Privacy Notice

This Privacy Notice describes how the Math Assessment Platform (MAP) (flippedmath.com assessment engine) handles account, course, and student information. It applies to teachers, students, parents, and school or district staff who use MAP.

This notice is not a signed Data Privacy Agreement (DPA), legal advice, or a formal compliance certification. If your Local Education Agency (LEA) and MAP execute a DPA (including state NDPA templates), that DPA controls treatment of covered student or LEA data for that relationship—even where it differs from this notice.

Classroom-oriented Q&A with more examples: Data privacy: how MAP handles school and student information and What information MAP collects. Account and acceptable-use rules are in the Terms of Use.

What information MAP collects

MAP stores only what it needs to run instructional assessment: accounts, course membership, assessments, student work, and grades.

• Account and profile — first name, last name, optional display name, email, username, hashed password, account type (Student, Teacher, Parent, or IT Support), organization for teachers via their license group (not a profile field), optional gender at signup (Male or Female; skipping leaves the field empty), last-login / session metadata used to keep a single active session per account, and optional US state and IANA time zone (from last-login IP / browser unless the user locks a manual value in Account Settings; used for operational audience filters, not advertising)
• Course, enrollment, and family links — which students and teachers belong to which courses; pending invite emails until accepted or voided; parent–student–course links when a parent invite is accepted
• Assessment, grades, and student work — attempts, answers, generated problem copies, scores, gradebook calculations, and optional focus-leave lock events (not webcam or remote monitoring)
• Technical and operational data — session and CSRF cookies needed to stay signed in and submit forms; application logs that may include IP addresses and request metadata; transactional email delivery records; paid-course purchase records and disposition export files stored outside the public media URL space

What MAP does not collect by design

MAP does not ask for or store the following as structured profile fields:

• Date of birth or age
• Race or ethnicity
• IEP / 504 / medical / health alerts
• Home address, phone, or transportation details
• Official district or state student ID numbers (unless a teacher types such an ID into a free-text name field)

How MAP uses information

MAP uses account, course, assessment, and grade information to run the instructional service: authoring, delivery, grading, notifications, support, and related classroom operations.

• MAP does not sell student personal information for marketing lists
• MAP does not use student data for targeted advertising inside the product
• In-app notifications and transactional email support invites, verification, and operational alerts—not ad targeting

Who can see what

• Distinct account types — Student, Teacher, Parent, and IT Support each get different capabilities
• Course-scoped enrollment — students appear in a course only after an invitation is created and accepted
• Teacher / co-teacher management — invites, roster actions, and grading workflows are limited to users who can manage that course
• Student grade visibility is teacher-controlled — score release and related assessment options decide what students can see and when
• Parent access is invite-only and course-specific — a parent link grants grade-summary visibility for a particular student in a particular course, not a teacher account and not unrestricted platform access
• Public Library is for shared instructional content patterns, not student gradebooks

How people join (data minimization)

• Students and parents join by invitation — not by open public signup for those roles
• Email verification — new or changing emails go through a verification code flow before the account is fully activated
• Passwords — stored with Django’s password hashing (not plain text)
• One active session per account — signing in elsewhere ends the previous session

Cookies

MAP uses session and CSRF cookies that are required to stay signed in and to submit forms securely. MAP does not use advertising or third-party tracking cookies.

Hosting, transport, and backups

• Production uses HTTPS so browser traffic to MAP is encrypted in transit
• Dedicated application hosting — MAP runs as its own deployed application stack
• Scheduled backups — production routines include regular database and media archives with a retention window so operations can recover from failure
• Sensitive upload paths — certain private files (for example disposition export zips) are stored outside the public media URL space

Exact server region and subprocessors for a signed agreement are confirmed when your district sends a DPA / NDPA packet via Contact Us.

Children’s privacy

Students and parents join only by school-issued invitation. MAP does not market to children or use student data for commercial profiling. Extra care still applies when tools are used with children under 13: collection is minimized to what the instructional service needs, and school-authorized educational use is the intended path.

Integrity features vs surveillance

Optional focus-leave lock can pause an attempt when a student leaves the assessment tab, with teacher unlock from the dashboard. That is a lightweight integrity cue—not webcam monitoring, remote desktop spyware, or a claim of perfect cheat-proofing.

School and district agreements

Many districts require a written DPA before classroom adoption. If your school or district needs a DPA, state addendum, or security questionnaire filled out, use Contact Us and tell us your district, state, and whether you use a standard packet (for example an NDPA / state alliance form).

Records, export, and deletion

To request an export of classroom grades and student work, or optional deletion when a teacher or school leaves MAP, a Teacher starts from Contact Us using purpose District data / offboarding. See District data requests and teacher offboarding.

Parents who need access to grades should use the school-issued parent invite for that course—not a shared student password. Parents or students who contact MAP directly about education records are directed to their school; MAP responds to written LEA requests through support.

Changes

MAP may update this notice as the product matures. Material changes that affect school agreements are handled with districts that have an active DPA process underway. The date at the top of this page is the last update.

Contact

Questions about this notice, DPA packets, or classroom records: Contact Us.