Privacy

1. Our Privacy Principles

This App is built around five commitments that shape every decision we make about student and teacher data.

• Collect the minimum. We do not ask students for names, email addresses, birth dates, government IDs, school IDs, or any other identifying information. Each student's activity is linked only to a randomly generated session code.
• Never sell, never share, never advertise. We do not sell student or teacher data, share it for any party's marketing or advertising purposes, or use it to build cross-site profiles. There are no advertising trackers or analytics cookies in this App.
• Use data only for the educational program. Information is used solely to deliver the lesson, let teachers see how their class is doing, and improve the program. No other commercial purposes.
• Comply with FERPA, COPPA, and California law. The App is designed around the federal Family Educational Rights and Privacy Act, the Children's Online Privacy Protection Act, and California's Student Online Personal Information Protection Act (SOPIPA).
• De-identify data when a class ends. Free-text student responses are automatically scanned and redacted of personal information, and the link between responses and any student session is permanently broken, when a class is deactivated.

2. Who We Are

This Privacy Policy covers the SFOA Sustainable Technology Career Videos web application (the "App"). The App is operated by the Sustainable Future Outdoor Academy (SFOA), which is responsible for all data collected through the App. SFOA collaborates with industry organizations (each a "Partner Company") that contribute career content and subject-matter expertise to the program; Partner Companies do not control, receive, or process student or teacher data through this App. The App delivers career education content about sustainable technology jobs to K–12 students and their teachers.

3. Scope

This policy applies to:

• The teacher portal (instructor guide and class dashboard)
• The student lesson portal
• The embedded career interest quiz
• The embedded climate quiz

This policy does not apply to external sites linked from the App (such as Vimeo or sfoa.earth), which have their own privacy policies.

4. What Information We Collect

From Students

The App is designed to collect the minimum data necessary for its educational purpose. No student is asked for their name, email address, birth date, government ID, or school ID number.

From Teachers

Information We Do Not Collect

This App does not use third-party advertising trackers, behavioral analytics, fingerprinting, cross-site tracking pixels, or social-media plugins. We do not collect device identifiers, location data, contacts, photos, or biometric information. The only cookies set by the App are functional cookies required by the teacher login system; no advertising or analytics cookies are placed.

5. How We Use Information

All data collected by this App is used solely for the educational program's stated purposes:

• Student data supports the lesson flow (progress gating), lets teachers monitor class participation, and gives students a summary of their own responses at lesson completion. After de-identification, aggregated response data may be used to improve the program (for example, identifying which lesson activities prompt the strongest reflections).
• Teacher data is used for authentication, account management, and audit logging required by FERPA.

We do not use any of this information for:

• Targeted or behavioral advertising
• Building profiles of students for non-educational purposes
• Selling, renting, or commercially sharing data with anyone
• Training third-party machine learning or AI models

6. How We Share Information

We do not sell or share student or teacher data with any third party for commercial purposes. We rely on the following service providers to operate the App; each is bound by contract and applicable law to use the information only to provide its service to us.

Supabase

Student and teacher data is stored and processed by Supabase, Inc. (San Francisco, CA, USA) on servers located in the United States. Supabase provides our database, authentication, and serverless function infrastructure. SFOA has entered into a Data Processing Addendum (DPA) with Supabase.

Vercel

The App's static files (HTML, CSS, JavaScript) are served through Vercel, Inc. Vercel delivers file assets to users' browsers; it does not store student or teacher personal data from the application itself.

Vimeo

The App embeds instructional videos hosted by Vimeo, LLC. When a video is played, the browser establishes a direct connection to Vimeo's servers; Vimeo receives network-level metadata (such as IP address and browser type) as a result of that connection. All Vimeo embeds in the App use the dnt=1 (Do Not Track) parameter, which instructs Vimeo to suppress behavioral tracking and analytics cookies. Vimeo does not receive student names, session IDs, quiz scores, or any other education records from this App.

Self-hosted assets

All JavaScript libraries and web fonts used by this App are self-hosted, meaning they are served directly from our own infrastructure and do not cause browsers to make requests to third-party CDN providers.

When We May Disclose Information

We may disclose information when required to do so by law (subpoena, court order, or other legal process), to investigate or address suspected fraud or security incidents, or to protect the rights, property, or safety of SFOA, our users, or the public.

7. Children's Privacy (COPPA)

This App is designed to be used in K–12 classroom settings, and it is intended that some users will be under the age of 13. We take the privacy of children seriously and have designed the App to comply with the Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312).

How we limit collection from children

• No student — at any age — is asked for their name, email address, or any other personally identifying information.
• Each student is identified only by a randomly generated session code that cannot be traced back to them.
• No targeted advertising, behavioral profiling, or third-party tracking is performed.
• No persistent identifier follows a student across sessions, devices, or websites.

Parental consent through the school

COPPA allows schools to provide consent on behalf of parents for educational technology used in the classroom (FTC COPPA FAQ Section M). When a teacher creates a class and indicates that some students are under 13, the teacher provides a consent attestation under 16 CFR §312.5 on behalf of the school. No class with under-13 students is activated without this attestation on record.

Parental rights

Parents and guardians of children under 13 have the right to:

• Review what information has been collected from their child
• Refuse to allow further collection or use of their child's information
• Request deletion of their child's information

To exercise any of these rights, contact SFOA using the information in Section 13. Because we do not collect names, you will need to identify your child's class and approximate participation date, and we will work with the classroom teacher to locate the relevant session record.

8. Student Records and FERPA

This App is provided as a service to participating schools and operates under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. §1232g; 34 CFR Part 99).

School officials exception

SFOA acts as a "school official" with a legitimate educational interest when delivering this program, as authorized under 34 CFR §99.31(a)(1). The classroom teacher, acting in an official school capacity, authorizes the collection of student response data when creating a class. The data we process is treated as an "education record" subject to FERPA's protections. Partner Companies do not act as school officials under this exception because they do not receive any education records through the App.

Pseudonymous coding

Student records in this App are linked only to a randomly generated session code. This pseudonymous coding model is expressly permitted under 34 CFR §99.31(b) and means that no personally identifiable information about students is ever stored or transmitted.

FERPA rights

FERPA gives eligible students and parents or guardians of students under 18 the right to:

• Inspect and review education records maintained about the student
• Request amendment of records believed to be inaccurate, misleading, or in violation of the student's privacy rights
• Consent to disclosures of personally identifiable information, except where FERPA authorizes disclosure without consent (such as the school officials exception applicable to this App)
• File a complaint with the U.S. Department of Education's Family Policy Compliance Office (FPCO) if FERPA rights have been violated

To exercise any of these rights, submit a written request to the contact in Section 13. We respond within 45 days as required by 34 CFR §99.23.

Locating a specific record: Because records are linked only to a randomly generated session code rather than a name, you will need to provide that session code (displayed at the start of the lesson) or ask the classroom teacher to identify it from their dashboard.

To file a complaint with the Family Policy Compliance Office: studentprivacy.ed.gov

9. California Privacy Rights

This App is operated in California and the majority of its users are California residents. This section explains how California state law applies to the program.

Student Online Personal Information Protection Act (SOPIPA)

SFOA acts as an "operator" under California Education Code §22584 (SOPIPA). In accordance with that law, we commit that we do not, and will not:

• Engage in targeted advertising directed to K–12 students based on information acquired through this App
• Use information collected through the App to build a profile of a K–12 student for any purpose other than K–12 school purposes
• Sell or rent a student's information
• Disclose covered information except as permitted by SOPIPA

We delete a student's covered information when a class is deactivated (see Section 10), and we maintain reasonable security procedures to protect that information.

California Consumer Privacy Act (CCPA / CPRA)

The CCPA (and its CPRA amendments) applies to for-profit businesses meeting specific revenue or data-volume thresholds. SFOA operates this program under the fiscal sponsorship of a 501(c)(3) nonprofit organization. Per California Attorney General guidance, the CCPA generally does not apply to nonprofit organizations. We nevertheless voluntarily commit to the substantive standards the CCPA would impose:

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• We do not use sensitive personal information for any purpose beyond what is described in this policy.
• Because no sale or sharing occurs, there is no opt-out mechanism to provide. There is nothing to opt out of.

Separately, information that constitutes an "education record" under FERPA is in any case exempt from the CCPA's definition of personal information (Cal. Civ. Code §1798.145(j)).

California residents who wish to ask questions about their data or exercise any rights described elsewhere in this policy may contact us using the information in Section 13.

California data breach notification

California Civil Code §1798.82 applies to any business or person (nonprofit or for-profit) that holds personal information about California residents. If a security incident affecting unencrypted personal information of California residents occurs, SFOA will provide notification consistent with §1798.82 and any other applicable state breach notification laws.

10. Data Retention and Deletion

Active classes

Student activity data (session IDs, quiz scores, written reflections, survey responses, and step progress) is retained for the duration of an active class so that teachers can monitor participation and students can view their own responses at lesson completion.

Deactivation

A teacher may deactivate a class at any time. Deactivation disables the class code so no new students can join, and the class is marked with a deactivation timestamp. Existing student data remains visible in the teacher's dashboard during a grace period (see below) so the teacher can review responses, export records, or recover from accidental deactivation.

De-identification (scrub)

De-identification of student data occurs in one of two ways:

• Manual delete. After deactivation, the teacher may choose "Delete Class Data" from the dashboard to immediately scrub the class.
• Automatic 30-day purge. Any class that has been deactivated for 30 days is automatically scrubbed by a scheduled process.

When a scrub runs (whether manual or automatic), the following steps occur:

1. Free-text fields (written reflections and survey responses) are scanned for personal information patterns — including email addresses, phone numbers, URLs, social handles, government identifiers, payment card numbers, dates, street addresses, ZIP codes, and contextual name mentions — and any matches are replaced with [REDACTED].
2. The pseudonymous session ID is removed from all response and survey records, breaking the link between any individual response and even the pseudonymous session.
3. All session ID records for that class are permanently deleted from the database.
4. The class is marked as deleted and removed from the teacher's dashboard.

After the scrub, the remaining de-identified response data (no longer linked to any session ID or individual) may be retained indefinitely for aggregate analysis of program effectiveness, consistent with FERPA §99.31(b)(1).

Teacher accounts

Teacher name and email address are retained for as long as the account remains active. To request account deletion, contact us at the address in Section 13. We process account deletion requests within 30 days of receipt.

Audit log

Security and FERPA compliance audit log entries (teacher logins, data exports, class creation and deactivation) are retained for a minimum of 3 years.

11. Security

SFOA maintains reasonable administrative, technical, and physical safeguards to protect the information collected through this App. Key technical controls include:

• Encryption in transit. All connections to the App use HTTPS / TLS.
• Encryption at rest. Data stored in our Supabase database is encrypted at rest by the provider.
• Row-Level Security (RLS). Database access policies ensure each teacher can read only the data belonging to their own classes; one teacher cannot access another teacher's student records.
• Multi-factor authentication. Teacher logins are protected by email one-time-password (OTP) multi-factor authentication.
• Session timeouts. Teacher sessions automatically expire after 120 minutes of inactivity.
• Audit logging. All teacher logins, data exports, class creations, and class deactivations are recorded in an audit log retained for at least 3 years.
• Rate limiting and abuse protections. Class code attempts and account registration are rate-limited to prevent enumeration and credential-stuffing attacks.
• Self-hosted dependencies. JavaScript libraries, fonts, and images are served from our own infrastructure rather than third-party CDNs, eliminating an entire category of supply-chain and tracking risks.
• Automatic PII redaction. Free-text student responses are scanned and redacted of personal information patterns whenever a class is de-identified.
• Incident response. SFOA maintains a written incident response plan covering detection, containment, notification, and post-incident review for any suspected security event.

No security program is perfect. If you become aware of a security concern with this App, please contact us at the address in Section 13.

12. Your Rights and Choices

This section summarizes the rights available under each applicable law and how to exercise them. Detail for each right is in the section noted.

To exercise any of these rights, write to the contact in Section 13. We respond to written requests within 45 days as required by FERPA, and sooner where another applicable law requires.

13. Contact Us

For questions about this privacy policy, to submit a data access or deletion request, or to report a privacy concern:

To file a FERPA complaint with the U.S. Department of Education: studentprivacy.ed.gov

14. Changes to This Policy

If we make material changes to this policy, we will update the effective date at the top of this page. We encourage teachers and parents to review this policy periodically. For changes that materially affect collection practices for students under age 13, participating teachers may be asked to re-attest the COPPA consent at class creation (see Section 7), consistent with 16 CFR §312.10.