Privacy

How student work is handled

Class Margin holds photographs of children's work, their names, their scores and their scoring accommodations. Those are education records, and the design treats them that way.

What is stored

• Photographs of submitted work, in private object storage. There is no public link to any image.
• Roster details: name, nickname, class number, school ID.
• Scores, per-question results, and who changed them.
• Scoring accommodations: how to grade, not why.

What is never stored

• Diagnoses, disabilities or medical information. Accommodation cards hold scoring rules only.
• Full individual education plans.

What the model is told

A page image is sent to a vision model along with the first names, last names, nicknames and numbers of the students in that class — never the whole school — and the scoring fields of one accommodation card where one applies. Two students' pages are never sent in the same request.

Requests are made with retention switched off at the provider, and comments may describe the work only, never the child.

Who can see what

Every query is scoped to a school; rows are never listed across schools. Teachers and assistants see only the classes they are assigned to. Accommodation details are visible to teachers; an assistant sees only that a card was applied and what it did to the score.

How long it is kept

You set a retention period: 180 days by default for a school, two years for a homeschool, and anything from one day to ten years. A daily job deletes photographs and scores older than that.

Finalized work is kept past it. That is on by default, and it is the setting that matters if you are building a portfolio: a paper you have finalized stays, and a paper you graded but never finalized is deleted on schedule like everything else. Two years is what Florida §1002.41 asks a home-education family to keep, and it is why a household starts there rather than at 180 days.

Deleting a student deletes their submissions and images with them. Exports you have already downloaded are yours and are not touched by any of this.

What US law asks

FERPA (20 U.S.C. § 1232g) binds schools that receive funding from the US Department of Education. Most homeschools and many private schools are not covered by it at all. Where it does apply, a service like this one handles education records as a school official under 34 CFR § 99.31(a)(1): the school keeps direct control, the records are used only for the educational purpose the school asked for, and they are not redisclosed. That is how this is built — see who can see what, above, and the list below.

COPPA covers personal information collected from a child under 13. No child signs in here and nothing is collected from one. An adult types the names and an adult holds the camera; the photographs are of work, not of faces. A child's name is stored because a parent or a teacher entered it, and it is deleted when they delete the student.

A person makes every grade. Virginia and Connecticut have both told schools that an AI system must not decide a final grade on its own. Nothing here does: every score arrives as a draft for a teacher to confirm, and written answers are never scored by a model at all.

Who else touches it

• Cloudflare — Workers for the application, D1 for the database, R2 for the photographs, and Email Routing for sign-in links. Hosted in the United States.
• xAI, reached through Cloudflare AI Gateway, reads a page image and returns what it can make out. Requests are sent with provider-side retention switched off, so the images are not kept there and are not used to train anything.

There is nobody else. No analytics service, no advertising network, no third-party embeds.

A school that needs a data processing agreement can ask for one from School settings once you are signed in. It is drafted and signed by people, not generated; what is on this page is what the software already does, and that is the factual half of one.