Privacy Policy

What is STEM Builder?

STEM Builder is an educational platform built for K–12 classroom use by STEM Builder LLC. It provides interactive STEM tools — design, engineering, coding, electronics, and more — for students, along with class and assignment management for teachers.

Our commitments

• No ads, ever, and we never sell or rent your data.
• No analytics, advertising, or tracking technology on any page.
• We collect the minimum needed to run the service.
• Student data is deleted on request.
• Data is encrypted and stored in the United States.

What data we collect

• Teacher account — name, email, and a hashed password. If you sign in with Google, we receive your name, email, Google account ID, and profile picture.
• Student account — a name (or the name your teacher/school provides, which may be a first name and last initial). Students who join with a class code can use a username-only account — no email or contact information required. If a student signs in with Google, we receive their name, email, Google account ID, and profile picture. If a school syncs its roster from Google Classroom, we receive each student's name, school email address, and Google Classroom ID from the school.
• Submitted and saved work — designs, code, drawings, projects, and progress created in the tools.
• Class enrollment — which classes you're in and the assignments your teacher has set.
• Technical data — a sign-in cookie that keeps you logged in (it holds your account ID and role and expires after 30 days), and the standard web-server request logs our hosting provider keeps for a short period for security, which include IP addresses and browser type. We run no analytics, advertising, or tracking on any page, and we do not build profiles from technical data.
• Age (independent accounts only) — if someone creates an account with no class or school, we ask their date of birth once to confirm they are 13 or older. We do not store the date of birth — only a record that the check passed. If the check fails, a 24-hour cookie remembers that so it cannot be retried with a different date. We do not collect age for students who join through a class or school.

We do not collect Social Security numbers, precise location, biometric or health data, demographic information, or home addresses/phone numbers.

Student pages load no third-party scripts, fonts, or trackers: apart from a student's own choice to use "Sign in with Google," every request a student's browser makes goes to our own domain. We do not send student work or student information to any artificial-intelligence service.

How students join

Students use STEM Builder in one of three ways:

• A class join code shared by their teacher;
• A school roster provisioned by their school or district; or
• An independent account, available only to learners age 13 and older.

Children under 13 may use STEM Builder only through a teacher's class or a school roster, where the school authorizes their participation. Under-13 students cannot create an independent account.

How we use your data

• To operate the platform and save student work and progress;
• To let teachers review student submissions and manage classes and assignments;
• To secure the service, respond to support requests, and meet legal obligations.

We do not use data for advertising, and we do not use it for any purpose beyond operating this educational platform.

Student privacy (FERPA & COPPA)

STEM Builder is designed for K–12 schools. Where used by a school, we act as a "school official" with a legitimate educational interest under FERPA, and we use student education records only to provide the service under the school's direction. For students under 13, we rely on the COPPA school-consent model: the school authorizes collection on parents' behalf, and we use children's data only to provide the educational service — never for advertising or sale. Parents may review or request deletion of their child's information through the child's school or teacher, or by contacting us.

Service providers (subprocessors)

We use a small set of vetted providers, each bound by contract to protect data and use it only on our behalf:

• Vercel — application hosting (US). As the web server it receives every request, including IP addresses, and retains standard request logs for a short period.
• Supabase — database (US) holding accounts, classes, and saved work
• Google — "Sign in with Google" and Google Classroom rostering, only when a teacher or school chooses to use them. Google profile pictures are served through our own servers, not fetched from Google by the student's browser.
• Resend — transactional email (e.g. password resets)
• Stripe — payment processing for paid teacher plans. Teachers enter payment details on Stripe's own secure checkout pages; we never see card numbers, and Stripe never receives student data.

Data storage & security

• Passwords are hashed with bcrypt and never stored in plain text; sessions use encrypted cookies.
• Data is encrypted in transit (TLS) and at rest, and stored in the United States.
• Database-level access controls (row-level security) keep each teacher's, school's, and district's data separated, so users only ever see their own.
• We monitor and log access for security.

Data retention & deletion

Account data is kept for as long as the account is active. Teachers and schools can remove a student from a class, or delete a student account, at any time from their dashboard.

You may also request deletion of your account and all associated data at any time by emailing privacy@stembuilder.io; teachers and schools may request removal of their students' data. When you delete data or a school agreement ends, the data is removed from active use immediately and permanently erased from our live systems within 30 days by an automated, logged process. Residual copies in routine encrypted backups expire on the provider's normal rotation (a short additional period, currently up to about a week), after which the data is gone entirely. We do not restore individual records from backups.

Data breach notification

If a data breach affects personal information, we will notify affected schools and, where applicable, teachers without unreasonable delay and consistent with applicable law.

Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date and, where appropriate, notify schools or account holders.

Contact

Questions about this policy? Contact us:
STEM Builder LLC
2650-1 Sunrise Hwy #1081, East Islip, NY 11730
privacy@stembuilder.io