Data Retention Policy
AI Safety Adventures — what we keep, how long, and how it gets deleted
Effective date: 2026-09-10 Last updated: 2026-09-10 Version: 2.0
About this version
Version 2.0 replaces version 1.0 (2026-01-30) and rewrites it end to end.
Version 1.0 described deletion controls the software did not have, and retention periods that did not match the code that runs the Service. That was our error, and correcting it in public is the point of this version. Every period in the tables below was checked against the running system in September 2026. Where a control is missing or a cleanup is still outstanding, this policy says so instead of implying otherwise.
Who this is for
Parents and guardians, teachers, and school administrators. It says what we store, how long we keep it, and how to have it deleted.
For the wider picture — what we collect and why — see our Privacy Policy.
Questions, or a request to review or delete data: privacy@ethis.ai.
How students are identified
A student is identified by a machine-generated token or username. "Student 4" and "brave-robot-42" are the two shapes it takes. We never ask a student for their real name.
That is pseudonymous, not anonymous. A persistent identifier that belongs to one person is personal information under the COPPA Rule, at 16 CFR §312.2(7), and we treat it as personal information. We use it only to run the Service for that student: sign them in, keep their place, remember the progress they earned, and keep accounts safe.
Two exceptions, the same two our privacy policy names:
- A student aged 13 or over who creates their own account can give us an email address.
- If a teacher turns on the optional Google Classroom or Microsoft roster sync, we read the school's roster to count students. We do not store the names in it.
A teacher who wants to match "Student 4" to a real child keeps that list in their own browser. It never reaches our servers.
Two fields do hold text a teacher types: the name of a classroom, and an optional private note on a score. Neither one asks for a student's name, and nothing in the Service prompts for one, but nothing stops a teacher typing one either. Both are deleted with the classroom.
1. Student data
| What | How long we keep it | How it is deleted |
|---|---|---|
| The student token or username (the identifier) | While the classroom exists | Deleted with the classroom |
| Learning progress, quiz answers, thinking profiles, collected cards, XP | While the classroom exists | The database deletes them the moment the token goes — immediately, not on a timer |
| Investigator case records | While the classroom exists | The same immediate deletion |
| The copy kept when a teacher resets a student's progress | 90 days | A job deletes expired copies every day |
| Student sign-in sessions | Cut off after 30 days without use | A daily job ends unused sessions; the session record itself is deleted 90 days after it ends |
| Pending sign-ups left over from a retired sign-up flow, which hold a parent's email address | 7 days | A daily job deletes them. Nothing creates new ones. |
There is no delayed-deletion window. When a classroom is deleted, its student tokens go with it, and every record that points at a token is deleted in the same operation, by the database itself. Version 1.0 of this policy promised a 30-day or 90-day grace period on top. No such timer has ever existed in the software.
About progress resets. A teacher can reset a student's progress — for example, to let a class retry an adventure. When that happens we keep a copy of the old progress and quiz answers for 90 days, then delete it. Version 1.0 did not mention this copy at all. It should have.
About backups. Our database host keeps point-in-time backups for 7 days. A deleted row can survive inside those backups until they roll off. We would rather say that than let a parent believe deletion reaches every copy the instant it runs.
2. Teacher and parent data
| What | How long we keep it | How it is deleted |
|---|---|---|
| Teacher account: email address, name, sign-in credentials | While the account exists | By email request — see the gap noted below |
| Classrooms a teacher created | While the account exists | Deleted when the teacher deletes the classroom, or with the account |
| Parent account, and the link to a child's account | While the account exists | By email request to privacy@ethis.ai — there is no delete button in the parent dashboard yet. Deleting a parent account deletes the linked children's accounts and everything attached to them, in one step. |
| Billing records | Held by our payment processor, Stripe, for as long as tax and accounting law requires | Stripe holds these. No student data is involved. |
A gap we are naming rather than papering over. There is no self-service "delete my account" button for teachers yet, and no job that deletes an account for going unused. Version 1.0 described both, plus a 30-day grace period. None of the three exists. Until the button ships: email privacy@ethis.ai and we will delete the account and its classrooms by hand, within 30 days of a verified request.
3. Operational data
| What | How long we keep it | How it is deleted |
|---|---|---|
| Server logs at our host, Vercel | 30 days | A rolling window at the provider |
| Error reports we send to Sentry | 90 days | The provider expires them |
| Error records in our own database | 30 days | A job deletes them every day |
| Security audit records | 1 year | A job deletes them permanently every day. They are not archived. |
| Adult account events: sign-up, email verification, password reset, password change | Target: 1 year | No automatic job runs on these yet. We are disclosing that rather than implying one does. |
| Rate-limit counters at our anti-abuse provider, Upstash | Under 24 hours | The provider expires each counter at the moment it is written |
| The separate usage record at that same provider | Entries written before 2026-08-08 have no expiry | New writes stopped on 2026-08-08. The older entries have not been deleted yet — a one-time purge is outstanding, and tracked on our side. |
| Aggregate analytics | Kept indefinitely | Not deleted. These are event counts with a short, fixed list of labels — never a student token, username, or classroom id. |
Third-party processors
The complete list of every service provider that may receive user data — what we send them, how long they keep it, and how a deletion is requested — is maintained at /policies/processor-inventory.
That document is the authoritative one. This policy does not duplicate it, so the two cannot drift apart and disagree.
Asking us to delete data
Parents and guardians. Email privacy@ethis.ai. You can ask to review your child's information, ask us to delete it, and tell us to stop collecting it. We act on a verified request within 5 business days. We verify through your child's teacher or school, so that we are not handing one child's records to someone else.
Teachers. Deleting a classroom deletes the student tokens in it, and everything attached to them, in one step. There is no delete button in the dashboard yet — archiving a classroom keeps its data — so email privacy@ethis.ai and we will delete it for you. To delete your own account, email privacy@ethis.ai.
Schools and districts. Email privacy@ethis.ai and tell us which classrooms or which teacher accounts. We handle these by hand.
We do not ask for a reason, and we do not charge for any of this.
One thing to know about timing. Deletion from our own database is immediate. Copies sitting with our service providers — an error report at Sentry, for instance — clear on their own schedules. A full trace across every provider can take up to 30 days.
If there is a data breach
Our commitments, in short:
- Within 24 hours, we determine whether student information may have been involved.
- Within 48 hours of discovery, we notify affected schools.
- Within 72 hours, parents are notified through their school.
- Regulators are notified as required by law.
- Within 30 days, we complete a written incident report.
The fuller summary — how we detect, assess, contain, and follow up — is at /policies/incident-response. The operational detail behind it stays internal, because publishing it would help an attacker.
Keeping this policy honest
Every retention period that our own software enforces is set in our code; the provider windows and the by-hand commitments above are checked against the provider's settings and our own records. When one of those numbers changes, this document changes in the same release. We also review the whole policy at least once a year, and whenever a new feature changes how data is handled.
Teachers and schools are notified by email of material changes.
Contact
- Reviewing or deleting data, and any privacy question: privacy@ethis.ai
- Reporting a security concern: security@ethis.ai
Legal references
- COPPA — 16 CFR Part 312, as amended in 2025 (90 FR 16977, Apr. 22, 2025).
- FERPA — 34 CFR Part 99. FERPA binds schools that receive federal education funding; it does not bind us directly, and many private schools are not subject to it at all. Where a school that is subject to FERPA uses the Service, we support that school's compliance.
- California SOPIPA — Cal. Bus. & Prof. Code §22584.
- Texas student data privacy — Tex. Educ. Code §32.151 et seq.
- New York — Education Law §2-d.
AI Safety Adventures is operated by Ethis.AI.