Privacy Policy

1. Introduction

Arcademy's mission is to help students do their best by giving teachers a clear way to assign, track, and assess game-based learning. Protecting your privacy is fundamental to our mission and business.

This Privacy Policy applies to the Arcademy service for educational institutions and their users, teachers, students, and district/school administrators, accessible via our web application (the "Service"). In this policy, Arcademy ("we," "us," or "our") explains how we collect, use, and protect personal information when you create an account ("Account Information"), add or review class work and evidence ("Class/Assignment Content"), complete assignments, and send Messages within the Service.

At a glance: We collect only what's needed to run Arcademy for schools; rely on school authorization (COPPA school consent) and act as a FERPA school official; we don't sell student data or use it for behavioral ads; hosting is on Microsoft Azure with Cloudflare; we use Microsoft Clarity to understand usage; where a School enables World Sync, we read only Arcademy assignment worlds from students' school OneDrive (see Section 16); parents exercise rights through their school; and we support district DPAs and state student privacy laws.

2. Arcademy and FERPA

When Arcademy is used by a teacher, school, school district, or other educational institution (collectively, "School") for an educational purpose, we may access, collect, or receive Student Data (including information from education records subject to FERPA) provided by the School, by the student under School direction, or created through use of the Service (e.g., submissions, feedback, progress). Arcademy acts as a School Official under the School's control and instructions and uses Student Data only to provide the Service for educational purposes or as required by law. We do not redisclose Student Data except to provide the Service at the School's direction or as legally required, and we do not use Student Data for our own independent purposes. We work with Schools to support FERPA compliance, including assisting with access, review, correction, export, and deletion requests that come through the School.

3. Arcademy and COPPA (PRIVO Safe Harbor)

Arcademy complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from a child under 13 unless a School has authorized student use of Arcademy for an educational purpose. In that case, we rely on the School's consent in place of direct parental consent, and use the child's personal information solely to provide the Service for the School's educational purposes—no other commercial purpose.

Arcademy, Inc. is a member of the PRIVO Kids Privacy Assured COPPA Safe Harbor program. The PRIVO Seal indicates COPPA-aligned practices and PRIVO's oversight and dispute resolution. Questions: (888) 585-9096 or privacy@arcademy.net. If unresolved, contact PRIVO at privacy@privo.com.

4. Who does Arcademy collect information from?

We collect information from people who use Arcademy with a School account:

• Teachers and School administrators who create accounts on Arcademy.
• Students who access Arcademy under School authorization.

Arcademy is not intended for consumer or non-School use, and we do not offer parent self-sign-up.

5. How does Arcademy obtain my information?

We receive information from:

• You: Details you provide when you sign in, set up classes, complete assignments, submit evidence, comment, or contact support.
• Other users: Teachers/admins may provide roster details or link student work to a class.
• Your device(s): Limited technical and log data (e.g., IP address, browser, device type) for security and operation.
• Third-party SSO: When you sign in with Microsoft or Google SSO, we receive minimal profile fields (e.g., name, official School email, and unique ID) as allowed by your identity provider and School settings.
• Your School's Microsoft 365 environment: where your School enables World Sync, we read a student's Arcademy assignment worlds from the Minecraft Education folder in their school OneDrive (see Section 16).

6. What information does Arcademy collect?

We intentionally limit collection to what's needed to provide the Service.

7. How does Arcademy use this information?

We use information to:

• Allow access and operate the Service (authentication, roles/permissions, assignments, submissions, grading, dashboards).
• Provide support and communicate with teachers and schools.
• Provide school administrators with information about how Arcademy is performing in their school(s).
• Improve the Service and develop new features using aggregate analytics.
• Investigate, prevent, and detect assignments on our Service that we believe may violate the law, applicable regulations, or Arcademy policies. We may, at the request of a school, investigate accounts to determine whether they comply with school policies.
• No behavioral ads or selling: We do not sell personal information and we do not use Student Data for behavioral or targeted advertising.

8. Does Arcademy allow third-party advertising or share user data for advertising third-party products?

No. Our business model is straightforward. We do not allow third-party advertisers or data brokers to collect information about your use of the Service for their own purposes, and we do not share personal information for third-party advertising or marketing. We also do not allow in-app purchases for student accounts.

9. In what limited circumstances may Arcademy need to share my information?

We share data only as needed to run the Service and as directed by the School:

Within the School: Student Account Information, Class/Assignment Content, and Messages are shared with authorized School personnel (e.g., teachers, admins) according to School settings.

At the School's request: We help Schools access/export Student Data (including to support FERPA obligations).

Legal/Compliance: To comply with law, regulation, or valid legal request; to protect rights, property, or safety; or to detect/prevent security issues.

Business Transfers: In a merger, acquisition, or sale of assets, we will continue to protect data consistent with this Policy and applicable laws and will notify Schools as required, including choices related to Student Data.

Links to other services: Minecraft Education and other integrated services are governed by their own privacy policies. We encourage reviewing those policies before sharing information with those services.

10. Who can view content posted in Arcademy?

By default, student work is private to the classroom context and available to the student's teacher(s) and authorized School personnel. Teachers control who within the School can view submissions and whether students can view or comment on peers' work, consistent with School policy and platform settings. Public sharing of student content outside the School context is disabled by default and governed by the School.

11. Do you work with third-party analytics services?

Arcademy is constantly improving, and we use aggregate data about how Arcademy is used, for example what buttons you click on or what pages you visit, to inform those decisions. To help us analyze this data, we use a small number of third-party services such as Microsoft Clarity. For more information, please visit Microsoft's Privacy Statement.

12. How do you use cookies?

Cookies are small text files your browser stores. We use:

• Strictly necessary cookies for authentication and session continuity
• Limited analytics cookies (see Section 11) to understand aggregate usage

You can manage cookies in your browser. Disabling essential cookies may affect functionality.

13. How to view, correct, edit, export, or update your personal information

You have the right to access, correct, or download for transport to a similar service any of your Personal Information collected by Arcademy, where permitted under applicable law.

If you are an administrator or teacher you can update the information associated with your Arcademy account directly by logging into your Arcademy account and viewing the Account Settings tab on your profile.

If you are a parent or guardian and want to correct, edit, download, or update information about your child, or to access or inspect the child's personal information or educational records maintained by Arcademy, please direct your request to your teacher or school, or you can contact us at privacy@arcademy.net if you need additional assistance.

14. Account retention and termination

Student Data: Retained only as long as needed for the School's educational purposes. By default, Arcademy retains student submissions and class records for the course term plus up to 12 months (unless your School sets a different policy). Upon verified School request, we delete or de-identify Student Data, typically within 30–60 days, subject to legal and backup constraints.

Teacher/Admin Accounts: Retained while the account is active and as needed for support, security, and legal obligations; deleted upon verified request or contract termination.

Logs & Backups: Security/operational logs are generally retained for up to 12 months; backups follow rolling cycles (typically ~35–90 days).

Some information may persist briefly in support records, system logs, or backups for integrity, security, and legal compliance. We do not delete information that has been properly de-identified.

15. How does Arcademy keep your data safe?

We take protecting your security and privacy seriously. Safeguards include:

• Encryption in transit and at rest
• Role-based access controls and least-privilege practices
• Cloudflare WAF/DDoS and Azure security tooling
• Audit logging and monitoring for anomalous activity
• Secure development and vulnerability management

Breach Notification: If a security incident compromises personal information, we will notify affected Schools without unreasonable delay and within timelines required by law.

16. Minecraft Education World Sync (OneDrive)

Minecraft Education World Sync. Where enabled by your Organization IT, Arcademy reads a student's Arcademy assignment worlds from the Minecraft Education folder in that student's school OneDrive, so progress and evidence appear in Arcademy automatically. Access is read-only — Arcademy cannot modify or delete any file in a student's OneDrive — and is limited by design to assignment worlds, which we identify by a unique Arcademy ID; files that are not assignment worlds are never processed or stored. Each time a student saves an assignment world, Arcademy processes the updated world to record progress and then deletes the world file from its systems; the student's own copy remains in their OneDrive. The feature is off by default, requires approval by your School's Microsoft 365 administrator, and can be revoked at any time from your admin center, which immediately ends Arcademy's access. Data obtained through World Sync is Student Data and is governed by Sections 2, 3, 10, and 14 of this Policy.

17. Changes to our Privacy Policy

Arcademy may from time to time make changes to this Arcademy Service Privacy Policy to account for changes to our practices or applicable law. The "Last Updated" date at the top of this policy indicates when this Policy was last revised. Your continued use of the Services means you thereby agree to the new Privacy Policy. We will not make any material changes to this Privacy Policy that relate to the collection or use of Student Data without first giving notice to the teacher or educational institution and providing a choice before Student Data is used in a materially different manner than was disclosed when the information was collected.

18. Contact Information

Questions or feedback about this Privacy Policy: