Enter
S3U Privacy Policy

Privacy promises for students, families, teachers, and tutors.

Last updated October 5, 2026. This policy explains what S3U collects, why we use it, and the choices adults have when they manage student learning.

Our Basic Promises

  • S3U does not require student email addresses, phone numbers, payment cards, or unnecessary personal details.
  • Parents, teachers, and tutors can create student logins without giving us a student's real identity.
  • Students can use public names in shared areas instead of real names.
  • S3U does not sell student, family, classroom, learning, forum, report, or account information.
  • S3U does not require a credit card to begin, does not use subscriptions, and plans paid add-ons as prepaid choices only.
  • S3U avoids cookies where possible and uses browser localStorage for device-side convenience.
  • S3U supports VPN use and modern devices with a browser.

Who This Policy Covers

This policy covers S3U pages and tools at s3u.com, including public information pages, student dashboards, games, worksheets, daily checklists, progress reports, forums, avatar items, pets, and the virtual S3U Bank.

S3U is designed for students and for the parents, teachers, tutors, learning centers, and other authorized adults who support them. When an adult creates or manages a student account, that adult is responsible for using S3U in a way that is appropriate for that student and their setting.

Information We Collect

Student Accounts

Student accounts may include a username, display name, public name, password, role, account status, group memberships, and the adult or organization that manages the account. S3U is built so a student account can be created without a student email address, even when optional Google login is also available.

Parent, Teacher, and Tutor Accounts

Adult accounts may include a username, display name, public name, password, role, account status, group memberships, and optional report email settings. Adults who choose Google login may connect a Google account for sign-in.

Learning Progress

S3U may store subject progress, activity results, scores, points, grades, active learning time, checklist completion, daily summaries, assigned tasks, chores, and time spent in each subject. This information helps students and adults see progress by absolute standards instead of curves or ranking against other students.

Recent Learning Activity

Connected parents and instructors can see whether a student's browser recently reported activity on a learning page. We keep one server timestamp per sign-in, not the page address, keys typed, answers, screenshots or browsing history. Signals come from recent interaction on a visible page or focused lesson playback. The indicator expires after one minute and is not proof of attention, attendance or being offline. It does not award grades, points or learning time. Ending the sign-in stops its eligibility; removing a group connection ends access through that connection. Old signals are removed in bounded batches during later activity after 24 hours, and are deleted with the sign-in or account. No presence history is shared or stored in browser storage.

Skill Practice and Starting Checks

Skill Paths saves the student, stable skill identifier, question version and worksheet form, a fixed copy of the questions, selected or numeric answers, answer feedback, declared use of help, browser-reported active time and timestamps. Duplicate-request identifiers and hashes prevent a retry from saving the same round twice. Only students submit their own rounds; currently authorized parents and instructors can read their practice history. Unsaved answers remain in the open page, not browser storage.

These short rounds guide practice and review, not validated diagnosis or proof of mastery. Starting checks do not create activity credit; full practice can add ungraded time but does not change subject grades, award coins or complete unrelated daily tasks. Suggestions use bounded recent history and separate older question versions. Public worked examples do not expose student results. Rounds, results and retry records remain until account deletion or an authorized deletion request is handled, subject to backup retention below. The two-hour saving deadline does not delete a started round. This feature does not send an email for each practice round or send answers to an external grading service.

Connected parents and instructors can view a Teaching Overview of existing skill practice across their authorized students. It shows public student names, bounded practice comparisons and shared wrong-answer patterns, with links to supporting saved attempts. It does not diagnose learning difficulties, change grades or create additional student records. Access is rechecked against current account roles and student connections; private summaries are not stored in browser storage.

Daily Skill Planning

Daily skill planning stores its activation date, fixed daily selections or a reason no task was assigned, question-version snapshots, completion references and teaching reasons. Connected parents and instructors can save versioned focus, pause or automatic settings; we retain their account reference, effective dates, revisions and retry hashes. Changes start the following UTC day and do not rewrite the current task. Future choices ignore directions from adults who are no longer connected, while already saved daily tasks remain part of the student's learning history. These records are private to the student and currently authorized adults and are removed with the student account, subject to backup retention. Adult changes are audited and queue a generic notice to the acting adult's verified account email, without student names or teaching notes.

Typing Practice

Saved typing rounds include the student, lesson, fixed practice text, source, chosen keyboard layout and input method, timestamps, active time, completed characters, insertion and correction counts, and counts for expected keys. We do not save the actual incorrect characters or capture typing from other fields. Composed, pasted and assisted input is marked separately and does not receive a speed score. These are browser-reported practice measures, not verified assessments or subject grades. Weekly-word practice reuses the student's saved spelling list without marking spelling complete.

Only the student can save their rounds. Currently authorized parents and instructors can view their progress. Guest and adult previews are not saved. Unsaved typing stays in the open page, not browser storage. Started rounds, aggregate results and duplicate-request protection records remain until the student account is deleted or an authorized deletion request is handled, subject to backup retention below. A round's two-hour saving deadline does not automatically delete its record. Typing can add ungraded practice time to learning summaries but does not send an email for each round.

Private worksheet templates

Worksheet Maker generates practice in your browser. Custom words, clues and titles are not saved automatically. Parents and instructors can explicitly save a private template containing its title, words and clues or math options, worksheet version and generator revision. Only the owning account can open or edit the source template. Saving it alone does not publish it, share it with students or create an assessment, grade or task. Unsaved content stays in the open page, not browser storage or URLs.

Deleting a template removes its content from the active record. Minimal identifiers, ownership, revisions, action times and request hashes remain to prevent delayed retries from recreating it. These records are removed with the owner account, subject to backup retention below. Saves and deletions are audited and queue a generic notice to the acting adult's verified account email, without worksheet titles, words or clues. Do not include sensitive student information in custom worksheets.

An adult can explicitly copy a custom template into a private learning collection and assign a further fixed copy to selected students. A collection copy is private to its owner; an assigned copy is readable by that student and their currently authorized adults. Copies contain the worksheet inputs and generator revision, not a live connection to the source. Editing or deleting the template or collection does not erase copies already assigned. Assigned worksheet content remains with its task until the task or student account is deleted, subject to backup retention and authorized privacy requests. Removing the assigning adult does not remove the student's copy, but adults who lose their connection to the student lose access to it. Printing and viewing do not record answers or award grades.

Private learning collections and assigned copies

Parents and instructors can also save project notebook outlines in their private collections, including a writing path, project question, final demonstration and ordered session goals. Explicit assignment stores a fixed copy with the student's task and the assigning adult's public name at that time. The student and currently authorized connected adults can read it; reading does not create student writing. If the student explicitly starts and saves a notebook, its original outline and public attribution are retained with that student's revisions. Later changes or deletion of the source collection do not replace these copies. Deleting the task removes its assigned starter, but not a notebook the student already saved from it. Saved notebooks follow the writing retention rules below. Collection outline printouts and a student's explicit draft download include the goals; writing-only printouts, portfolio copies and generic email notices do not. Author attribution does not indicate S3U approval of the outline.

Collection version history retains up to 20 recent saved versions within a 2 MiB content limit per collection. These private snapshots include titles, ordered resources, instructions, time estimates, optional pacing defaults and copied custom worksheet inputs. Older versions are removed as the limits are reached; versions from before history was introduced cannot be reconstructed. Only the owner can inspect a retained version or explicitly restore it as a separate collection. Restoring does not change student assignments or the source. Deleting the source collection deletes its retained versions, but not separate restored or assigned copies. Backup retention below still applies.

Parents and instructors can save private, ordered collections containing lesson, game and worksheet references, offline activity titles, instructions, optional time estimates and default weekdays, week intervals and resources per day. Saved pacing does not include student start dates or progress. Only the owning account can open or edit a saved collection. Explicitly assigning it creates independent task copies for the selected students, visible to those students and their currently authorized adults. Editing or deleting the source collection does not change those copies or their schedules. Time estimates and task checkmarks are not assessment scores.

Deleting a collection removes its title, instructions, resource list and pacing defaults from the active collection record. Minimal identifiers, ownership, revision, action timestamps and request hashes remain to prevent a delayed retry from recreating it; assignment retry records contain created task identifiers, not copied instructions or student names. Deleting the owner removes their collections and retry records, while existing student task copies remain with the student. Deleting the student removes their tasks. Collection changes are audited and verified adult actors receive generic queued notices without collection contents. Unsaved drafts remain only in the open page. Printed copies cannot be recalled.

Paced assignments, or an adult's explicit grouping of existing assignments, create a private course plan with a title, student and assigning-adult references, ordered task links, pacing settings, revision, pause status and archive time. Grouping existing assignments preserves their saved work and dates and records the selected order and task snapshots. Course changes retain the acting adult, request hash, time, and before-and-after task titles, dates, revisions, resource links and estimates. Rename, archive and restore history also retains old and new course titles and pause/archive states. Pausing or archiving suspends unfinished due work; it does not erase assignments, submissions or completed work. Restoring a course keeps unfinished work paused until it is separately resumed. The student and currently authorized adults can view the plan and recent history; only eligible connected adults can change it. Deleting a source collection or former instructor does not remove the student's plan. Course plans and their history are removed with the student account, subject to backup retention and authorized privacy requests. Changes are audited and queue a generic notice to the acting adult's verified email without course contents.

Learning Logs, Reading Journals, and Attendance

Saved learning records contain the student, activity date and timezone, type, subject, title, reported minutes, optional notes, and author/correction details. Reading records may also contain a book author, pages or chapters read, and read-aloud status. A reading session appears in the journal and log as the same record. Attendance stores the date, timezone, adult-confirmed status, optional note and reported minutes. These are manually reported records, separate from measured website activity; a login or planned task does not create attendance.

Records are private to the student and currently authorized adults. Parents need a Family-group connection and instructors need a shared learning group. Students can edit or remove their own learning entries; connected adults can correct entries and confirm attendance. Authorized viewers can download or print records, including saved notes. Unsaved drafts stay in the open page, not browser storage. Avoid sensitive personal information in notes.

Removing an entry deletes its content. Minimal correction events retain the acting account, action, record identifier, revision and request hash, not the former note or title. Deleting the student removes their records and correction events, subject to the backup provisions below; this cannot recall downloaded or printed copies. Verified adult actors receive a queued, generic action notice without student names, reading notes or attendance details. These notices do not enable optional progress reports.

Private Learning Timeline

The learning timeline brings together dates, titles, subjects and limited metadata from completed lessons, reading and learning logs, currently ready writing projects, portfolio-selected uploads and saved reports. It is available only to the student and currently authorized connected adults. It does not copy reflections, feelings, messages, writing bodies, uploaded images or grading feedback into the timeline, create a public profile, or generate a new sharing link. The view reads existing records without creating additional learning credit, grades or emails. Corrections, removals and changes to current selections are reflected when the timeline is reloaded; it is not an immutable history. Timeline contents remain in the open page, not browser storage. Source-record retention and existing portfolio-sharing rules still apply.

For notebooks with session milestones, the timeline also shows saved revision checkpoints, including drafts: the title and date of that saved revision and counts of sessions the student marked evidence ready, working or not started. It does not include session evidence, next steps, linked-task references or discussion text. These counts describe the student's status at each save, not grades, adult approval or completed assignments. A checkpoint link opens that exact saved revision for authorized comparison without changing the latest draft. Later edits do not replace earlier checkpoint counts; deleting the project removes its checkpoints from the active timeline.

Multi-Day Writing Projects

Students can add session milestones to a project notebook. Each saved revision then includes the student's session status, evidence, next step and optional assigned-task reference. The project list shows counts, not that evidence. Linked tasks display their current planned dates and checkmarks when reloaded; changing or completing a task does not change the notebook's saved evidence. A removed task's reference may remain in earlier revisions without its task details. Milestone evidence is visible only with the project to the student and currently authorized connected adults. It is excluded from writing-only printouts, portfolio copies and email notices. A submitted notebook includes the milestone evidence from that exact submitted revision for authorized review. Milestone status is the student's report, not a grade or attendance record.

Revision practice uses the student's selected passage or current draft and revision note only in the open page. Trying the worked examples does not send writing, record answers, create a score or contact a writing service. Unapplied revisions and example choices are not stored in browser storage or the database. Applying a revision changes only the current draft; the student must separately save it to keep it under the ordinary writing retention rules. Closing practice discards unapplied changes, and account changes clear the practice workspace. A temporary undo copy remains only in the page until reset or navigation.

Students may design their own notebook outline with a question, final demonstration and ordered session goals. An outline being designed stays in the open page. Once used to start a notebook, its goals can be included in the optional tab recovery copy described below. Saved custom goals are labeled student-designed, kept with the original notebook revisions and visible only to the student and currently authorized connected adults. They do not become a public learning pack or instructor-approved standards. They are excluded from general project summaries, queued email notices, writing-only prints and portfolio copies; a student's explicit draft download includes the custom goals. Removing the notebook removes these goals from the active database with its revisions. Downloaded copies and backup retention follow the rules below.

Writing Workshop stores project titles, genres, plans, writing, revision notes, draft/ready status and saved versions, plus reusable character and setting ideas. Students can explicitly copy a saved daily story into a separate project without changing the original. A notebook started from a learning pack also keeps that pack's original title, version, question, session goals and criteria with its saved revisions; later changes to the public pack do not replace those starting goals. Only the student edits this writing. Currently authorized parents and instructors can read it and leave feedback on a specific ready revision. Reviews retain the adult's account reference, public name at review time, decision, feedback and date. They are not public posts or automatic grades.

Students and currently authorized connected adults can also discuss a saved notebook session while the work is still a draft. Each comment records the saved project revision and session, text, date, account reference, public name and role at posting time. Comments stay with that saved revision; they do not edit or approve the work, change grades or complete tasks. They are private to the student and currently authorized connected adults, not portfolio viewers. Writing-only prints, portfolio copies and email notices exclude comment text. Generic discussion notices are queued for connected parents and instructors with verified registered email addresses; pending notices for the same session revision and recipient are combined. Delivery rechecks the recipient's current connection, verified email and the continued existence of the discussion. Removing the project or student account removes its comments from the active database; queued generic notices become ineligible for delivery. Previously delivered emails and downloaded copies cannot be recalled. Account deletion and backup retention follow the rules below.

A connected adult with Plus or Lifetime access can explicitly select an approved revision for a private portfolio. The fixed portfolio copy contains its title, writing, genre and revision, with the student's public name in the portfolio header; it excludes plans, library ideas, revision notes, feedback and account emails. Sharing still requires the separate portfolio confirmation. Later edits do not rewrite earlier shared copies. Removing a project removes its saved versions, reviews and associated portfolio links; withdrawing approval from its current ready revision removes portfolios of that revision. Older shares can be revoked in Learning Tools. Printed and downloaded copies cannot be recalled.

Writing Workshop's optional recovery copy is off by default. When a student turns it on, this tab stores an encrypted copy of the current title, writing path, plan, writing, revision note, notebook starting goals and milestone draft in sessionStorage. It excludes idea-library edits, adult feedback, session comments, unapplied revision practice and sharing consent. It is tied to the current login session and student, not uploaded automatically, and becomes ineligible for recovery after seven days without an update. Restore requires a fresh account-access check and an explicit action; it does not save or submit work. Confirmed account saves, discard and logout remove the applicable copy. Closing the tab or clearing site data may remove it; browser session restoration can retain it. This is not a replacement for saving or a safeguard against someone using your signed-in browser. Avoid sensitive personal information and finish logout before sharing a device.

Without recovery enabled, unsaved writing stays only in the open page; the student may explicitly download their draft. Feedback always stays in the open page until submitted. Account changes are audited without copying content into the audit record. Adult review and portfolio actions queue generic notices to the acting adult's verified address, not the student's writing or feedback. Minimal retry identifiers and hashes and an ungraded completion record can remain after individual project removal. Writing records are removed with the student account, subject to backup retention and authorized privacy requests. Deleting a reviewing adult clears their account reference but does not erase feedback retained with the student's project.

Saved Game Places

Students can explicitly save one private File Quest place: the mission and game version, fictional file and folder names and locations, selected file, operation counts, revision and update time. File contents refer only to the game's supplied examples; no device files are read or uploaded. Only the student can read, replace or discard this place. It stays saved until replaced, discarded or the account is deleted, including after a game is finished. Unsaved changes stay in the open page, not browser storage. Saving does not record learning time, grades, coins or completion and does not send email. Discard removes the saved workshop; minimal request identifiers, hashes, revision receipts and account-change logs remain to prevent old retries from restoring it. Deleting the account removes its places and retry records, subject to backup retention below. Avoid personal information in fictional names.

Weather Desk also offers one explicitly saved private place per student. It contains the case and game version, selected record and pinned record identifiers, revision and update time. It contains no free-form notes, answers or weather from your location. Only the student can read, replace or discard it. Saving or reopening does not award completion, practice time, grades or coins, and does not send email. The place remains after finishing until replaced, discarded or the account is deleted. Discard removes the notebook state; minimal request identifiers, hashes, receipts and account-change logs remain to prevent old requests from restoring it. Deleting the student removes the place and retry records, subject to backup retention below. Unsaved changes remain only in the open page.

Circuit Bench offers a separate private saved notebook with the current experiment, game version, full-bench or single-experiment choice, modeled control settings, up to twelve comparison settings per visited experiment, practice comparison and explanation flags, revision and update time. It contains no free-form notes or physical-device readings. Displayed readings are recalculated from the saved model settings. Only the student can read, replace or discard it. Saving and reopening do not create grades, coins, completion or practice time, and do not send email. A reopened experiment requires its explanation again. Replacing or discarding removes the previous notebook state; minimal request hashes, receipts and account-change logs remain to prevent stale retries. Account deletion removes the notebook and retry records, subject to backup retention below. Unsaved changes remain only in the open page.

Saved Programming Drafts

Students can choose to save Route Coder programs to their account. Saved drafts contain a program name, mission and model version, selected test route, instruction blocks, revision number and dates. Each student can keep 25 programs, with the latest 20 revisions of each. Only that student can change or delete them; currently connected parents and instructors can read them. Drafts are private, are not shared through public links and are not stored in browser storage. Unsaved changes stay only in the open page. Saving a draft does not send an email, submit an assignment or award grades, coins or completion credit. Reopening requires fresh route tests.

Students can separately submit a saved program revision to an assignment. The submission keeps a fixed copy of its title, mission and model version, selected test route, blocks and instruction labels, plus the student's optional note. This submitted copy remains available after older draft revisions are trimmed. Currently authorized connected adults can review it, request changes and compare a newer submitted revision with the earlier one. Review decisions and dated feedback are retained with the assignment; they do not automatically change a grade or complete a task. Submission and review actions queue generic notices to eligible connected adults without program contents, notes or feedback. Saving a draft alone does not send a notice.

Deleting a program removes its title, instructions, retained drafts, assignment submissions and their feedback from the active database. Deleting an assignment removes its submissions and reviews, not the original saved program. Minimal deletion records, request identifiers and hashes, and account-change audit entries remain to prevent old retries from recreating deleted work. These records are removed with the student account, subject to the backup and legal-retention rules below. Previously delivered generic notices cannot be recalled. Avoid sensitive personal information in program names.

Daily Stories

When a student saves a daily story, S3U stores its date, theme, title, optional plan, story text, active writing time, version, and completion status. Saved drafts and earlier stories can be read by that student and their connected parents and teachers. Only the student can write or complete the story. Story text is not included in public profiles, forums, or progress emails; reports can include completion and learning time. Stories remain until the account is deleted or an applicable deletion request is handled. Unsaved text is held in the current browser page, not stored in localStorage, and can be lost when the page is closed. Do not put sensitive personal information in a story.

Public video lessons can be watched without an account. For signed-in students, we store the lesson and content version, playback position, watched portions, active viewing time, and completion status so they can continue later. Connected parents and teachers can access lesson progress; adult preview does not record viewing for a student. Completing a video can add an ungraded learning activity, not proof of mastery. Playback records are deleted with the student's account. We do not send emails for watching a video or store viewing history in localStorage. Our self-hosted player does not contact a third-party video service.

Students may choose an optional learning level. We use that preference, saved lesson progress, and recent scores on matching practice to suggest daily lessons and practice. We store each day's selection and its reason so it stays consistent. This is not an age assessment; private feelings entries and payment status are not used for these recommendations. Learning preferences and daily selections are deleted with the student account.

Schedules, Schoolwork, and Grading

Plus and Lifetime learning tools store required weekdays, timezone, effective date, schedule versions and the acting adult. Schoolwork uploads store a title, subject, image, thumbnail and upload/checksum status using the same paid-upload and private-storage protections as artwork. Incomplete schoolwork uploads expire after 24 hours and are removed on later upload requests.

Students can explicitly link a saved picture or ready Writing Workshop revision to an assigned task. Assignment submissions store the task and source references, a student note, review status, revision, acting account and dated feedback history. A writing submission references the exact saved version, including its title, writing, plan and revision note; later project edits do not replace it. Only the student and currently connected adults can read these records; eligible connected adults can review them. Withdrawing preserves the submission history but removes it from pending review. Removing the original picture, writing project or assignment removes its linked submissions and feedback from the active database; minimal request identifiers and hashes remain with the student account to prevent duplicate retries. Submission decisions do not automatically complete tasks, change grades, approve writing for a portfolio or make it public. Generic action notices are queued to currently connected adults with verified emails, without the picture, writing, notes or feedback; delivery rechecks their connection and account email. Account deletion and backup retention follow the rules below.

When a student explicitly submits revised work after a change request, we link the new submission to the earlier submission and the exact review revision being answered. This preserves access to the earlier feedback without copying it into another record or replacing the original work. If the earlier submission is removed, the new submission remains but no longer exposes that earlier work or feedback through the link. Removing the new submission removes its revision link; removing the assignment or student removes its linked revision records. Revised submissions use the same private access, account audit, queued notice and backup rules as other submissions.

The student and currently authorized connected adults can compare two retained linked submissions. Opening this view reads the saved submitted writing or private pictures, the original change request and, when available, the latest recorded instructor-reviewed rubric scores and feedback for each picture. It does not expose unapproved grading drafts, create another copy of the work, request grading, send a notice or replace either grade. Closing the comparison or leaving the account clears its displayed content and temporary picture links.

An eligible connected adult can separately confirm permission to request assessment of a revised picture using the earlier approved rubric unchanged. We retain the request identifiers, acting account, request hash and assessment reference to prevent duplicate requests. A new assessment enters the grading queue described below and queues a generic notice to the acting adult's verified email, without the pictures, rubric or student name. Reusing an existing assessment does not restart it or send another notice. These actions are audited; they do not approve a grade or replace the earlier grade. Minimal retry receipts remain with the student account after an individual task or assessment is removed, subject to account deletion and backup retention.

School-year calendars store year names and date ranges, named breaks, version snapshots, effective dates and the acting adult. Calendar versions remain after a year is removed from future planning so earlier planned days can be reconstructed. They are private to the student and currently authorized adults and are removed with the student account, subject to backup retention below. Calendar exports compare plans with separately confirmed attendance and reported offline minutes; they do not create attendance. Changes are audited and queue a generic notice to the acting adult's verified email without student or break names.

When a connected adult explicitly requests automated grading, S3U saves a queued request. A server worker later sends only the selected image and their rubric to an external grading service, subject to availability and usage limits. Current permission and paid access are checked again before processing. We do not add student names, account identifiers, email addresses, feelings or unrelated work. Adults must remove personal information visible in the image and must be authorized to submit the work. Photo-metadata removal does not remove text or faces visible in a picture.

S3U requires Zero Data Retention for the external grading service and checks the service's retention confirmation before sending student content. Response-history storage is disabled. The service's terms and data controls govern its processing of the selected work. Contact S3U with questions about external processing. Grading is not enabled solely by buying Plus: the service must also be configured and available.

We keep the rubric, source checksum, grading service and version, job status, validated assessment and instructor corrections. Raw service responses and internal processing details are not retained. Draft assessments are visible only to connected adults. Students see instructor-approved feedback and grades. Daily request counters remain for up to 90 days to enforce usage limits even if an upload is removed. Deleting an upload removes its grading details and portfolio references; a minimal approved activity grade remains. Schedule, work, grading and portfolio records tied to the student are deleted with the student account.

Portfolios and Invitations

Portfolios contain only selected saved pictures, titles, subjects, a public name captured at creation, and optional approved grades. They exclude private names, account emails, feelings, teacher review notes and draft assessments. A connected adult can explicitly create an expiring link or request an email invitation. Anyone possessing that link can view the selected work; the recipient is not required to prove ownership of the email address. Do not forward a link without authorization.

Links expire after 1 to 30 days and can be revoked by the student or a connected adult. Viewing also stops if Plus expires or the sharing adult loses access. Renewal can restore an otherwise-valid link. We store a hash of the viewing token in the share record; an email invitation necessarily contains the link. Tokens are not kept in viewer localStorage or sent in API URLs. Revocation cannot recall emails, saved copies or prints already received. Removing original work removes it from live work portfolios, but not from fixed report snapshots described below.

Connected adults can save fixed learning-report snapshots containing the student's public name, reporting dates, recorded assessment and activity summaries, lesson progress, reading and offline entries without their private notes, confirmed attendance, and an optional explicit adult observation. When selected, Plus portfolio work adds copies of image previews and included approved grades. Reports exclude account email, private profile names, feelings, private messages, story text and draft assessments. Titles, book authors and any adult observation are included; avoid sensitive information in these fields.

New learning reports also capture dated individual activity results, completed skill-round counts and help indicators, retained worksheet titles and content versions, and matching approved upload criteria with awarded/possible points, review dates and reviewer public names. They do not copy individual answers, grading feedback or private review reasons. Criterion text appears in the preview and shared copy; do not put sensitive information in criteria. Older snapshots are not supplemented with these details. Approval of an individual grade is not approval of an annual portfolio.

A connected parent or instructor with Plus or Lifetime access can separately request review of an exact saved learning-report snapshot by another connected instructor. We retain the report identifier and comparison hash, requesting adult and instructor public names, dates, decisions and review comments. Comments and decision history are visible to the student and currently connected adults, so do not include sensitive information. Only the selected instructor can record or correct a decision; corrections retain earlier decisions. Withdrawal stops new decisions and marks earlier decisions as historical, without erasing the history. Removing the saved report or deleting the student removes its review requests and comments. Printed and downloaded copies cannot be recalled. These reviews do not certify accreditation or legal compliance.

Review requests, decisions and withdrawals queue generic notices to the requesting adult and instructor when their account emails are verified. Notices contain no student work or comment text. We recheck current connections, account email, report availability and the latest request state before delivery; obsolete notices are cancelled. A review request does not create a public viewing link or grant access to an unconnected person.

A course-completion record is a saved report containing the student's public display name, course identifier, title and revision, the listed assignment identifiers, titles, resource links and completion times, a comparison hash, and its generation date. It records assignment checkmarks, not mastery, attendance, accreditation or a diploma. Later views compare the saved course data with current records and flag changes or a removed course without rewriting the snapshot. These records use the same private access, explicit Plus portfolio sharing, deletion and backup rules as other saved reports; no legal name is required. Private notes and account emails are not copied into them.

Later corrections or removal of original entries and uploads do not rewrite saved reports. A corrected report is a new snapshot. Authorized students and connected adults can read and export snapshots, including after Plus expires. Connected adults can remove a report and its portfolio links; deleting the student removes their reports. Minimal request identifiers and hashes remain after an individual report is removed to prevent duplicate retries from recreating it. Reports remain subject to backup retention, and previously downloaded or printed copies cannot be recalled. Sharing a snapshot uses the same explicit, expiring Plus portfolio invitations and revocation rules above. Action emails contain no report contents.

We queue transactional schedule, grading and portfolio action notices to the acting adult's verified account email and invitations to the explicitly chosen recipient. Queue records include address, message and delivery status. We recheck invitation permission at delivery and cancel queued invitations when revoked. These notices do not turn on optional progress reports.

Weekly Artwork

Students with paid account access can upload an original picture for a weekly art theme. All file uploads require paid access. We store the student account ID, week, assigned theme, title, optional artist note, image, thumbnail, upload checksums, and completion status. Saved artwork is available to the student and their currently connected parents and teachers, not to public visitors or other students. Pictures and artist notes are not included in report emails.

Paid-access records contain the account ID, a payment reference, access dates, and any revocation date. Purchase records include the paying adult's and student's account IDs, selected plan, amount, currency, accepted terms, payment provider references, payment status, and access dates. We keep minimal webhook identifiers and dispute status, not raw payment notifications or card details. When an account is deleted, its purchase references to that account are removed; minimal transaction records remain for payment reconciliation and recordkeeping. Losing paid access does not by itself remove permission to view, download, or remove previously saved artwork.

When checkout is enabled, an adult completes payment on PayPal or Stripe. S3U sends the purchase amount, plan description, and an opaque order reference, not the student's name or email. The provider may collect the adult's payment and contact information under its own privacy and cookie policies. S3U does not receive the card number or store provider credentials in your browser.

We record payment-status changes and may email checkout, payment, refund, or dispute updates to the paying adult's verified account email. These transactional messages are separate from optional learning reports and do not turn reports on. The outgoing email queue stores the recipient address, message, and delivery-attempt status, linked to the purchase history. Payment messages do not include the student's name or schoolwork. Accounts without a verified email can still receive purchased access; payment status remains available when signed in.

Printable invoices and receipts retain the purchaser's name and verified email, the student's display name, itemized charges, service dates, and payment references. You may optionally provide a billing name, organization, address, and reimbursement reference at checkout. These details are stored by S3U for billing, not added to public profiles or sent to payment providers. Copies of billing details remain with the purchase record when profiles are renamed or deleted, subject to applicable recordkeeping requirements and privacy requests. Older purchases record available account details when their billing document is first prepared and are labeled accordingly.

Only the signed-in purchasing account can open its billing document in the account interface; belonging to the same student group does not grant access. Purchase emails link to this protected document without including its billing details. If you print, download, or share a receipt for reimbursement, the recipient will see its purchaser and student details. S3U cannot recall those saved or printed copies.

The browser prepares a smaller JPEG picture, and the server validates and re-encodes it to remove embedded photo metadata. This does not remove personal information visible in the picture itself. Do not include faces, names, addresses, or other sensitive details. Pictures and upload pieces are kept in private database storage, not in public site files or browser localStorage. An unfinished upload expires after 24 hours; expired pieces are removed during subsequent artwork visits or upload starts, or scheduled cleanup. The original file stays on the student's device.

Students can remove a saved picture, its title, and artist note. A minimal record that the weekly learning goal was completed remains, so removal or replacement does not create repeated completion credit. Deleting the student account removes its artwork and upload records from the active database. Backup retention and applicable privacy requests follow the sections below.

Daily Feelings Check-Ins

Students can optionally record how they feel and a note of up to 1,000 characters. We store the student account ID, the site's calendar date, the selected feeling, the note, and creation and update times. Skipping stores only a skipped-day record, without a feeling or note. There is one editable entry per student per day.

These entries and their completion status are available in the student's own account, not in connected parent or teacher dashboards, progress emails, forums, or public profiles. They do not affect grades, learning scores, coins, or recommendations. S3U does not diagnose feelings or monitor these entries for urgent help. Students who need support should talk with a trusted adult or someone they trust.

Check-ins are stored on the server, not in browser localStorage. Students can delete individual entries from My Feelings. Entries remain until deleted or until the account is deleted; limited backup retention may still apply. As with other account records, authorized privacy requests, necessary service-provider access, and legally required disclosures are handled under the sections below. Student-only visibility in the app is not a promise of confidentiality from S3U's operation of the service or these requests.

Groups and Join Codes

Parents, teachers, and tutors may create groups for families, classrooms, tutoring rosters, co-ops, or learning programs. S3U may store group names, group types, memberships, join codes, and related settings so adults can manage more than one student.

Shared Group Practice Goals

A current group instructor or Family parent can create a subject-based worksheet-practice goal. Sharing is off for each student until a connected parent or instructor authorizes that specific goal and group membership. We store the goal, target, exact authorizing memberships, permission revisions, contribution dates and request receipts. The student explicitly shares a practice day after saving a scored worksheet in the subject. No worksheet answers, scores or titles are copied into the goal.

Authorized students see the combined group total and their own count, not a list of classmates' contributions. Currently connected adults can inspect their students' counts. Future authorized group members can see the total. Totals in small groups may allow someone to infer that another student practiced. The student or a connected adult can withdraw permission; withdrawal or loss of the authorizing connection removes those contributions from shared totals. Reauthorization does not restore earlier contributions. Removing the student membership or deleting the group removes its associated goal participation records. Minimal account audit records follow the retention rules below. Goal and permission changes may queue generic notices to verified connected adults; daily contributions do not send emails. No public viewing links are provided.

Newspaper Participation Settings

Newspaper participation is off until a connected parent or instructor explicitly authorizes a student's current membership in a named group. A parent connects through a Family group; an instructor connects through a shared learning group. The student or a connected adult can withdraw authorization. We store the group membership, authorizing account and role, the memberships establishing that adult's connection, revision numbers and timestamps. The private change history also stores the acting account's public name and action. It is available to the student and currently connected adults, not to other group members just because they share a classroom.

The confirmation shows the group name and current student/adult counts, without exposing a member directory. Readership includes current and future active members of that private group, with no public links. Participation authorization is separate from adult approval of each article. Authorizing participation alone does not share any existing Writing Workshop draft.

To submit an article, the student separately previews and confirms a copy of a ready Writing Workshop revision: its title, writing and public name. Private plans, reflections and workshop feedback are not copied. We store those article snapshots, correction notes, review decisions and private reviewer notes with revision numbers and timestamps. The writer and currently connected adult editors who belong to the newspaper group can review submissions and earlier editions. Other current members can read only the current approved edition, and student readers also need participation authorization. Reader views do not include editorial notes or earlier editions.

A correction removes the current article from the newspaper until the new edition receives adult approval. The writer or an authorized editor can withdraw an article. Withdrawal of participation, removal of the writer's membership, or loss of the approving adult's recorded connection or membership also prevents group readership. Rejoining or renewing participation does not automatically republish old editions. Deleting the source writing project removes its article snapshots. Deleting the student or group removes associated articles and request records. Minimal account audit records follow the account retention rules below. Editors may receive generic queued email notices without student writing, names or group details; their current connection and verified address are checked again before sending.

Current adult editors can assign a submitted edition to another eligible connected adult in the newspaper group, reassign it or clear that choice. We store the selected account, role, edition, exact group and connection memberships and update time. The writer and existing editors can see the current assigned editor's public name; ordinary readers cannot. Only existing editors can browse eligible public-name choices. Assignment coordinates review responsibility but does not grant access or remove other authorized editors' existing access, reassignment or withdrawal rights. It does not approve publication. Removed memberships do not regain assignments after rejoining, and a new student submission starts without an assigned editor. Changes are audited and may queue generic editor notices without assignment names or writing. Deleting the source writing, student or group removes the assignment; deleting the editor removes their account reference and displayed name.

Members can separately confirm sharing a currently approved newspaper edition with S3U support. A report copies only that edition's title, writing, public name, correction note, publication time and the reporter's reason and explanation. It does not copy workshop plans, reflections, private editorial notes or other editions. The reporter and eligible support staff can view the report in a private support conversation, including after group access ends. The reporter, writer, approving adult and participation authorizer are excluded from reviewing that report as staff. Staff access requires support permissions and additional sign-in verification.

Support can put the reported article on hold or release that hold. A release does not republish it: a new student submission and adult approval are required. Private staff reasons and reporter explanations are not shared with the writer or group. General updates may be queued to verified account addresses without the article or report text; support replies also appear in the reporter's Messages. Deleting the source writing, writer or group removes selected article evidence, but existing private support replies and fixed reviewer exclusions may remain under the support retention rules. Deleting the reporter removes their support conversation. Normal backup retention and authorized-disclosure rules apply.

New article-hold and release decisions also create private notices for the writer, with a general explanation, edition and date. A hold notice keeps a copy of that writer's selected title, writing and correction, but not the original reporter's identity or explanation, private staff reasons or editorial notes. Connected adults and staff do not receive access to the writer's notice list. The writer can explicitly share this selected own edition and an explanation in a separate private support conversation to request an independent review. The original moderator, reporter, writer, approving adult and participation authorizer cannot review that appeal as staff.

The independent review response is visible to the writer. A changed or deleted article can receive an answer without changing its publication status; releasing a hold never republishes the article. Generic notices may be queued to the writer's verified account address without the writing or appeal text, and the conversation works without email. Deleting the source writing or group removes the selected writing evidence, but minimal decision notices, existing support replies and fixed reviewer exclusions may remain. Deleting an appeal conversation does not permit a second appeal for the same notice. Deleting the writer's account removes their notices and appeal conversations. Normal support, backup and authorized-disclosure retention rules apply.

Removing the student's group membership removes its authorization; rejoining requires a new authorization. Removing the authorizer or the specific memberships used to establish their connection invalidates that authorization. We keep minimal change records for the student, but a new membership does not inherit the previous membership's private history. Deleting the student or group removes the associated participation records. Deleting another acting account removes its account reference but leaves its recorded public attribution in any retained history. Normal backup retention and authorized-disclosure rules still apply.

Generic transactional receipts are queued for the acting adult and, when different and still connected, the previous authorizer. A student's withdrawal can notify the authorizer. Only verified adult account addresses are used, and current connection, account status and email eligibility are checked again before sending. These notices include no student name, group name or writing. Participation changes do not alter grades, activity, coins or other group memberships.

Private Messages

A new conversation can include a link to one of the selected student's assignments. We store the conversation and assignment references, and record creation of the link in account history without copying the task title or message text into that log. The conversation shows the task's current title and date. The assignment page lists only conversations in which the viewer is already a participant, including their archived conversations; it does not add other connected adults or the student to an adults-only discussion. Removing the task clears its link and displayed task details, but does not delete the participants' messages. Text a participant chose to put in the subject or message remains part of the conversation under the retention rules below.

Private messages are separate from forums. We store the selected student, subject, message text, sender, fixed participant list, send times, read position, archive status and message-block settings. Messages display public names, not account emails or private profile names. Only selected participants with a current messaging connection can read a conversation in the app; a student or another connected adult is not automatically included. Parents connect through the student's Family groups, while instructors connect through shared learning groups. Removing a connection suspends access; reconnecting can restore old conversations. Group membership is not independent verification of guardianship.

Message email notices are optional, off by default, and available only to adults with a verified account email. The outgoing queue stores a generic inbox notice, recipient address and delivery status, not the private message text or subject. We recheck access, unread state and email eligibility before delivery. Students do not need email to use messages. Message settings and blocking changes are recorded in account history without message contents.

Unsent message drafts stay in the open page unless you enable recovery for that tab. This optional feature encrypts the current draft text, subject, recipient and student or conversation identifiers, any assignment link, and any unconfirmed send identifier in the tab's session storage. It requires the same account sign-in and rejects copies more than 24 hours old; expired or unreadable copies are cleared when checked. Restore is explicit and checks current recipients or conversation access before filling the editor. It never sends automatically. Confirmed sends, explicit discard, logout and detected account changes attempt to remove the copy. Storage failures, closing a tab or clearing site data can lose it, and some browsers restore tabs after restarting. This is not an account backup or protection from someone using your signed-in browser or a compromised page. Avoid enabling it on a shared device. Support reports and support-ticket drafts are not included.

Archiving or blocking does not delete conversation history. Messages remain until an applicable deletion request or account deletion: deleting the selected student removes that student's conversations; deleting another participant removes their membership and the messages they sent. This cannot remove copies saved by other recipients, and the backup and authorized-disclosure provisions below still apply. Do not send sensitive personal information in messages. Blocking stops new messages between those accounts, but private messaging is not an emergency service.

Private Message Reports

A conversation participant can choose a received message and confirm sharing it with S3U support. We save a fixed copy of that message, its timestamp and sender's public name, the reporter's selected reason and explanation, and references needed to investigate and prevent duplicate reports. We do not copy the other messages or give staff access to the full conversation. The report and support replies are visible to the reporting account and authorized support staff, not automatically to other participants or connected adults. Reporting does not block the sender.

We retain participant account references internally with the support ticket to prevent involved staff from reviewing the report or its follow-up replies. These references are not a shared participant directory and contain no additional message text, names or email addresses. Confirmation and reply notices use the email queue and contain no selected message or explanation. A verified email is not required to report or read replies in S3U. Selected-message evidence is removed when the reporting account, related student account or support ticket is deleted. Deleting another sender's account removes their linked account reference but does not erase the copy already submitted for review. Minimal conflict-prevention identifiers remain with any retained support conversation until that ticket or its reporting account is deleted, so removing evidence cannot grant involved staff access to the replies. Follow-up support messages have their own support-record retention, subject to the retention and backup provisions below. Support is not an emergency service.

Support Requests

We store support subjects, messages, account references, reply times, status and read acknowledgments. Support updates are recorded in account history without copying their message text. To prevent duplicate submissions, we keep a request identifier, a hash of the submitted details, the resulting ticket reference and revision, and the request time. Deleting a ticket removes its reference from this retry record so an old request cannot recreate it; deleting the submitting account removes its retry records. Verified account addresses receive generic queued notices with a private conversation link, not the conversation text. Support drafts stay in the open page and are not saved in browser storage. The retention and backup provisions below apply.

Forums and Issue Reports

S3U forums and issue reporting tools may store topics, replies, public names, status labels, related page URLs, and moderation information. Shared areas should use public names and should not include private personal information.

Forum discussions and ordinary bug, content or other issue posts are visible to signed-in members. Account and safety issues submitted through the issue form go to private support instead; older issue records already classified as account or safety are excluded from shared forum views.

The reporting account can read its own earlier account and safety issue records in a private archive, including the original title, description, submitted page text, dates and recorded status. This archive does not show other members' replies or give connected adults or staff access to another account's archive. Viewing it does not reopen a report, create a support conversation, send a notice or copy the record into a new store. Records without a remaining reporting account are not exposed through this archive. Current help requests use Support.

To prevent duplicate forum submissions, we keep an account-linked request identifier, a fingerprint of the submitted details, the action, time and links to the saved records. This receipt does not contain another copy of the post text. Minimal receipts remain after a post is removed so a retry cannot recreate it; deleting the submitting account removes its receipts. Forum posting also creates an account activity log. Unsaved drafts and retry identifiers stay only in the current browser page and are cleared when you leave it or change accounts.

Forum blocking stores the two account references, whether your block is active, change times, revisions and duplicate-request protection records. Each account can see and remove only the blocks it created, displayed using public names. While either account has an active forum block, the two accounts cannot see each other's forum topics or posts, or reply to discussions started by the other. This does not erase shared content for other members, change learning access, or replace the separate Messages blocking control. Private support and authorized staff review of existing reports are unaffected.

We log forum block changes and queue a generic confirmation for the account making the change when it has a verified email address and account notices are enabled. We do not notify the other member. Inactive block records and minimal retry receipts remain to prevent old requests from changing a newer preference. Deleting either account removes their block relationship; deleting the requesting account removes its retry receipts. Other retention and backup provisions below still apply.

You can explicitly share a selected forum post and your explanation with support. We retain a fixed copy of its topic title, post text, author public name and date, your reason, account references and duplicate-report protection records. The report and support replies are available to the reporting account and authorized, uninvolved support staff. The reporter, post author and topic creator are excluded from staff review, with minimal exclusion references retained with the ticket. Reporting alone does not hide a post or notify its author.

Authorized support staff can hide or restore a reported post or topic. We record the acting staff account, action, target, reason and time; generic progress notices are queued for the reporter's verified email, without the post or explanation. Hidden content remains stored but is excluded from shared forum reads. Submitted report copies remain after their source post or author account is removed; deleting the reporter or support ticket removes the report copy. Retention, authorized privacy requests and backups follow the provisions below. Forum support is not an emergency service.

For new hide or restore decisions, the author of the affected post or topic receives a private moderation notice in Forums, including accounts without email. It records the author's account reference, content type and identifier, visibility decision, a separate standardized explanation and date. The notice list does not show post text, identify the reporter or expose the private report or staff audit reason. The notice history belongs to the author; linked adults and other members cannot read it through their own accounts. A generic email linking to the notices is queued when the author has an eligible verified address and account notices are enabled. Notice history remains if the original content or report is removed, and is removed when the author's account is deleted, subject to the retention and backup provisions below. Authors can ask support about an older notice using its reference number.

New hide decisions also retain the affected author's text and topic title, the visibility revision and minimal account references needed to exclude involved reviewers. An author can explicitly send an explanation and this saved context for an independent appeal in Support. A topic appeal does not include another member's reported reply. The original reporter, affected authors and original decision-maker cannot review the appeal as staff. The author and eligible support reviewers can see the appeal, decision and replies, but the original report and staff-only reason are not copied into it. Generic email notices omit this content. Deleting the appeal conversation removes its explanation and replies; a marker prevents delayed requests from recreating it. The decision context stays with the author's notice and is removed with the author's account, subject to the retention and backup provisions below.

Avatars, Rewards, Pets, and S3U Bank

My Farm records pretend crops, care, harvests, earned-coin changes and responsibility points. Farm action receipts retain the student's account, request identifier, action type, time and a fingerprint of the submitted options so an interrupted action can be retried without another charge or reward. Account history records the action type, not a complete farm snapshot. Receipts remain after individual journal entries are removed and are deleted with the account, subject to backup retention below. Unconfirmed actions stay only in the current browser page and are cleared when you leave it, log out or change accounts. Routine farm actions do not send email or change academic grades.

S3U may store virtual coins, avatar clothing, hats, accessories, pets, pet care history, pet status, pet run-away events, virtual bank balances, and virtual bank transactions. These features are learning and motivation tools only. They are not real money, real credit, real debt, or real banking services.

Avatar action receipts record the requesting account, student, action type, request identifier, time, and a fingerprint of the requested options so interrupted requests can be retried without repeating a purchase or change. Account history records the action type, not a copy of the chosen appearance. Receipts do not store passwords, payment details, or complete avatar snapshots. Deleting the requesting account removes its receipts; deleting a student removes their reference from another account's receipts, leaving a minimal record to prevent reuse. Backup retention below still applies.

Market Workshop stores a student's pretend shop inventory and dated trade journal: product, quantity, fixed stock cost, selling price, revenue, profit, coin-wallet changes and balances, revisions and duplicate-request receipts. These records belong to that student and are not public shops or messages to other users. The shop has system customers, uses earned game coins and has no real payments or borrowing. Trade records, wallet entries and account-change logs are saved together. Routine trades do not send emails or change academic grades. The free worked example runs in the open page without saving answers.

Shop records remain until the student account is deleted or an authorized privacy request is handled, subject to backup retention below. Deleting the student account removes its shop, inventory and trade records from the active database. Private shop records are not stored in browser storage or included in page printouts.

Product Studio uses built-in colors, patterns and shapes, not uploaded files. Unsaved designs and temporary undo copies stay only in the open page. A student can explicitly save a design for a product they have stocked in their own shop. We retain the selected options, product and account references, revision and update time. Saved designs appear only in that student's private shop; they do not change prices, coins or grades and are not sent to other students or included in email notices. Removing a saved design clears its options from the active record. Minimal revision, action, time, request identifier and hash records remain to prevent delayed requests from restoring removed designs. Deleting the student account removes its saved designs and retry records, subject to the backup provisions below.

Google Login

When a student or adult uses Google or another connected login provider, the provider may send S3U an account identifier, name, and email address. S3U saves the name as the account display name when creating an account or replacing a generic placeholder. This does not replace the separate public name used in forums and shared spaces. S3U stores a verified email address as an account sign-in identifier so approved sign-in methods can reach the same account. The email is shown in the account owner's settings, not shared student lists or forum profiles. Students may still use username-only accounts without an email.

Provider account identifiers remain hashed in the connected-identity records. S3U does not connect accounts merely because someone supplies the same email: matching requires trusted email-ownership verification, and conflicting existing accounts are not automatically merged. Optional progress reports and student-login notifications use the adult's registered, verified account email. We do not ask for a separate report address or verification code.

On your first successful sign-in, we may send a one-time welcome to your provider-verified email address or your verified account email. Accounts without an available verified address do not need to add one. The welcome does not enable recurring emails. The outgoing email record stores the recipient address and message. While a new connected user chooses an account role, the private name and verified email stay in a temporary server-side record. The browser receives only an opaque reference. These references expire after ten minutes, and expired temporary records are removed during subsequent connected sign-ins.

Sign-In Records

We record successful sign-ins with the account ID, sign-in method, and UTC time. These records do not include IP addresses, device details, email addresses, passwords, or login tokens. Routine account checks do not create new sign-in records. Sign-in records are deleted when the account is deleted.

We also record account changes made through S3U, including profile settings, passwords, connected sign-in methods, group membership, and email preferences. Each record identifies the affected account, the account that made the change, the type of change, the field names changed, and the time. These records do not copy names, email addresses, passwords, password hashes, or tokens. You can view your own change history in Account Settings. Records begin when this feature is enabled, not retroactively, and are deleted with the affected account. If an acting account is deleted, its identifier is removed from other accounts' change records.

Technical Information

S3U may collect server logs and security information such as request time, requested page, IP address, browser details, error messages, and deployment or system status. This helps keep the site secure, diagnose problems, prevent abuse, and improve reliability.

How We Use Information

  • To create and protect student, parent, teacher, and tutor accounts.
  • To let authorized adults manage students, groups, assignments, reports, and schedules.
  • To save activity results, scores, grades, time, checklists, and learning summaries.
  • To recommend daily learning tasks and help students practice skills with feedback.
  • To send daily or weekly progress emails when an adult asks for them.
  • To send a one-time first-sign-in welcome when a verified email address is available.
  • To record purchases and send transactional payment updates to the verified paying adult.
  • To operate forums, issue reporting, moderation, and support workflows.
  • To operate virtual coins, avatars, pets, and S3U Bank learning features.
  • To secure S3U, detect misuse, debug errors, and maintain the service.

Children and Student Privacy

S3U is built to reduce the personal information collected from students. We do not need student email addresses, phone numbers, home addresses, payment cards, or real names for basic student login.

Authorized parents, teachers, tutors, schools, or organizations may create and manage student accounts. An authorized adult can ask to review, correct, export, or delete student account information by using the Contact page. We may take reasonable steps to confirm the request is coming from an adult who is allowed to manage that student account.

If S3U learns that unnecessary personal information was posted in a shared area, entered into a student profile, or submitted in an issue report, we may remove it or limit access to it.

Sharing and Disclosure

S3U does not sell personal information. S3U does not use student information for targeted advertising.

We may share information with authorized adults connected to a student account, such as a parent viewing a child's progress or a teacher viewing a classroom group. We may also share limited information with service providers that help operate S3U, such as hosting, email delivery, security, or database services. These providers should only use the information to provide services to S3U.

We may disclose information if required by law, to protect the rights and safety of students or others, to prevent misuse, or to respond to a valid legal request.

Browser Storage, Cookies, and Cache

S3U's direction is to avoid cookies where possible. For login and convenience features, S3U may use browser localStorage or similar browser storage to keep device-side tokens, selected student context, OAuth state, preferences, and temporary interface state.

localStorage stays in the browser on that device until it is cleared by the user, the browser, or S3U sign-out logic. Signing out should remove local login state from the browser, but it does not automatically delete server-side account, progress, or report records.

S3U may use normal browser and Cloudflare caching for static files so pages load quickly. Private account and progress information should be served through protected API routes rather than cached public pages.

Optional first-party analytics is off until you choose Allow anonymous counts. It counts visits to selected public information pages only, not lesson viewing, game play, worksheet answers, messages, or account tools. The analytics table stores only a UTC date, a fixed page path, and a count. It has no account or visitor identifier, IP address, query string, referrer, or device information. Counts are not unique-visitor totals. Old counts are removed after 90 days during the next count or administrator report.

Use Privacy choices on public information pages to accept or withdraw optional counts at any time. S3U remembers this choice in localStorage as s3uPrivacyChoiceV1. Essential only leaves sign-in and requested learning features available. Browser Global Privacy Control or Do Not Track signals keep optional counts off. Withdrawing stops future counts; aggregate counts already collected cannot be linked back to you or individually removed.

To limit spam and repeated sign-in attempts, the server temporarily holds keyed hashes of network addresses or account identifiers with attempt counts. Raw addresses and submitted credentials are not stored in these counters. Counters expire within an hour and are removed on subsequent protected requests; hosting security logs are separate. S3U does not add advertising cookies. External sign-in and checkout services control their own storage when you visit them.

Data Retention

S3U keeps account, group, learning, report, forum, avatar, pet, and virtual bank records for as long as they are needed to provide the service, support learning records, resolve issues, prevent abuse, or meet legal obligations.

An authorized adult may request deletion of an account or student records through the Contact page. Some records may remain for a limited time in backups, logs, abuse-prevention records, legal records, or aggregated statistics that no longer identify a student.

Security

We use Cloudflare Turnstile on sign-in and signup forms to reduce automated abuse. Cloudflare processes browser and network signals for this security check. S3U verifies the resulting token on the server without sending your password, email address, or student records to Turnstile. Our widget does not enable pre-clearance cookies. See Cloudflare's Privacy Policy.

S3U uses practical security measures such as password hashing, protected API routes, private configuration files, database access controls, and limited collection of student information. No online service can promise perfect security, so adults should use strong passwords and keep student login details private.

Your Choices

  • Students may use public names instead of real names in shared areas.
  • Adults can choose whether to receive daily or weekly progress emails.
  • Adults can request review, correction, export, or deletion of student information through the Contact page.
  • Users can clear localStorage in their browser or sign out to remove local login state from that device.
  • Users can disconnect Google login by changing account settings or contacting S3U when account settings are not available yet.

Changes to This Policy

S3U may update this policy as the service grows. If a change is important, S3U will update the date at the top of this page and may provide additional notice in the product or by email when appropriate.

Contact

For privacy questions, student record requests, account help, or issue reports, use the S3U Contact page at s3u.com/contact.

Contact S3U

Open a support conversation for account help, privacy requests, corrections, exports, or deletion requests. Account support requires sign-in.