How we handle student and teacher information
Privacy Policy
Mistake Master is used by students in classrooms. That places a high bar on what we collect and what we do with it. This page states plainly what we hold, why we hold it, how long we keep it, and how a school can get it back or have it deleted.
Effective July 25, 2026 · Last updated July 25, 2026
The short version. We use student information only to provide the educational service. We never sell it. We never use it for advertising, and we never build advertising or marketing profiles of students. We collect only what the service needs and nothing more. Schools, and parents through their school, can review, correct, and delete a student's information at any time.
1. Who we are
Mistake Master ("Mistake Master," "we," "us") is a free educational practice platform operated by Mistake Master LLC, an Illinois limited liability company. You can reach us about privacy at privacy@mistakemaster.com.
We provide misconception-targeted diagnostics and remediation for students, and a dashboard that helps teachers see which concepts a class has not yet mastered.
2. Our promises up front
We make the following commitments about student information. These are the baseline protections required of education service providers under the student-privacy laws enacted in most states, and we hold to them regardless of where a school is located.
- We use student information only to provide the educational service.
- We never sell student information.
- We never use student information for advertising, and we never build advertising or marketing profiles of students.
- We collect only the student information needed for the educational service, and nothing more.
- Schools, and parents through their school, can review, correct, and delete a student's information.
3. Accounts and roles
Teachers hold accounts. A teacher signs in, creates a class, and gets a class code.
Students do not hold accounts. A student opens a class code, enters their first and last name, and begins practicing. Students do not provide an email address and do not create a password.
4. Information we collect
| Source | What we collect | Why |
|---|---|---|
| Teachers | Email address and name. Optional school or organization name. | To create and secure the account. |
| Students | A display name (first and last name) entered when joining a class, and the class code used to join. | So a teacher can tell whose work is whose. |
| Practice activity | Questions attempted, answers chosen, misconceptions triggered and cleared, scores, and timestamps. | To adapt practice and show a teacher what the class has not yet mastered. |
| Technical | Standard server and security information, such as browser type and a transient IP address. | Security and abuse prevention. We do not retain IP addresses beyond what security requires. |
We do not ask students for any information beyond their name, and we do not knowingly collect more than is needed to run the service.
5. How we use information
We use the information above only to:
- Deliver diagnostics, lessons, and practice to students.
- Track which misconceptions a student has cleared, so practice adapts.
- Show a teacher which concepts their class has and has not mastered, and which students to support.
- Maintain security, prevent abuse, and fix problems.
We do not use student information for any commercial purpose unrelated to the educational service.
6. The legal basis for student information
Mistake Master is intended for use in schools under the direction of a teacher. When a school or teacher directs students to use Mistake Master, the school provides consent on behalf of parents for the collection of student information for educational purposes, consistent with the Children's Online Privacy Protection Act (COPPA) school-consent framework and with the Family Educational Rights and Privacy Act (FERPA).
We act as a service provider to the school. The school controls the student information, and we process it only on the school's behalf and only for the educational purposes described here.
We do not knowingly collect personal information from a child under 13 except through a school that has authorized that use.
7. How we share information
We do not sell student information and we do not share it for advertising.
We use a small set of service providers ("sub-processors") to run the platform. They may process information only to provide their service to us, under terms that protect the data.
| Provider | Purpose | Student data |
|---|---|---|
| Supabase | supabase.com — application database and teacher authentication. | Yes |
| Netlify | netlify.com — static website hosting and delivery. | Transient only |
| GoatCounter | goatcounter.com — aggregate visit counts. Cookieless. Stores computed totals only; raw IP addresses and browser user-agent strings are never written to its database, and no persistent identifier is set. | None |
On analytics. We do not use Google Analytics or any advertising-network analytics. Our analytics provider cannot identify an individual visitor, sets no cookies, and never receives student names, class codes, or practice results — none of which ever appear in a page address.
We may disclose information if required by law, or to protect the rights and safety of users and the public. We maintain a current list of sub-processors and will provide it to schools on request.
8. How long we keep information
- Teacher account information is kept while the account is active.
- Student information is kept while the class is active and the student is using the service.
- Student information is deleted 12 months after the student's last activity, or sooner at the request of the school.
- A teacher can delete a class, which deletes the associated student information.
9. Your rights and choices
A school, or a parent through their school, may ask us to:
- Review the information we hold about a student.
- Correct inaccurate information.
- Delete a student's information.
To make a request, contact privacy@mistakemaster.com. We will respond within 30 days, and we verify that a request comes from the school or an authorized party before acting on it.
10. How we protect information
We protect information with measures including encryption in transit (HTTPS) and encryption at rest, access controls that limit each teacher to only their own classes, least-privilege access for our systems, and monitoring for abuse. No system is perfectly secure, but we work to protect student information and to meet applicable security requirements.
11. Data breaches
If a security incident affects student information, we will notify the affected school without undue delay and consistent with applicable law, and we will cooperate with the school's own notification obligations.
12. State student-privacy laws and data privacy agreements
Most states have enacted student-privacy laws that apply to education service providers, including California's Student Online Personal Information Protection Act (SOPIPA) and New York Education Law 2-d. We comply with the laws applicable to the states where our users' schools are located.
Where a school or district requires a data privacy agreement before sharing student information, we will enter into one. We support the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement and can sign a district's required agreement.
13. Changes to this policy
If we make a material change, we will update the date at the top of this page and notify schools through a reasonable means before the change takes effect for student information.
14. Contact
Questions about this policy, or about a particular student's information:
Mistake Master LLC, an Illinois limited liability company