Student data privacy and security

Locus collects the minimum needed to run a class, keeps it for a short time, and hides student accounts from the public. Classes, assignments, and the teacher workspace live on class.locusmath.org, which runs no analytics and loads no third-party code; Google Analytics runs on locusmath.org only and receives no account identifier and no learning data. The signed Data Privacy Agreement is the binding document.

COPPA and FERPA posture

  • The district's DPA authorizes student accounts and stands in for parental consent (COPPA school-authorization provision).
  • Locus operates as a school official under FERPA: student records are used only to provide the service, not redisclosed or used commercially, and deleted on request.
  • Districts can request a full export or deletion of any student's data; both actions are logged.
  • Parents exercise review rights through the district.

Student accounts

  • Excluded from public leaderboards and profile pages.
  • YouTube help videos are off unless the district authorizes embeds.
  • Every asset on class.locusmath.org is served from our own domain.
  • No ads, no analytics on the classroom site, no sale of data.

What we collect and keep

  • Account: name and email from the school sign-in. No ages, no birthdates.
  • Learning activity: attempts, answers, scores, timing; the data teachers need for grading.
  • Crash reports (90 days), email tokens (deleted on expiry), invitation records (deleted 7 days after expiry).
  • IP addresses are not stored. Account deletion removes personal data immediately.

Subprocessors

  • Cloudflare: hosting, TLS termination, signup bot check, transactional email delivery
  • Google, Clever: sign-in
  • Google Analytics: page views on locusmath.org only; not loaded on class.locusmath.org
  • UptimeRobot: status-page monitoring, receives no user data

Security

  • TLS everywhere; passwords hashed with Argon2; httpOnly same-site session cookies.
  • Administrative access to student data is role-restricted and written to an audit log.
  • Breach notification to affected districts without undue delay.

Rostering

Students sign in with school Google (or Clever) accounts; classes fill through join codes, email invites, or roster import.

Get the DPA

Locus signs NDPA-style data privacy agreements; contact us for the template.

[email protected]Read the full privacy policy