parent or guardian must be present and signed in.

This page summarizes our practices and works alongside our Privacy Policy and Terms of Service; where they overlap, all apply.