Privacy Policy

Bear Academy is a classroom platform for planning lessons, presenting, practice, assessment, and student work. It is built and run by a practicing classroom teacher, not a company, and it is used with that teacher’s own classes and colleagues. This policy explains what information the site handles and what we do — and don’t do — with it.

• Teacher accounts: a username, a name, the email address the teacher was invited at, a password (stored only as a one-way hash), and, for two-factor sign-in, an encrypted authenticator key and one-way hashed recovery codes. Teacher accounts are created by invitation; the invitation email is sent through our email provider, Resend, which receives the teacher’s address and the invitation. Resend also delivers security notices about sign-ins and account activity to the site’s operator. Bear Academy never emails students.
• Students: student names and class rosters entered by their teacher, and the work students produce in the platform — practice attempts, assignment responses, scores, and the teacher’s feedback. The teacher may also record each student’s statewide student ID (used to match state and district assessment results), English learner, IEP and 504 status, assessment results (such as CAASPP, ELPAC and STAR), attendance, seating and seating preferences, notes, learning supports and tags the teacher writes, classroom groups and tallies, and, optionally, gender. Live lessons, fact-fluency practice and games keep each student’s answers and scores. Bear Academy does not ask for students’ dates of birth or home languages. Students sign in with accounts their teacher creates, which have no email address. The one exception: if the teacher uses Google Forms and links a form response to a student, Bear Academy keeps the school email address Google recorded for that response, so later results can be labelled (see Google account information below).
• Teacher content: lesson plans, slides, assignments, uploaded files, and calendars a teacher creates or imports.
• Technical data: a sign-in session cookie, a record of each sign-in attempt (the account name, the time and the network address it came from), and ordinary server logs needed to keep the site running and secure.

We do not run advertising, we do not track people across other sites, and we do not sell or rent information to anyone.

Only to provide the platform to the teachers and students using it: showing each person their own classes and work, grading and reporting for the teacher, keeping the service working, and fixing problems.

A teacher may optionally connect their Google account. When they do, Bear Academy receives the account’s email address (to show which account is connected) and access to the Google services the teacher chooses to use — Google Calendar and Google Forms — using only the permissions the teacher approves on Google’s consent screen:

• Read calendar events — to import the teacher’s school-year events (holidays, no-school days, early releases) into their Bear Academy calendar. Only the calendars the teacher ticks are read, and only all-day events unless the teacher also asks for timed ones. When one Google account is connected, each import removes earlier imported events that are no longer selected.
• Create and edit calendar events — only when the teacher chooses to send a Bear Academy calendar entry to their Google Calendar.
• Google Forms that Bear Academy creates (shown by Google as access to “only the specific Google Drive files you use with this app”) — only when the teacher chooses to export an assignment as a Google Form, so Bear Academy can create that form in the teacher’s own Google account and fill in its questions, answer choices, and answer key, and later, when the teacher opens that form’s results, show the teacher its questions, each response’s answers and scores, the email address Google recorded for whoever answered, and any name the student typed. This permission reaches only forms Bear Academy itself created; it gives no access to the teacher’s other Google Drive files or forms.

This Google data is used only to provide those features to that teacher. It is not shown to students or other teachers, not used for advertising, and not sold or shared with anyone else. The access tokens Google issues are stored encrypted in our database and used only to talk to Google on the teacher’s behalf.

A Google Form created this way belongs to the teacher’s Google account, and the teacher decides who it is shared with. It contains the assignment’s questions, choices and answer key and, until every student’s school email is matched, a question asking students to type their name. The form and its responses are kept in the teacher’s Google account. Bear Academy does not send student names or other student information to Google when creating a form. By default the form asks students to sign in to Google so Google records the school email each student answers with; the teacher can turn this off when exporting.

Bear Academy reads the responses students submit to a Google Form it created only when the teacher opens that form’s results. Responses are fetched from Google at that moment and shown only to that teacher; Bear Academy does not save them or copy them into grades, submissions, or the gradebook. When a teacher matches an email address to one of their students, Bear Academy remembers that match (the email address and which student it belongs to) so later results are labelled; the teacher can remove a match from the results panel, and matches are deleted along with the student or teacher record.

Bear Academy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A teacher can disconnect Google at any time from the School Years page. Disconnecting asks Google to revoke Bear Academy’s access and deletes the stored connection (and with it access to Calendar and Forms, including reading results). A teacher can also review or remove access at myaccount.google.com/permissions. Events already imported remain in the teacher’s Bear Academy calendar until they delete them.

Some planning features are optional and only run when a teacher uses them. They send the text or attached materials the teacher chooses to include (for example lesson or course plan content) to a third-party AI provider, Anthropic, to generate suggestions. Bear Academy does not send student names or individual student records to the AI provider: at most it sends class-level counts, and for a class of fewer than 5 students only its size. Text a teacher writes into a planning feature, such as a note about a class, is sent as written. Under Anthropic’s commercial terms, this data is not used to train its models.

Five providers handle information for us, each only to provide its service, under its data processing terms:

• DigitalOcean — hosting, the database and file storage, in the United States, where Bear Academy keeps classroom information.
• Cloudflare — the site’s network security and HTTPS (site traffic passes through Cloudflare), and storage for off-site backups, which are encrypted before they leave our servers with a key Cloudflare does not have.
• Anthropic — the optional AI planning features above.
• Resend — email to teachers, such as invitations, and security notices to the site’s operator. Students are never emailed.
• Google — only for a teacher who connects their Google account, as described above. Forms, their responses and calendar entries the teacher sends are kept in the teacher’s Google account.

Some practice images and embedded Google Slides presentations load directly from IXL and Google, which see the device’s network address.

We may disclose information if the law requires it.

The site is served over HTTPS. Sign-in, or a substitute link a teacher creates, is required to see classroom information, and what a person can see is limited by their role and their classes; a substitute link gives temporary, limited access to one class. Teachers sign in with a password and a second factor. Opening a student’s records, and class views such as the gradebook and attendance, are logged. Backups are encrypted and a copy is kept with a second provider. No system is perfectly secure.

• A school year’s student information is kept until 60 days after that school year ends. Bear Academy then reminds the teacher to delete it and offers a download first; nothing is deleted without the teacher’s confirmation.
• A student’s information is deleted within 10 school days of a request from the student’s school or district, and can be deleted by the teacher at any time.
• Backup copies are deleted within 35 days. Sign-in records and web request logs are kept 90 days, and the log of who viewed a student’s records is kept one year.

Bear Academy is used at a teacher’s direction as part of classroom instruction; students do not sign themselves up. It keeps students’ information on behalf of their school. Parents and guardians who want to see, correct, or delete a child’s information can ask the child’s school or teacher; the teacher can download everything about a student (private notes only if the teacher includes them) or delete it in one step. You can also write to us at the address below.

If this policy changes, we will update the date at the top. Questions, or requests to access or delete information: [email protected].