Privacy Policy for JotterBlog

1. Who We Are

JotterBlog is an educational web app designed to help teachers manage student writing and teacher assessments. Student writings are created into sharable blogs and assessments are auto graded by AI and provides the teacher with assessment data. Teachers create and manage student accounts. JotterBlog is developed and operated by Anthony Barragan. Student and teacher data is stored securely using Neon, a managed PostgreSQL database service, in accordance with their security and compliance standards.

2. Information We Collect

In order to protect student privacy, we encrypt data that may be considered Personally Identifiable Information (PII)

From Teachers:

• Encrypted Name
• Email address
• Google account information(See section 11)

From Students:

• Encrypted username
• Encrypted Name
• Encrypted password
• Blogs and responses to questions

3. How We Use the Information

• Create and manage teacher and student accounts
• Provide access to JotterBlog features
• Securely store and manage classroom content
• Automatically generate AI-assisted responses using OpenAI (see Section 6)

4. Children's Privacy

JotterBlog is compliant with the Children's Online Privacy Protection Act (COPPA). Students under 13 use the platform under the supervision of their teachers. We do not collect personal information directly from students. All student accounts are created and managed by verified teachers. All PII is encrypted in our databases.

5. FERPA Compliance

JotterBlog is designed to operate in compliance with the Family Educational Rights and Privacy Act (FERPA). We recognize that student educational records are the property of the school and the family, not JotterBlog.

Specifically:

• Schools and teachers retain full ownership of all student data and educational records created within JotterBlog
• JotterBlog acts as a school official with legitimate educational interest, accessing student data only to provide the services requested by the teacher
• We do not disclose student educational records to any third party without the consent of the school or parent, except as required by law.
• Student data is never used for advertising, analytics, or any purpose outside of providing educational services within JotterBlog
• Schools may request the deletion of all student records at any time by contacting us at [email protected]

6. Data Protection and Security

• All passwords are encrypted
• Student usernames are encrypted for privacy
• All data is stored securely
• Access is limited to authorized personnel only

In the event of a data breach that compromises personal information, we will notify affected teachers and schools within 72 hours of becoming aware of the breach. Notifications will be sent to the email address associated with the teacher's account.

7. Cookies

JotterBlog only uses essential cookies required for the website to function properly—such as session cookies that keep you logged in or remember your basic preferences. We do not use tracking cookies, advertising cookies, or analytics tools that collect personal data.

Because these cookies are necessary for core functionality, they cannot be disabled. By using JotterBlog, you agree to the use of these essential cookies.

8. Use of AI and External Services

When students answer questions on JotterBlog, their responses may be processed by OpenAI's ChatGPT to generate scores. These responses are not linked to any personal identifying information. While content is shared with OpenAI for processing, it is done anonymously and solely to provide educational assistance within the platform. Student responses sent to OpenAI for grading are processed through the OpenAI API in accordance with OpenAI's API data usage policies. OpenAI does not use API data to train models by default. For more information, see OpenAI'sprivacy policy.

We do not use this data for advertising or analytics, and we do not allow OpenAI or any third party to access identifiable student information.

9. Data Sharing

We do not share, sell, rent, or trade any personal information. The only third-party interaction involves anonymous, unlinked student content sent to OpenAI for educational assistance.

Student data never used for advertising

10. Data Retention and Deletion

We retain data only while an account is active. If a teacher deletes their account, their account and all associated student data are permanently deleted from our systems and cannot be recovered.

If a teacher account remains inactive for 3 years, we reserve the right to delete the account and all associated student data after providing 30 days notice via email. Active accounts and their data are retained indefinitely until the teacher requests deletion.

11. Your Rights

Teachers may request access to their data, make corrections, or delete their account and all associated student records at any time by contacting us.

12. Changes to This Policy

We may update this policy as needed. When changes are made, we will notify users via email or in-app notifications. The most recent version will always be available on our website.

13. Google User Data Disclosure

JotterBlog's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request access to a teacher's basic Google profile information (Google ID, name, email address, and profile image). With the teacher's permission, we access their Google Classrooms and classroom rosters to help populate and manage their teaching dashboard within JotterBlog.

This information is used solely to:

• Verify identity and securely authenticate teacher logins
• Provide personalized dashboard features
• Display and manage teacher's classes and student rosters

We do not share Google user data with any third parties, and it is not used for advertising or analytics purposes. Teachers may revoke JotterBlog's access to their Google account at any time through their Google Account settings.