Overview
Codebusters AI Tutor ("we", "us", "our") is an educational platform that helps students practice Science Olympiad Codebusters cipher-solving skills. We take your privacy seriously, especially because many of our users are students under the age of 18.
This policy describes what information we collect, how we use it, and the choices you have. We comply with the Children's Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA) where applicable.
Information We Collect
Account Information
- Email address — used for account login, verification, and password resets.
- Password — stored as a bcrypt hash, never in plaintext.
- Display name and avatar — optional, chosen by the user.
- Grade level and division — collected during onboarding to personalize practice.
Practice and Progress Data
- Cipher puzzle attempts, answers, and time spent.
- AI tutor chat messages (used to provide tutoring and improve responses).
- Diagnostic test results and mastery scores.
- Streak data, daily goals, and gamification progress.
Billing Information
Payment processing is handled by Stripe. We do not store credit card numbers — Stripe tokenizes all payment data. We retain records of subscription status and transaction history.
Technical Data
- IP address (used for rate limiting and security).
- Browser type and device information (collected automatically).
- Usage logs for debugging and security monitoring.
How We Use Information
- To provide and personalize the educational experience.
- To track progress and generate performance insights.
- To process payments and manage subscriptions.
- To send account-related emails (verification, password resets, progress digests).
- To prevent abuse, fraud, and unauthorized access.
- To improve our curriculum and AI tutor quality.
Children's Privacy (COPPA)
Codebusters AI Tutor is designed for Science Olympiad students, many of whom are under 13. We comply with COPPA requirements:
- Parental consent: For students under 13, we require verifiable parental consent before collecting personal information. Parents may create and manage accounts on behalf of their children.
- Limited data collection: We only collect information necessary for the educational service — name, email, grade, and practice progress. We do not collect geolocation data, photos, or social media connections.
- Parent data rights: Parents may review, update, or request deletion of their child's data at any time by contacting hello@coachingdad.com.
- No third-party advertising: We do not display behavioral advertising or share children's data with advertising networks.
- AI tutor interactions: Chat messages with the AI tutor are used to generate responses in real time. We retain conversation logs for quality improvement but do not share them with third parties.
Data Sharing
We do not sell or rent user data. We share data only with:
- Stripe — for payment processing (payment data only).
- Cloudflare — for bot protection and CDN services.
- Email provider — for transactional email delivery.
- AI/LLM provider — chat messages are sent to our configured LLM endpoint to generate tutor responses.
We may disclose information when required by law or to protect the rights, safety, or property of our users.
Data Retention
We retain account and practice data for as long as your account is active. You may request account deletion at any time, which will permanently remove your personal data and practice history within 30 days. Anonymous usage statistics may be retained for analytics.
Your Rights
- Access: You can view your data through the dashboard.
- Correction: You can update your profile at any time.
- Deletion: You can request account deletion by emailing us.
- Export: You can request a copy of your practice data.
- Opt-out: You can unsubscribe from non-essential emails.
Security
We use industry-standard security measures including bcrypt password hashing, JWT-based authentication with refresh token rotation, HTTPS encryption in transit, rate limiting, bot protection (Cloudflare Turnstile), and disposable email blocking. Practice data is stored in a managed database with access controls.
Contact
For privacy questions, data requests, or COPPA-related inquiries, contact us at hello@coachingdad.com.
Changes to This Policy
We may update this privacy policy as our service evolves. Material changes will be communicated via email to registered users. The "last updated" date above reflects the most recent revision.