Student data
About each child, LOOP keeps a first name, a class code and their work. Never a last name, a birthday, a login or a photo of a face.
This page says what we collect, where it goes, how long it stays, who can see it, and what deletion means.
What we collect.
For each child
One first name, one class code, the child's worksheets, and the skill records made from that work.
What we do not collect
No last names. No birthdays. No photographs of faces. No student logins or accounts.
We do not call this anonymous. A first name and class code can still point back to a child inside a school, so we treat it as student data.
Where it lives, and for how long.
| Store | What it holds | Current retention |
|---|---|---|
| School records | Roster, scores, skill history, and plans | One school year |
| Scan storage | Scanned pages, and pictures of boxes the reader was sure of | Deleted within hours of scoring |
| Flagged pictures | Pictures of boxes flagged for the teacher to check | Until the teacher checks the box, and never past 7 days |
Every store is in the United States and encrypted at rest. These retention windows are provisional. We confirm them with the school before signing.
Who sees it.
The classroom teacher signs in with a one-time code or Google sign-in on the teacher's school email. There is no password. The people operating LOOP can reach the records only for support and repair. That is the full access list.
What the AI does.
LOOP uses AI only to read handwriting. Whether an answer is right comes from the answer key, not the AI. A reading goes to the teacher unless it matches the answer key or a mistake LOOP expects; a blank always goes to the teacher.
What leaves the school record.
A single handwritten-digit crop can go to a commercial AI API for reading. The request contains the model name, one fixed instruction, and the image.
No child name, class code, sheet identifier, or date is attached. First names stay in one school record column used to print and display the teacher's page.
The provider does not train on these inputs. Its current default retention is 30 days until zero-data-retention is granted.
How deletion is proved.
There are two deletion commands. One removes a whole class. One removes a single child. Each command counts rows and files before deletion, runs again safely if needed, and recounts to zero afterward. This supports the deletion right in Utah Code 53E-9-309.
The one thing we ask for.
A school can choose to let answer crops help improve the reader. This is off by default for every class. If a school turns it on, the crop moves to a separate store keyed only by an image hash. The move cannot be reversed because the link back to the child is removed.
What we still owe you.
The picture windows and the one school year record window are provisional until the school agreement confirms them.
The reading provider's retention is the 30-day default until zero-data-retention is granted.
The school's Data Manager is named in the agreement.
No ads. No parent-facing product. No third-party analytics anywhere on this site.