Privacy Policy

NSF CURE SBP is an educational platform operated as part of an NSF-funded research and curriculum project at California State Polytechnic University, Pomona. This policy explains what information we collect when you use the site, how we use it, and the choices you have. It applies to all pages served under this domain.

We do not sell personal data, and we do not load third-party advertising or tracking scripts.

We collect only what's needed to run the platform:

• Account information — name, email address, and the password hash used to sign you in.
• Participant profile — optional fields such as participant type, organization, project role, and demographic indicators (e.g. first-generation or transfer student) that you choose to provide. These support NSF research reporting.
• Classroom membership — which classrooms you've joined and the join codes you've used.
• Learning activity — lessons completed, quiz attempts, and your current and longest streak.
• Technical data — basic server logs (IP address, timestamp, request path) generated automatically when you load a page, used for security and debugging.

• To keep you signed in and to show your progress across sessions.
• To allow instructors and administrators to see student progress within their own classrooms.
• To produce aggregated, de-identified statistics for NSF reporting (e.g. participant counts, completion rates).
• To investigate abuse, security incidents, and bugs through server logs.

We do not use your data to train external AI models, and we do not share it with advertising networks.

• You — you can review the data we have on file at any time on your data transparency page (sign-in required).
• Instructors and administrators — staff for the classrooms you join can see your name, email, and your progress within those classrooms.
• The project team and authorized NSF reviewers — may access data in aggregate form for evaluation and reporting purposes.
• Service providers — our hosting provider (Railway) and database provider process data on our behalf under their own security and confidentiality terms. They do not use your data for their own purposes.

Data is stored in a managed PostgreSQL database hosted in the United States. Application traffic is served over HTTPS, and passwords are stored only as salted hashes — never in plain text.

We use a small number of strictly necessary cookies:

• Session cookie — keeps you signed in across pages.
• UI preference cookies — remember small choices such as whether your sidebar is open and whether you've dismissed the cookie notice.

We don't use third-party analytics, advertising, or social-media tracking cookies. Because these cookies are required for the site to function, there's no opt-out — but you can clear them at any time from your browser's settings.

Account and learning-activity data is kept while your account remains active and for as long as needed for NSF research reporting. Server logs are retained for a short rolling window (typically under 30 days) for security and debugging.

If you would like your account deleted, contact us at the address below and we'll remove personally identifying fields. Aggregated, de-identified statistics already included in published reporting cannot be reversed.

You can:

• Access the personal data we store about you on your data transparency page.
• Correct profile fields from your account settings.
• Delete your account by emailing the address below.
• Ask questions about how your data is used, including for residents of California (CCPA/CPRA) and other jurisdictions with similar rights.

The platform is built for university-level coursework and is not directed at children under 13. We don't knowingly collect data from children under 13. If you believe a minor has created an account, contact us and we'll remove the account.

We may update this policy as the platform evolves. Material changes will be reflected in the "Last updated" date at the top of this page, and where appropriate we'll surface a notice in the app.

Questions about this policy, or requests related to your data, can be sent to sbp@cpp.edu. You can also reach the project team through the contact page.