Student data

• Students sign up with a name, a username, and a password. Email is optional. We do not ask for a birth date, address, phone number, or photo.
• We use student data only to provide Fivefold to the student and their school.
• We never sell student data, use it for advertising, or build profiles for any non-school purpose.
• AI models see a student's answer and the task, never the student's name or email. We do not use student work to train AI.
• Photos of artwork students upload for art and design tasks are seen only by the student, their teachers, and our staff.
• Schools and parents can see, correct, and delete student records.

• Account: the name the student enters (first name and last initial is enough), a username, a hashed password, an optional email for password resets, and a time zone.
• Schoolwork: lesson progress, answers to questions, free-response answers with their scores and feedback, photos of artwork for art and design tasks, flashcard reviews, reading time, test results, and the mastery levels and predicted scores worked out from them.
• Class membership: which classes the student joined and when.
• Security: sign-in sessions and content access, each with IP address and browser type, used to keep accounts secure and to protect licensed content.

The full list is in our privacy policy.

When a school or its teachers use Fivefold with students, the student records we hold are education records that belong to the school. We act as a school official with a legitimate educational interest, under the school's direct control over how those records are used, as the Family Educational Rights and Privacy Act allows.

• We use education records only to provide the service to that school, and we do not re-disclose them except to the service providers listed in our privacy policy, who are bound to the same limits, or when the law requires it.
• Parents and eligible students ask the school to inspect, correct, or delete records. We help the school respond within the time FERPA gives it.
• A teacher can remove a student from a class at any time. The school can ask us to delete a student's records entirely.

Fivefold does not allow children under 13 to sign up on their own. Anyone who creates an account without a class code must confirm they are 13 or older. A student under 13 can join only through a teacher's class code.

For those students, we rely on the school to consent on parents' behalf, as the Children's Online Privacy Protection Act allows when a service is used solely for the school's educational purposes. By inviting students under 13, the teacher and school confirm they have that authority and have given any notice their policies require. We collect only what the service needs, never use it for commercial purposes, and never show ads.

A parent can review their child's information or have it deleted by contacting the school or writing to us at support@fivefoldprep.com. If we learn that a child under 13 created an account without a school class, we delete it.

• A teacher sees, for each student in their classes: name, username, activity, progress, mastery, predicted score, answers, and free responses in the class's courses.
• Students do not see each other's work or names.
• School and district administrators on a school plan see totals by course and by teacher.
• Our support staff can view an account to fix a problem. Every such view is time-limited and recorded.

Free-response scoring, written feedback, short-answer checks, and the tutor use AI models. Point-by-point scoring decisions come from TypeSafe AI's Jev model, reached through OpenRouter. Written feedback and tutor replies are generated through TypeSafe AI's Jev Router, also reached through OpenRouter, which may send the request on to a third-party AI model provider to answer it. We send the task, its rubric or expected answer, and the student's answer, never the student's name or email.

Art and design tasks are the one exception. Jev cannot see images, so a student's artwork photos and what they wrote about each work are sent to an OpenAI model through OpenRouter, only to score them, with data collection by the provider denied. Photos are shrunk on the student's device first, which removes location data, and photos not used in a scored answer are deleted after 7 days.

Scores and feedback are saved with the student's work so the student can revise and the teacher can review. AI scoring can be wrong, and teachers decide any grade that counts.

• Data is stored in Microsoft Azure data centers in the United States, in a database dedicated to Fivefold.
• All connections are encrypted. Passwords are hashed with scrypt. Access by our staff is limited to people who need it and is logged.
• If a breach affects student data, we notify the affected schools promptly and support them in notifying families as the law requires.

• Student records are kept while the account exists, so progress carries over from year to year.
• A school, a parent, or a student can ask us to delete a student account. We delete the account with its progress, answers, and class memberships within 30 days of a verified request.
• At the end of a school agreement, we delete or return the school's student records as the agreement says.

Many states, such as California under SOPIPA, restrict how education services use student data. Our commitments above (no selling, no targeted advertising, no non-school profiles, deletion on request) apply to every student, wherever they live. We sign data privacy agreements with schools and districts, including state model agreements, on request: write to support@fivefoldprep.com.