What we do with your students' data.

1. What Gregarious does with student data

Student data in Gregarious is used for exactly one purpose: improving the educational experience of the student who generated it and supporting the educators and parents who serve them.

We collect:

• •Account information: display name, email address, role, and grade level.
• •Mastery activity: which standards were practiced, how many questions answered, scores earned, and session timing. This powers the adaptive engine.
• •Studio work: project titles, descriptions, and any written or creative content students produce. Visible only to the student, their teacher, and their linked parent.
• •Pulse check-ins: a daily mood indicator (emoji selection) and optional short text. Shown in aggregate to the student's teacher. Never shared outside the classroom.
• •Usage patterns: pages visited, features used, session length. Used to improve the product and for anonymized dissertation research. Never tied to a student's name in any published report.

We do not collect biometric data, device identifiers, location data, or any information unrelated to the student's learning activity.

2. Is student data sold?

We also do not use student data to show advertising, build commercial profiles, or train AI models without explicit opt-in consent from a parent or eligible student.

3. How is AI used?

AI in Gregarious serves three functions: Socratic tutoring, scoring assistance, and content generation for teachers. Here is what that means in practice.

• •Socratic tutor: When a student is stuck, the AI asks questions rather than giving answers. It never writes essays, answers comprehension questions for students, or completes assignments on their behalf.
• •Scoring assistance: AI scores open-response questions against a rubric. A human teacher reviews the AI's score for high-stakes items. See /trust/ai for a full breakdown.
• •Teacher tools: AI generates worked examples, reasoning scaffolds, and reflection prompts at a teacher's request. Teachers review all AI-generated content before it reaches students.

Student names and personally identifiable information are stripped from every AI call before it leaves the platform. The AI receives anonymized text only. Every student-facing AI interaction routes through an internal safety-wrapper layer (safety-wrapper.js) that enforces the Socratic posture, filters input, redirects self-harm or abuse disclosures toward a trusted adult, and blocks unmoderated AI image generation in the student experience.

For full documentation of every AI touchpoint, see /trust/ai.

4. Who can see my child's data?

Access is strictly role-scoped. A student cannot see another student's data. The following people can see a student's record:

5. How does deletion work?

Schools, parents, and eligible students have the right to request deletion of a student account and all associated data.

• •Email cgb003@gmail.com from the school's official address (or a parent's email on file).
• •Include the student's display name and the school name.
• •We will confirm receipt within 2 business days.
• •Deletion is completed within 30 days of the confirmed request.
• •You will receive a confirmation email when deletion is complete.

Anonymized, aggregate research data that cannot be linked back to any individual may be retained under IRB protocol #2025-0847 for dissertation purposes. This data has no name, email, or school identifier attached.

You may also request a full export of your child's data before requesting deletion. We will provide a CSV within 5 business days.

6. What happens if there's a breach?

In the event of a confirmed data breach affecting student records:

• •We will notify affected schools and parents within 72 hours of discovery.
• •Notification will include: what data was affected, when the breach occurred, and what we have done to contain it. We will also tell you what you should do.
• •Supabase handles encryption at rest (AES-256) and in transit (TLS 1.2+). Breach response is covered under Supabase's SOC 2 Type II certification.
• •We will file all required notifications under applicable state and federal law.

If you discover a security vulnerability, please report it to cgb003@gmail.com before public disclosure. We take responsible disclosure seriously and will respond within 48 hours.

7. Subprocessors

Gregarious uses the following third-party services. Each is subject to a data processing agreement, and each was selected in part for its privacy posture.

We do not use advertising networks, behavioral tracking pixels, or social media SDKs anywhere in the student-facing platform.

8. For district IT teams

Gregarious is designed for FERPA compliance. Student education records are accessible only to the student, their teacher, and their linked parent. We act as a school official under the school's direction and do not own student data.

If your district has a student data privacy addendum (SDPA) template, send it to cgb003@gmail.com and we will review and sign it.

9. Questions we don't yet have full answers to

We would rather be honest about our current state than obscure it. If one of these gaps is a blocker for your district, reach out and we will talk through it.