Student data privacy and security
class.locusmath.org is the classroom side of Locus, which is operated by Stel Studio Inc: classes, assignments, rosters, and the teacher workspace. Students sign in here and nowhere else. It is a separate site from the consumer product at locusmath.org, on its own origin, and it carries no analytics tag.
Effective date: September 24, 2026.
This page is written for a district privacy review. It states what we collect about students, who else receives it, how long we keep it, and how a school gets it exported or deleted. The platform privacy policy covers both products in full; the signed data privacy agreement is the binding document.
Our role: school official under FERPA
This applies to students whose school or district has signed a data privacy agreement with us.
- Locus acts as a school official with a legitimate educational interest, under the direct control of the school with respect to student education records.
- Student data is used only to provide the service to the school. We make no commercial use of it and no secondary use of any kind.
- We do not redisclose student data to anyone except the processors listed below, each limited to what is listed.
- The school directs what happens to the data: review, correction, export, and deletion are all available on request at any time.
- At the end of a contract we return or delete the district's student data on request.
Classes with and without a district agreement
- Anyone may take the teacher role and create a class, including club leaders and tutors. Only teachers we have verified can import or sync a roster.
- A student in a school or district that has signed a data privacy agreement with us is covered by that agreement. Our role is the school-official role above, and the district directs what happens to the records.
- A student can also sign in and join a class that a teacher runs without any agreement, such as a math club or a tutoring group. That student gets the same student account and every protection on this page that the software provides: no public leaderboard or profile, no social features, no billing, no free-text channel, no analytics, no ranked-play signals, and no third-party media. There is no school directing the record, so the student manages it: they can download it and delete their account themselves.
- A teacher who creates a class sees the name and email address of every student who joins it.
COPPA and school authorization
- Consumer accounts on locusmath.org are for users 13 and over, a condition of the Terms of Service. The same condition applies to a student account in a class run without a district agreement.
- A student under 13 may use Locus only through a school or district that has signed an agreement with us. That authorization stands in for parental consent under COPPA's school-authorization provision, for the educational use the agreement describes.
- We collect no ages and no birthdates anywhere in the product. Consent attaches to the district relationship, not to a detected age, so there is no age gate for a student to answer.
- A Clever sign-in creates a student account when Clever reports the student role, and a teacher account when it reports a teacher or staff role. A Google sign-in on the consumer site with a contracted district address is refused and pointed at the classroom site instead.
What we collect about a student
- Account: the name and email address the sign-in supplies (Google or Clever), the provider's identifier, the Clever district identifier for a Clever sign-in, and the student identifier if the school imported a roster. No password, no username, no age, no birthdate, no address, no phone number.
- Class membership: which classes and groups the student is in, and when they joined.
- Assignment work: problems served, answers submitted, correctness, score, hints used, time taken, corrections, and teacher grade overrides.
- Self-study on this site: practice attempts, per-topic rating, review queue, bookmarks, and goals. Visible to the student, not to other students.
- Crash reports: on this site the app sends only the error text, the page path, and the app version, for every account. If a student's report arrives from another Locus site, the server drops the click trail, the grading context, the user-agent string, and the query string of the page address before anything is stored.
- We do not store IP addresses, and email addresses in our own log lines are masked.
What students are kept out of
- Public leaderboards and public profile pages: a student appears on neither.
- The follow graph and activity feed, which exist between adult accounts only. A student session is refused on every one of those endpoints.
- Billing: subscriptions are never offered to a student and a student session cannot reach a billing endpoint.
- Free text: bug reports, the contact form, and problem reports are adult endpoints a student session cannot call.
- Analytics: this site loads no measurement tag at all, so classroom work is never measured.
- Third-party embeds: YouTube help videos stay off for a student unless their district authorizes third-party media in its agreement; a student outside a district agreement never sees them. With authorization, the YouTube row below applies. Otherwise every asset a student loads comes from a Locus domain.
- Advertising: there is none anywhere in Locus, and no profiling, no behavioral targeting, and no sale of data.
- AI: we do not use student data to train models. The teacher assists send class statistics - accuracy, mistake counts, attempt counts - and, for one assignment question, up to ten wrong answers with nothing attached to say whose they are. The software adds no name, email address, roster, or account identifier. The assists also send whatever notes the teacher types, as written, and the forms ask teachers not to include student names. The Anthropic row below lists everything that goes.
- Behavioral monitoring: the ranked-play fairness signals the consumer product records (window focus, blocked copy, paste and drag, right-click, print, and the PrintScreen key) are never stored for a student, and no anticheat flag is ever raised against one.
- Discord and live play: both need a personal or teacher account. A student account cannot link to our Discord server or join a live match.
Subprocessors
These are the only third parties that receive data from the classroom product, and they receive only what is listed. Adding one, or widening what one already receives, means updating this page and giving districts notice under the agreement.
| Service | What it receives |
|---|---|
| Cloudflare | Hosting, TLS termination, and delivery, so all traffic passes through it. It also delivers our service email (recipient address, subject, and body, which can contain a name, a class or assignment name, or a school name). |
| Google (sign-in) | The sign-in exchange for a school Google account, from which we receive the name, email address, and Google account identifier. |
| Clever | The sign-in exchange and, if the district uses it, rostering: name, email address, school role, and district identifier. |
| Google Classroom | Only if a teacher connects a course: we read that course's roster (student names and email addresses) to fill the Locus class. |
| YouTube (Google) | Help videos on practice, assignment, and lesson pages. A student sees them only when their district has authorized third-party media in its agreement; students outside a district agreement never do. When a tile renders, the browser requests its thumbnail from YouTube (i.ytimg.com), which sees the IP address and browser; the player loads only on a click, through the youtube-nocookie domain. Teachers and signed-out visitors see the tiles. |
| Stripe | Teacher and school billing only: the payer's email address and the details entered on Stripe's form. Never a student, and card numbers never reach us. When a paying account is deleted we ask Stripe to delete its customer record, and our staff finish any deletion Stripe does not complete. |
| Anthropic | The AI assists a teacher runs from their own workspace, the physics studio, and the paid authoring assistant. Each needs the paid Author plan on the teacher's account, bought or granted by us, and a server without a provider key runs none of them. The assists send class statistics: accuracy per skill, how many mistakes fell into each category, weekly attempt counts, mastery percentages against standards, gradebook scores, and the text of the questions behind those numbers. Diagnosing a single assignment question also sends up to ten wrong answers to it, each a math expression cut to 80 characters. Any assist also sends the notes the teacher types into it (up to 2000 characters) and, if a result is sent back for another try, the teacher's hint (up to 500 characters). The authoring assistant sends a topic, a difficulty, and up to 2000 characters the teacher typed; the studios send the teacher's own draft. The software adds no names, email addresses, rosters, account identifiers, class names, or teacher names: a draft written about one student carries the placeholder [Student], and the teacher's browser puts the name back on their own screen. What a teacher types is sent as written, so the forms ask teachers not to include student names. Everything that comes back is a draft the teacher reads and edits before anyone else sees it. |
| DevHelm | Hosts our status page at status.locusmath.org, which the site footer links to. It receives the ordinary web requests of anyone who opens that page (IP address and browser). Our sign-in cookies are limited to paths under /api, so a browser sends them to the status host only for addresses under status.locusmath.org/api. |
Google Analytics is not on this list: it runs on locusmath.org only, only after a personal learner account signs in, and never on this site.
How long we keep data
| Data | Kept for |
|---|---|
| Student record, class membership, assignment work, and self-study history | Under a district agreement: until the school or district asks for deletion, or the contract ends. Outside one: until the student deletes the account or asks us to. There is no automatic expiry, so grades and progress stay intact. |
| Crash reports | 90 days, then deleted by a nightly job. |
| Email verification and password-reset tokens (teachers) | Deleted when they expire. The send records behind our rate limits are deleted after 30 days. |
| Class invitations | An invitation expires 7 days after it is sent, and unused invitations are deleted then. The moment one is accepted, the name, email address, and student identifier it carried are erased; what remains is the record that this class invited someone, when, and from which roster. Deleting a student also deletes any invitation still open to their address, and a nightly job re-checks that no accepted invitation is still carrying a name or address. |
| Administrative audit log | Kept as the record of who read, exported, or deleted student data. It keeps the identifier of the account an action was taken against even after that account is deleted, so the disclosure trail stays meaningful. |
Export, deletion, and end of contract
- Export: every student can download a JSON copy of their own record from Settings (Download my data). For a district's students we also send the same copy on request from the contact on the contract, and a district official with access to our console can export it directly. It covers everything we hold: profile, classes, assignment work, corrections, physics quiz scores, practice attempts, topic ratings, physics attempts, bookmarks, review schedule, and goals.
- Deletion: a student under a district agreement is deleted through the school or district, which can ask us or, with console access, delete the student directly. A student outside a district agreement can delete their own account from Settings or ask us. Deletion is immediate and permanent, and it removes the student record together with class memberships, assignment work, corrections, grade overrides, and the student's own practice history, and clears the roster invitation trail that named them.
- End of contract: on request we purge, in a single operation, every student the contract accounts for - linked to it directly, matched by the district's Clever identifier, or on one of its email domains - and report the count back.
- Every export, search, and deletion of student data by our staff, a district official, or a teacher exporting a gradebook is written to our audit log with the person who did it, the action, and the target. A student exporting or deleting their own record is not logged.
- For a request sent to us, we confirm it came from the contact on file, then act within 30 days and usually sooner.
- Send requests to [email protected].
Parents and eligible students
For a student under a district agreement, parents and eligible students exercise their rights of access, correction, and deletion through the school, which can obtain any of them from us. We do not act on a request from a parent directly, because we cannot verify the relationship and the records belong to the school; we forward such a request to the district contact instead.
Security
- Every connection is encrypted in transit with TLS.
- Teacher passwords are hashed with Argon2 and never stored in a readable form. Students have no password: they sign in through the school's identity provider.
- Session cookies are httpOnly, SameSite=Lax, Secure in production, scoped to the API path, and expire after 24 hours. Students and adults carry different cookies and different token types, and each is rejected by the other's endpoints.
- Our API sends HSTS, a strict content security policy, X-Frame-Options DENY, nosniff, and a strict referrer policy.
- Sign-in, password reset, class joining, and report submission are rate limited.
- Administrative access is behind a role check, and reads, exports, and deletions of student data are written to an audit log. A teacher exporting a gradebook is logged the same way.
- A teacher sees only their own classes; a student sees only their own work.
If there is a breach
We contain the incident, determine exactly which students and records are affected, and notify within 72 hours of confirming it. Districts are notified through the contact on their contract, with what happened, what data was involved, what we have done, and what we recommend. We notify regulators where state law requires it.
Where data is stored
Student data is stored and processed in the United States. Our hosting provider delivers pages and static files from its global network, so a page asset may be served from a location near the school, but student records live in the United States.
Rostering and sign-in
Students sign in with Google or Clever accounts; there are no Locus passwords for students. Classes fill through a join code, an email invitation, a pasted roster, or a Google Classroom or Clever roster sync.
Roster import and roster sync are restricted to teachers we have verified, and a row that matches a student who already belongs to a district is refused unless the importing teacher is on that same district's contract. An emailed invitation does nothing until the student accepts it.
Get the data privacy agreement
Stel Studio Inc, the company that operates Locus, signs NDPA-style data privacy agreements. There is no download link: ask and we will send the current template, along with anything else your review needs.