Privacy policy

Information we collect

• Teacher accounts: Google sign-in name, verified email address and unique Google account identifier (the “sub” value), together with your teacher profile, preferred display name, time zone and optional school or organization. Google sign-in is used to identify you and connect you to your workspace. Courseframe does not receive or store your Google password.
• Student registration: the student’s name supplied during registration or by a teacher, verified Google email used for sign-in, parent email, group membership and registration approval status. A teacher reviews pending registrations before granting access to the class.
• Teaching records: course and group details, student rosters, Zoom meeting links, lecture titles and dates, participant names and remembered Zoom-name matches, join and leave events, camera on/off events, and calculated attendance and camera-on durations. Attendance records describe participation and camera state.
• Materials and assessments: uploaded PDFs, page images and cropped questions, extracted text and search representations of materials, quiz questions and answer keys, student answers, submissions, scores and result-email records.
• Tutor conversations: student questions, conversation history, generated answers and the course materials referenced in answers.
• Operational information: sign-in sessions, connection credentials, request and error logs, and technical information such as IP addresses and browser details that the application or hosting providers may process to deliver and protect the service.

How information is used

We use this information to sign users in, keep teaching workspaces separate, manage registrations and rosters, calculate attendance, deliver and grade quizzes, send teacher-requested results to parents, and provide the course-based tutor. Information is also used to respond to support requests, diagnose problems, prevent misuse and meet applicable legal obligations.

Courseframe does not sell personal information or use Google user data for advertising. Courseframe does not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models, and does not transfer Google user data to third-party AI or machine-learning services. AI providers’ processing of teacher-uploaded course content is described separately below.

Google sign-in and optional Classroom access

Google sign-in identifies teachers and students. Connecting Google Classroom is a separate, optional teacher action. With your authorization, Courseframe uses Classroom course and roster permissions to create Classroom courses for your groups and invite students when you approve their registrations. You can also choose individual Classroom classes to import into an existing Courseframe course. For the classes you select, Courseframe imports and stores class details and student roster names and email addresses in your teacher workspace, together with mappings between the Classroom class and Courseframe group. Student email addresses are used for sign-in and enrollment matching. Importing a class does not send invitations and does not import parent email addresses. The connection stores the connected teacher email, authorization credentials and Classroom identifiers needed for these features.

Courseframe’s use and transfer of raw or derived user data received from Google APIs, including Google Workspace APIs such as Google Classroom, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features described in this section. We do not use it for advertising, do not sell it, do not transfer it to others except as needed to provide these features, comply with law or protect security, and do not allow humans to read it except with your consent, for security or legal purposes, or when it is aggregated and anonymized for internal operations.

Google user data, including Classroom class details, roster names and email addresses, and Google account information, is never included in requests to AI services and is not used to train AI or machine-learning models.

You can disconnect Classroom in Courseframe Settings or remove Courseframe’s access through your Google Account connections. Disconnecting immediately deletes the stored Classroom authorization credentials and connected teacher email, and stops all further Classroom access. It does not automatically delete Courseframe teaching records, Classroom courses or invitations already created; you can delete those as described under Retention and deletion.

AI tutor and uploaded course content

When the tutor is enabled, Anthropic’s Claude API processes questions and generates answers. Requests can include the question, prior conversation turns, course details, material titles and relevant excerpts. Scanned PDF page images may also be sent to Claude for text extraction.

Search embeddings are generated locally on Courseframe’s server. Courseframe does not send material text or student questions to Google or another hosted embedding API for this step. Local processing still takes place on Courseframe’s hosting infrastructure.

The tutor does not automatically add your roster name, sign-in profile, email address or parent email to AI requests. Personal information you include in a question, conversation or uploaded material may still be sent to Anthropic. Please avoid sharing private personal information.

Teachers can view their students’ tutor conversations. AI answers can be incorrect; check important details with your teacher and course materials. Anthropic’s processing is governed by its applicable service terms and privacy policy. Earlier versions used Google’s Gemini API for answers, text extraction and embeddings; changing providers does not itself delete information previously processed by a provider.

Who information is shared with

Teachers can access the student records and conversations in their teaching workspace. Students access the learning activities their teacher makes available to them. Parents may receive quiz results at the address provided for the student when a teacher sends those results.

Courseframe uses service providers for the features below. Which providers process a record depends on the features in use:

• Railway: hosting for the public site and, when the teaching application is enabled, infrastructure used to store and process service data.
• Google Identity and Google Classroom: account verification and, when connected, selected class and student-roster imports, course creation and student invitations using relevant teacher, group and student information. Imported roster names and email addresses are stored in the teacher’s Courseframe workspace; importing itself sends no invitations and imports no parent email addresses. See Google’s Privacy Policy.
• Recall.ai: the attendance bot receives the Zoom meeting link and processes meeting participant information and attendance events.
• Anthropic: Claude processes tutor questions, conversation context, course excerpts and scanned material pages, as described above.
• Resend: delivery of teacher-requested parent-result emails, including the recipient address, student name, quiz title, score and question-level results.

Providers may process information in countries other than your own, depending on their infrastructure and service arrangements. Information may also be disclosed where needed to comply with applicable law or address fraud, abuse or security incidents.

How we protect your data

We use the following technical safeguards to protect personal information, including Google account information, Classroom data, student records and connection credentials:

• Encryption in transit: the public Courseframe application uses HTTPS to encrypt information sent between your browser and our service. Connections from our backend to Google’s authorization and Classroom API endpoints also use HTTPS.
• Protection of connection credentials: Google Classroom refresh tokens are encrypted before being stored in our database. The encryption key is held in server configuration separately from the stored token records. Google client secrets and Classroom refresh tokens are used by the backend and are not sent to the browser.
• Account and record access controls: the backend verifies Google sign-in and checks the signed-in teacher’s workspace before allowing access to its teaching records. Student access to quizzes and tutor activities is checked against the relevant course or group roster and approval status.
• Protected sessions: teacher sign-in uses session cookies marked Secure, HttpOnly and SameSite on the public service. These settings restrict cookie transmission and access from page scripts. The backend stores a hash of the session token, checks session expiry and enforces an inactivity timeout.
• Protection of account actions: authenticated teacher actions that change data require a session-linked anti-forgery token and a matching request origin, helping prevent another website from making those requests on your behalf.

No online service can guarantee absolute security. Keep your Google account secure and report suspected unauthorized access to islam.amin099@gmail.com. Do not include passwords or authorization tokens in your report.

Cookies and account security

Courseframe uses necessary cookies and sign-in state to maintain teacher sessions, complete Google authorization and protect account actions. Google’s sign-in services may use their own cookies. Blocking necessary cookies may prevent sign-in or connected features from working. Courseframe does not use advertising cookies.

Retention and deletion

We keep teaching records, including Google data imported from Classroom, only while the teacher’s account and the related course remain active, or until the teacher deletes them. Classroom authorization credentials are kept only while Classroom is connected and are deleted as soon as it is disconnected.

Teachers can delete courses, groups, students, quizzes and materials in Courseframe at any time. Deleting a course also deletes its groups, rosters (including imported Classroom roster data), attendance, quizzes, answers and tutor history. Deletion from our active database takes effect immediately.

To delete a teacher account and all associated data, email islam.amin099@gmail.com from the account’s email address. We will complete the deletion within 30 days and confirm when it is done. Students and parents can request deletion of a student’s records the same way. Where the law requires us to keep specific information for longer, we will say what we keep and why.

Your choices and privacy requests

You can update your teacher profile in Settings and choose whether to connect Classroom. Students and parents can ask their teacher to correct classroom records, or contact us directly for help.

To request access, correction or deletion of personal information, email islam.amin099@gmail.com. Identify the account or class concerned and describe your request. We may need to verify your identity or authority to act for a student before sharing or changing records. Do not send passwords or Google authorization tokens.

Students and minors

Student participation is managed through teachers and, where appropriate, parents or guardians. Teachers are responsible for providing appropriate notices and obtaining any permissions needed for their students’ use of attendance tools, quizzes and AI tutoring. Courseframe does not provide an age-verification or parental-consent workflow. Parents or guardians with concerns about a child’s information can contact the teacher or the privacy contact below.

Changes to this policy

We may update this policy as the service or its data practices change. Updates will appear on this page with a revised effective date. Where required, we will provide additional notice or seek permission before using information in a new way.