Student data
About each child, LOOP keeps a class code, their work, and a first name only if the teacher gives one. Never a last name, a birthday, a login or a photo of a face.
This page says what we collect, where it goes, how long it stays, who can see it, and what deletion means. Homeschool families: read the family data page.
What we collect.
For each child
One class code, the child's worksheets, and the skill records made from that work. A first name is optional, and a numbered class keeps none.
What we do not collect
No last names. No birthdays. No photographs of faces. No student logins or accounts.
We do not call this anonymous. A class code, or a first name if the teacher uses one, can still point back to a child inside a school, so we treat it as student data.
Where it lives, and for how long.
| Store | What it holds | Current retention |
|---|---|---|
| School records | Roster, scores, skill history, and plans | One school year |
| Scan storage | The uploaded scanned pages | Usually 3 days after the scan; 7 if they could not be read |
| Pictures | A picture of each page and of each answer | Usually 3 days after the scan; while an answer on the page still needs checking, until a day after it is checked, if that is later; never past 7 days |
| Waitlist emails | Email, and optionally a first name and number of children | Until LOOP for families opens, or sooner if you ask |
Every store is encrypted at rest, with Cloudflare in Western North America. The stores are not yet held to the United States; LOOP is moving them to storage that is. These retention windows are provisional. We confirm them with the school before signing.
The automatic deletion is switched on before any real student's work is uploaded.
Who sees it.
The classroom teacher signs in with a one-time code sent to the teacher's school email. There is no password. The people operating LOOP can reach the records only for support and repair. That is the full access list.
What the AI does.
LOOP uses AI only to read handwriting. Whether an answer is right comes from the answer key, not the AI. A reading goes to the teacher unless it matches the answer key or a mistake LOOP expects; a blank always goes to the teacher.
What leaves the school record.
A picture of one answer box can go to a commercial AI API for reading. The request contains the model name, one fixed instruction, and the image.
No child name, class code, sheet identifier, or date is attached. First names stay in one school record column used to print and display the teacher's page.
The provider does not train on these inputs. Its current default retention is 30 days until zero-data-retention is granted.
How deletion is proved.
There are two deletion commands. One removes a whole class. One removes a single child. Each command counts rows and files before deletion, runs again safely if needed, and recounts to zero afterward. This supports the deletion right in Utah Code 53E-9-309.
The one thing we ask for.
A school can choose to let answer crops help improve the reader. This is off by default for every class. If a school turns it on, the crop moves to a separate store keyed only by an image hash. The move cannot be reversed because the link back to the child is removed.
What we still owe you.
The picture windows and the one school year record window are provisional until the school agreement confirms them.
The reading provider's retention is the 30-day default until zero-data-retention is granted.
The school's Data Manager is named in the agreement.
No ads. No parent-facing product. No third-party analytics anywhere on this site.