Privacy policy

We collect only what the service needs to work.

• Account details. Whether you are a teacher or a student, your name as you enter it, a username, and your password, which we store only as a one-way hash (scrypt) and can never read. Teachers give an email address; for students it is optional. We also keep your time zone (for streaks and daily goals) and your daily goal.
• Learning activity. The lessons you finish, your answers to practice and test questions, your written free-response answers with their scores and feedback, photos of artwork you upload for art and design tasks, flashcard reviews, time spent reading study guides, and the mastery levels, XP, streaks, and predicted scores we work out from them.
• Classes. Class names, join codes, rosters, assignments and due dates, and any units, lessons, or questions a teacher writes.
• Billing, for teachers and schools. Your plan, its status, the courses and class size it covers, and invoice records. Card details go straight to our payment processor, Stripe; we never see or store card numbers. For purchase-order invoices we keep the school name and the invoice email you give us.
• Security records. For each sign-in session: when it started and was last used, your IP address, and your browser type. When course content is opened we log which unit, when, and from which IP address and browser, to enforce licenses and spot bulk copying. We also keep a log of account actions such as sign-ins, password changes, and email changes.
• Messages to us. School and district inquiries (name, email, organization, role, number of students, and your message) and problem reports you send about course content.

On your device. We set one cookie, which keeps you signed in. It cannot be read by page scripts and is not used for anything else. The app also saves a few things in your browser so it works the way you left it: your light or dark theme and flashcard mode, the courses you added to your list, the last course you opened, where you stopped in a lesson or practice set, and progress made offline that has not been sent yet. We do not use advertising cookies, and we do not run third-party analytics or tracking scripts. Our fonts are served from our own site.

• To run the service: save progress, score answers, show students what to study next, and show teachers how their classes are doing.
• To send account and service emails: email confirmation, password resets, trial and billing notices, class seat alerts, and invitations. We do not send marketing email to students.
• To protect licensed content and accounts: enforce licenses, limit the number of active sessions, and detect bulk copying or abuse.
• To answer your questions and fix problems you report.

We never sell personal information, we never use it for advertising, and we never build profiles of students for any purpose other than their schoolwork in Fivefold.

• Your teachers. A teacher sees the name, username, and work of each student in their classes: progress, answers, scores, free responses, and activity, for the courses the class studies. Students in a class do not see each other's work.
• School administrators. When a school or district buys a school plan, its administrators see totals by course and by teacher, such as how many students were active and average mastery.
• Our staff. A small number of people who run Fivefold can see account data to give support and keep the service safe. When staff view an account as its owner would, the session is time-limited, clearly marked, and recorded.
• Service providers who process data for us under contract, only to provide the service:
  • Microsoft Azure (United States) hosts the application and database and sends our email through Azure Communication Services.
  • Stripe processes payments.
  • OpenRouter, TypeSafe AI, and the AI model providers OpenRouter connects us to process text for AI features, and OpenAI (through OpenRouter) scores artwork photos. See AI features.
• When the law requires it. We disclose information when we must to comply with a valid legal process, and we tell the affected school or user when the law allows.

If Fivefold is ever sold or merged, personal information stays covered by this policy, and we will notify you before it becomes subject to a different one.

Some features use AI models: scoring free-response answers against their rubric, written feedback on those answers, checking whether a short typed answer means the same thing as the expected one, and the study tutor.

• Scoring decisions (how many points each rubric row earns, and whether a short typed answer matches the expected one) are made by TypeSafe AI's Jev model, which we reach through OpenRouter.
• Written text (feedback on an answer, tutor replies, and rubric rows that need a calculation or a second look) is generated by TypeSafe AI's Jev Router, also reached through OpenRouter. Jev Router may send the request on to a third-party AI model provider to answer it; we do not choose or see which one.
• Artwork photos are the one exception to Jev. Jev cannot see images, so photos a student uploads for an art and design task are sent, with what they wrote about each work, to an OpenAI model through OpenRouter, only to score them. We ask OpenRouter to use only providers that do not collect or train on the data. Photos are shrunk on the student's device first, which also removes location data. Only the student, their teachers, and our staff can see them, and photos never used in a scored answer are deleted after 7 days.
• We send the least needed: the question, its rubric or expected answer, the relevant course material, and the student's answer (for art tasks, their photos). Never the student's name or email.
• For each AI request we record which feature it was for, which model answered, how long it took, and what it cost, so we can control costs. Scores and feedback on free responses are saved with the student's work so they can review them.
• We do not use student work to train our own AI models.

AI scoring can be wrong. Teachers can see every score, and grades that count are always the teacher's decision.

• Account details and learning activity are kept while the account exists, so progress carries over from one school year to the next.
• When a teacher's plan ends, their classes, rosters, and analytics stay readable for at least 24 months in case they return. They can ask us to delete them sooner.
• Password reset links expire after one hour and email confirmation links after 48 hours. Sign-in sessions end after 30 days without use.
• When an account is deleted, we delete its profile, progress, answers, free responses, sessions, and class memberships. A teacher's classes and the content they wrote are deleted with their account. Some records outlive the account without any link to it: our log of account actions, AI cost records, problem reports, and school inquiries. Payment records that Stripe must keep for tax and accounting stay with Stripe.

• You can change your name, email, time zone, and daily goal in Settings at any time.
• You can ask us for a copy of your data, to correct it, or to delete your account by writing to support@fivefoldprep.com from the email on the account, or through your teacher. We answer within 30 days.
• If you study through a school, your school controls your records. Parents and students can make requests through the school, and we help the school answer them. See Student data.
• Depending on where you live, you may have further rights under local law. We honor them for every user.

Students under 13 can use Fivefold only by joining a class with a code from their teacher, as part of their school's educational program. Anyone who signs up without a class code confirms they are 13 or older. If we learn that a child under 13 created an account outside a school class, we delete it. Our Student data page explains how we meet COPPA and FERPA.

Connections are encrypted. Passwords are hashed with scrypt. The sign-in cookie cannot be read by scripts and is protected against cross-site requests. Teacher accounts can be signed in on 2 devices at a time and student accounts on 3; the oldest session is signed out first. Sign-in attempts and other sensitive actions are rate-limited. No system is perfectly secure; if a breach affects your information, we will tell you and your school as the law requires.

If we change this policy in a way that matters, we will say so on this page and email teachers before the change takes effect. We will not use information already collected in a materially different way without consent. Questions go to support@fivefoldprep.com.