Privacy Policy

About this policy

RubberDuck is an educational service for reading, speaking, and studying. This policy explains how we handle information about students, parents and guardians, teachers, and school users. Questions and privacy requests can be sent to nihaal@rubberduckai.com.

Information we collect

We collect account and profile details such as name, email address, sign-in identifier, grade, age or age range, and guardian information when needed. If you sign in with Google, we receive the basic account information used to identify you, such as your name and email address, through our authentication provider. Google sign-in does not give RubberDuck access to your Gmail, Drive, contacts, or Google password.

We also collect class membership and invite codes, books and chapters selected, reading and study activity, speaking prompts, answers, recordings when a feature uses the microphone or camera, transcripts, feedback, reports, rewards, and messages submitted to the service. We receive basic device, network, session, and diagnostic information needed to run and secure the service. If a school buys a subscription, Stripe processes payment details and sends us billing and subscription status; RubberDuck does not receive full payment card numbers.

How we use information

We use this information to provide accounts and classes, operate learning activities, generate feedback, show progress to authorized teachers, manage guardian permissions, process subscriptions, maintain safety and security, troubleshoot errors, and respond to requests. Some feedback is generated by AI and can be inaccurate. We do not use Google sign-in data for advertising or sell it.

Who can see or process it

A student can see their own learning experience. A teacher may see class membership, progress, reports, transcripts, and recordings made available for students in that teacher's class. Parents or guardians may request access to their child's information. We use service providers for authentication, hosting and storage, live voice, transcription and AI feedback, billing, and operational diagnostics. These include WorkOS, Cloudflare, Google Cloud, OpenAI, ElevenLabs, Daily, Stripe, and Pydantic Logfire; older accounts may also use Supabase authentication. They process information as needed for the relevant feature. Student work is not posted publicly by default.

Children and recordings

Some features process a child's voice, and Spin and Speak can record video. We seek parent or guardian permission where required and provide a separate children's recording notice with feature-specific details and choices. A parent or guardian can contact us to review a child's information, withdraw permission, or request deletion. We may verify the requester's relationship to the child before acting.

Retention and deletion

Spin and Speak videos approved under the children's recording notice are available to authorized teachers for 30 days, then scheduled for deletion; some earlier recordings have a 14-day period. Other call audio may have a separate, shorter schedule. Deleting a video does not automatically delete its transcript or feedback. We keep account, class, learning history, and billing records while needed to operate the service and meet applicable obligations. To request access or deletion, email nihaal@rubberduckai.com. Some records may be retained where required for security, legal, or accounting purposes.

Security, location, and changes

We use access controls and other safeguards to protect information, although no online service can guarantee absolute security. Our providers may process information in the United States and other countries where they operate. We may update this policy as the service changes and will post the revised date here. Material changes to children's data practices will be handled with any notice or consent required by law.