Privacy Policy
How Curio handles student and teacher data
Effective September 28, 2026. Curio makes curriculum games that classes play during a lesson at curiogames.io. This policy covers students who join a class session, teachers who use the console, and visitors to this site. Questions: mbrophy@curiogames.io.
Students: what we collect and why
A student joins with a code their teacher shows. We do not ask for a name, email, photo, voice, location or login, and students cannot create accounts. During the session we collect:
| Information | Why we collect it | How long we keep it |
|---|---|---|
| A nickname we generate (for example BraveOtter7) and a colour | So the teacher can see who is in the room | Deleted within 3 days of the session ending |
| Answers to the check-in questions and three one-tap survey questions | To show the teacher how the class did and whether the game worked | Individual answers deleted within 3 days of the session ending; class totals kept with the teacher's report |
| In-game progress events (which challenge was started, completed or failed) | To show the teacher where the class got stuck | Deleted within 3 days of the session ending; class totals kept with the report |
| Messages typed to Curio, the tutor (up to 500 characters each) | To reply to the student | Deleted within 3 days of the session ending; our processor Anthropic deletes its copy within 30 days |
| A salted hash of the device's IP address and network | To detect abuse of a class code, never to identify a student | Deleted within 10 days |
| A random session token stored in the browser | So a refresh or a dropped connection returns the student to their seat | Removed when the session ends |
We collect no persistent identifier from students for any purpose other than running the session and keeping it secure. Because the data is collected for use in school under a teacher’s direction, we rely on the school’s consent for educational use; parents may contact their school or us to review or delete it.
Teachers: what we collect and why
Teachers sign in with their school Google account through Auth0. We store the name and email address, the class labels a teacher types, the sessions they run, and class-level reports. We keep these while the teacher has access and delete them within 30 days of a request from the teacher or the district.
How we use information
To run the session, generate the tutor’s replies, produce the class report, keep the service secure, and improve the games from class-level totals. We do not use it for anything else.
Who we share it with
Only processors that provide the service, under written terms:
| Processor | Receives | Purpose |
|---|---|---|
| Amazon Web Services (United States, us-west-1) | All of the above, encrypted | Hosting and storage |
| Anthropic PBC (Claude API, commercial terms) | The tutor conversation and the question it is about, with no nickname or identifier; not used to train models; deleted by Anthropic within 30 days | The tutor's replies |
| Auth0 (Okta) and Google | Teacher name and email | Teacher sign-in |
We do not sell personal information, do not share it for advertising, and disclose it otherwise only when the law requires.
What we never do
- No advertising or ad tracking.
- No selling or renting data.
- No profiles of students.
- No use of student information to train AI models.
- No analytics or tracking scripts on student pages.
Security
All traffic uses TLS 1.2 or newer. Data is encrypted at rest. Games run in a sandboxed frame that cannot reach session data. Access to our systems is limited to named staff and logged. We keep a written information security program, review it at least once a year, and will notify affected schools within 72 hours of confirming a breach.
Your choices and rights
A parent may ask their school, or us, to see or delete their child’s information from a session; because we hold no names, the school identifies the session and nickname. A teacher or district may ask us to delete any session, report or account. We answer within 30 days. California residents have the rights described in the California Consumer Privacy Act and the Student Online Personal Information Protection Act; we honor them without discrimination.
Children under 13
Curio is used by students under 13 at school. We collect only what the table above lists, only for school use, and we do not condition a student’s participation on giving more. We do not knowingly collect personal information from children outside a school session.
Changes
We will post changes here with a new effective date and tell districts we work with before a change takes effect.