Privacy Policy

Summary

• Global CyberSafe Academy is a free, nonprofit learning site for children and teens (about ages 5 to 18), run by Global CyberSafe, a 501(c)(3) nonprofit in Ogden, Utah.
• A parent or legal guardian creates the account and gives consent before a child can use it. Children never give us an email address or password.
• We collect only what we need to teach: a first name or nickname, birth year, grade band and learning activity.
• We do not sell personal information, show ads, or use advertising or analytics trackers in the Academy.
• The AI tutor and AI hints are off unless a parent turns them on. The rest of the Academy works without them.
• Parents can see, download or delete their child’s information at any time from their dashboard, or by writing to info@globalcybersafe.org.

Who we are and how to reach us

The Academy is operated by:

Global CyberSafe (501(c)(3) nonprofit)
965 N 975 E
Ogden, UT 84404
USA
info@globalcybersafe.org

Our privacy officer (the person in charge of the protection of personal information, including for Quebec’s Law 25) is Popol Elonda, reachable at info@globalcybersafe.org or at the address above. This policy covers the Academy only. Our main website has its own policy at https://globalcybersafe.org/privacy.html; unlike the main website, the Academy uses no Google Analytics or other analytics tools.

Notice to parents (COPPA direct notice)

The U.S. Children’s Online Privacy Protection Act (COPPA) requires us to tell you, before we collect personal information from a child under 13, what we collect and how you stay in control. Here it is in short:

• What you give us: your email, password, and name; and for your child, a first name or nickname, birth year, grade band, avatar and language. We use your email only to run your account (sign-in, password reset, important notices about this policy or your child’s account).
• What your child gives us while learning: lesson progress, quiz answers and scores, math practice answers (including timing and the type of mistake), points and coins, certificates, friend connections, emoji reactions, math problems your child writes, and — only if you turn on AI — the questions your child types to the AI tutor or hint helper.
• Why: to provide lessons and practice, save progress, show you progress reports, keep the service safe, and nothing else. We do not use it for advertising or profiling.
• Who else receives it: only service providers that host or run the Academy for us (listed below). If you turn on AI, your child’s typed questions are sent to Anthropic to generate an answer. We never make your child’s information publicly available. Inside the Academy, your child’s nickname and avatar can be seen by family members, by friends you approve, and by anyone you give your family code to (see “Social features”).
• Your consent: your child’s profile stays inactive until you give consent. If you never give consent, we delete the profile within 30 days.
• Consent to collection without disclosure: you can let your child use the Academy without allowing any disclosure to third parties other than those needed to run the service. In practice, this means leaving the AI tutor turned off — it is a separate, optional choice.
• Your rights: you may review your child’s information, have it corrected or deleted, download a copy, and refuse to allow any further collection or use. See “Your rights and how to use them.”
• We will not ask a child for more information than is reasonably needed to take part in an activity.

Information we collect

How we use information

• To provide lessons, quizzes, math practice, games, certificates and (if enabled) AI help.
• To adapt practice to your child’s level and show you progress.
• To run social features safely (parent approval of friends, admin review of posts and kid-written problems).
• To keep the service secure, prevent abuse, and keep proof of consent.
• To contact parents and teachers about their account or changes to this policy. We do not send marketing to children.
• To meet legal obligations.

Social features and what other users can see

• Family code: anyone who enters your family code sees your children’s display names and avatars so they can pick a profile; signing in still needs the PIN. Share the code only with your household.
• Friends: a child can send a friend request with another child’s friend code. The connection is only made if the recipient’s parent approves it on their dashboard. Friends see each other’s display name and avatar and can start math challenges. There is no free-text chat between children.
• Races and battles: results show display names and scores to the children taking part.
• Culture Exchange: teachers publish posts after our team reviews them. Children can only react with a fixed set of emoji. Children cannot post, comment, see call links, or join a video call themselves (see “Live classroom video exchanges”).
• Certificate verification: each certificate carries a random code. Anyone who has that code (for example, because you shared a printed certificate) can confirm it on our public verification page at academy.globalcybersafe.org/verify. That page shows only the achievement title, the date it was issued, “Issued by Global CyberSafe Academy” and the first initial of your child’s display name (for example, “T.”) — never the full name, grade, avatar, school or family details. Verification pages are not indexed by search engines, and lookups are rate-limited.
• Apart from the certificate verification page described above, nothing your child does is shown publicly on the internet.

The AI tutor and AI hints

The AI tutor (in lessons and in the country courses) and the hint helper (in math practice) are powered by Claude, a model provided by Anthropic, PBC (USA), acting as our service provider. They are optional and turned off by default. You can turn them on when you give consent or later from your child’s page on the dashboard, and turn them off at any time. When they are off, every lesson, quiz and practice activity still works.

• What is sent: the lesson topic (for the country courses: the official topic code, title, objectives and the class level, for example “Primary year 3”), your child’s grade band and language, and the text your child types (for hints: the math question). We do not send your child’s name, birth year, or any account identifier.
• Children should not type personal details into the tutor. The tutor is instructed to stay on the lesson topic and not to ask for personal information.
• Under Anthropic’s commercial terms, content sent through its API is not used to train its models, and Anthropic keeps it only for a limited time for safety and abuse monitoring.
• We store tutor conversations (lessons and country courses) so you can review them, and delete them after 12 months (or sooner if you delete the profile). They are included in your child’s data download and report.
• AI answers can be wrong. They are learning help, not professional advice.

“Ask Polmia” visitor chat

• The public pages offer “Ask Polmia,” an optional chat that answers questions about the Academy. It is meant for parents, teachers and other visitors, and needs no account.
• What you type, and the few previous messages of the same conversation, are sent to Anthropic (Claude) only to generate the answer. We do not store the conversation, and it is not linked to any account.
• To prevent abuse, we keep your IP address for up to 24 hours to limit the number of questions; it is not linked to what you typed.
• Please do not share personal information in the chat. Answers are generated by AI and may contain mistakes; this policy and our team (info@globalcybersafe.org) are the authoritative sources.

Voice answers and read-aloud

Some math activities let a child say an answer out loud. This uses the speech recognition built into the web browser, not a service we run. Depending on the browser, the audio may be processed by the browser’s maker (for example Google for Chrome, Apple for Safari, or Microsoft for Edge) under that company’s own privacy policy. We never receive or store audio — only the number that was recognized. If you prefer, your child can type answers instead, or you can block microphone access in the browser settings.

To read lessons, math questions and short encouragements aloud in a natural voice, we use Microsoft Azure AI Speech (Microsoft Corporation, United States), acting as our service provider (processor). Only our own text — lesson sentences, math questions and explanations, and a fixed list of phrases like “Great job!” — is sent to Microsoft to be turned into audio. No personal information and nothing a child types or says is ever sent. The resulting audio is stored on our servers and reused for every learner. If this service is unavailable, the device’s built-in voice is used instead.

Live classroom video exchanges

In the Culture Exchange, two approved teachers can hold a live video call between their two classrooms. It is a school activity, organized by the schools and supervised by the teachers in class.

• Classroom only: the call runs on a classroom computer, at school, with the teacher present. Children never receive a link, cannot join from home or on their own, and their Academy accounts are not used or connected to the call in any way.
• Who can join: only the approved teachers of the two schools of a confirmed exchange, each with a personal access that works only during the scheduled time (from 15 minutes before the start until the end of the scheduled duration). The host teacher admits the other classroom from a waiting room, the call is limited to four connections, and everyone is disconnected automatically when the time is over.
• Not recorded: video and audio are streamed in real time only. We do not record, transcribe or store the audio, video or images of a call, and recording, transcription, chat and screen sharing are turned off in the service. Teachers agree that no one may record a call by any means (see our Terms of Use).
• Provider: calls are carried by Daily (Daily.co, United States), acting as our service provider (processor). To run and secure the call, Daily processes the participants’ IP addresses, device and browser information, the display name of each teacher (name and school) and temporary call metadata such as join and leave times and connection quality. Daily may use this information only to provide its service to us.
• What we keep: only the exchange details (topic, date, time, duration), the technical name of the call room and the time the host ended the call — no audio, video or images.
• Children on camera: students may appear on camera as a group. Teachers must follow their school’s rules, including any permission the school requires from families, keep full names and other personal information off the screen, and end the call if anything inappropriate happens. A child’s participation in a classroom call is decided by the school, under its own authority; parents with questions should contact the school or write to us at info@globalcybersafe.org.

Who we share information with

We do not sell, rent or trade personal information, and we do not share it for advertising. We share it only with:

These providers may use the information only to provide their service to us. We may also disclose information if required by law, to protect the safety of a child or others, or to a successor organization if the Academy is transferred (in which case this policy will continue to apply and we will notify you).

Your rights and how to use them

A parent or guardian linked to a child’s profile can, at any time:

• Review progress, quiz results and friend requests on the dashboard, and the full record with “Download my child’s data.”
• Download a copy of all information about the child in a machine-readable (JSON) file.
• Turn the AI tutor on or off from the child’s page.
• Delete the child’s profile and all related activity with “Delete this child’s profile,” which also withdraws consent and stops any further collection.
• Delete your own account from the dashboard. Children you alone manage are deleted with it.
• Correct information, or make any request you can’t do yourself, by writing to info@globalcybersafe.org.

We answer written requests within 30 days. To protect children, we will confirm that the request comes from the parent linked to the account (usually by replying to the account’s email address). If more than one parent is linked to a child, any linked parent may exercise these rights.

How long we keep information

Security

We use encryption in transit (HTTPS), hashed passwords and PINs, database access rules that let each parent see only their own children, limited staff access, rate limits on sign-in attempts, and human review of content from teachers and children. No system is perfectly secure; if a breach affecting your information happens, we will notify you and the authorities as required by law, including Utah’s data breach notification law, Quebec’s Law 25 and the GDPR.

Where information is stored

The Academy’s servers are in the United States. If you use it from Canada (including Quebec), the European Union or elsewhere, your information is transferred to and stored in the United States, where privacy laws may differ from yours. We choose providers that contractually commit to protect personal information and assess these transfers as required by Quebec’s Law 25; for users in the EU or UK, transfers rely on the providers’ standard contractual clauses or equivalent safeguards.

Cookies and local storage

We use only cookies that are needed for the Academy to work. There are no advertising or analytics cookies, so there is no cookie banner.

Children, teens and young adults

• Under 13: a child can only use the Academy through a parent’s account, after the parent’s consent, as described in this policy.
• 13 to 17: we apply the same protections. Teens still use a parent-managed profile; the parent keeps the rights described above.
• 17 and older: a student whose birth year shows they are at least 17 may create their own sign-in (email and password) linked to their existing profile. They can then manage their own profile and exercise the rights in this policy themselves; a parent who is already linked stays linked until removed on request.
• If we learn we have collected information from a child without a parent’s consent, we delete it.

Teachers and schools

Teachers who join the Culture Exchange create their own account and are approved by our team. Their name and school appear on posts they publish. Teachers can ask us to correct or delete their information at info@globalcybersafe.org. Teachers must not include students’ names, faces or other personal information in posts or session proposals. If a school wants to use the Academy with its students under a school agreement, contact us first so the school’s own student-privacy obligations can be addressed in writing.

Your rights where you live

Changes to this policy

If we make a material change — especially to what we collect from children or who we share it with — we will notify parents by email or on the dashboard before the change applies, and ask for new consent where the law requires it. Each consent records the version of the notice you agreed to. The date at the top shows when this version took effect.