Privacy policy

Effective date: October 18, 2026. Last updated: October 18, 2026.

This policy explains what Vibe Maker Academy (“we”) collects, why, who can see it, and how to have it deleted. It covers the Vibe Maker Academy app and this website. Vibe Maker Academy is a product of Young and Refined (Tzvi Grossman, doing business as Young and Refined, 249 South Highland Avenue, Los Angeles, CA 90036). A shorter version for kids is at Privacy for kids.

The short version

We collect the least we can. For a child: first name and last initial, grade, an avatar, a picture password or code, and their answers.
We use it only to run the homework service for the teacher, school or parent who set it up.
No ads. No selling. No tracking. We never use children's data to train AI.
A parent or school can see, download or delete a child's data, or stop us collecting more. Write to info@vibemakeracademy.com.

This website

This website (vibemakeracademy.com) sets no cookies, runs no scripts, has no forms and loads nothing from other companies. Our host, Cloudflare, handles the network traffic needed to show you the pages (such as your IP address) and to protect the site from attacks. We do not keep visitor logs.

What we collect from grown-ups

Teachers, parents and school staff (“grown-ups”) sign in to the app. For them we keep:

Account: name, email address, time zone, and the role (teacher, parent, admin).
Sign-in: there are no passwords. We email a one-time sign-in link, or you can use a passkey (Face ID, fingerprint, Windows Hello). For a passkey we keep only its public key, never your fingerprint or face. We keep a list of signed-in devices, named by browser and device type (for example “iPad Safari”).
What you make: classes, question sets, schedules, lesson files you upload, marks you change, and your messages to the AI helper on the Teacher's Desk.
Records of use: a log of important actions (for example, who changed a mark), and a log of each AI request (when, what kind, which model, whether it worked). The AI log never holds the text sent to the AI.

What we collect about children

A teacher or parent adds a child. Children never type an email or make a password. For each child we keep:

First name and last initial (for example “Ava R.”), grade, and an avatar chosen from our built-in set.
Their sign-in: a class code plus a picture password (three pictures in order) or a 6-digit code. It is stored hashed for checking, and encrypted so their teacher or parent can show the sign-in card again.
Which classes and groups they are in, and which teachers and parents can see them.
Their homework: every answer and every try (wrong first tries too), whether it was right, the marks, how long each question took, total active time, which game they played, and the kind of device (phone, tablet, Chromebook or computer, worked out from screen size only).
Help logs coming soon: when the in-game helper is built, the conversation about a question will be saved on that question's paper for the teacher or parent to see.

We never collect from children: email, phone number, home address, birthday, photos, precise location, contacts, or voice or face recognition data.

Why we use it

To run the service: show each child their homework, mark answers, and show teachers and parents the results.
To keep accounts safe and fix problems.
To improve how Vibe Maker Academy works for the teachers and families using it. We do not build profiles of children for any other purpose, and we never use children's data for marketing.

Through a school. When a teacher adds children for school use, the teacher confirms that their school has an agreement covering those students. In school use we act as a “school official” under the US Family Educational Rights and Privacy Act (FERPA): we work for the school, under its control, and use student data only for the school's purpose. Under the Children's Online Privacy Protection Act (COPPA), a school can give permission in place of parents for school use only. To be confirmed: whether a teacher signing up alone, without a school agreement, is enough; until a lawyer answers, we treat this conservatively.
Through a parent. When a parent adds their own child, the parent gives permission as that child's parent. To be confirmed: how we verify that the person is really the child's parent (COPPA requires a verified method).
Extra permission for extras. The AI helper for kids and spoken answers will each need their own separate yes from the school or parent before they are switched on for a child.

How we use AI

Some features use AI: drafting questions, marking written answers, reading text out of an uploaded lesson file, turning a grown-up's speech into text, and the Teacher's Desk chat helper.

The AI runs on Cloudflare Workers AI, the same company that hosts the app. Models used today: Meta's Llama 3.3 (text), OpenAI's Whisper (speech to text, run by Cloudflare), and Cloudflare's own document conversion.
Children's names are never sent to the AI. Before anything goes to the AI, each child's name is replaced with a placeholder such as “Student 1”, and swapped back when the answer returns. To mark a written answer, the AI sees the question, the accepted answers and the child's answer text, with no name.
We never use children's data to train AI, and we do not build our own AI models. Cloudflare says it does not use customer content sent to Workers AI to train models. To be confirmed: this commitment is written into our contract with Cloudflare.
Every mark the AI gives is labelled with the model that gave it, and a teacher can change it. If the AI can't mark an answer, the paper says so and waits for the teacher.
The app can also use Anthropic's Claude, but that is switched off. We will update this page before turning it on.

Voice

Grown-ups: the microphone button on the Teacher's Desk sends the recording to Cloudflare Workers AI to turn it into text. The recording is not stored; only the text you then send is kept.
Children: spoken answers are coming soon and we collect no children's voice today. When we add them, they will need separate permission from the school or parent, be kept only as an answer for the teacher or parent, and this page will say how long we keep them first.
We never create voiceprints or recognise who is speaking.

A child's data is visible only to the teachers and parents linked to that child. A child sees only their own homework and results, never answer keys.
Linking a child's record between a parent and a teacher, and passing it on to next year's teacher, are coming soon. When built, a hand-over will only happen when the school or parent releases it, never automatically.
Our team sees data only when needed to run or fix the service.
We share data with the service providers below, only to run the service, and with authorities only when the law requires it.
We never sell data, show ads, or let advertisers or data brokers have it.

Service providers we use

Cloudflare, Inc. (USA): hosts the app and this website, the database (Cloudflare D1), file storage for uploaded lesson files (Cloudflare R2), the AI (Workers AI), and sends sign-in emails (Cloudflare Email Service).
Google (Gmail): emails you send to our vibemakeracademy.com addresses are forwarded to a Gmail inbox, so Google stores those messages. Please don't email us a child's homework; we can find what we need in the app.

We will update this list before adding any new provider that handles personal data.

Cookies

The app uses only the cookies it needs to keep you signed in (and a short-lived one while you set up a passkey). No tracking or advertising cookies. This website uses no cookies at all.

How long we keep data, and deleting it

We keep a child's data while a teacher or parent linked to that child still uses it. Homework a child answered is kept as their record so it isn't lost when they change teacher or grade.
When a parent or school asks, we delete a child's data. When a school's agreement ends, we delete or return that school's student data as the agreement says.
Sign-in links expire after 15 minutes. Grown-ups' sign-ins last up to 30 days; children's up to 12 hours.
To be confirmed: exact time limits: how many days after a request we delete, how long after a child leaves everyone's access we delete inactive records, and how long deleted data can stay in the database's built-in recovery history. COPPA requires us to publish these; this section will list them.

Parents' rights

If you are a child's parent or guardian, you can:

Review what we have about your child, and get a copy;
Delete it;
Refuse further collection: tell us to stop collecting your child's data.

Write to info@vibemakeracademy.com. We will check that you are the child's parent before sharing or deleting anything. If your child uses Vibe Maker Academy through school, you can also ask the school, which controls that data under FERPA; we help the school answer you.

Security

Everything travels encrypted (HTTPS). Cloudflare encrypts the database and stored files at rest.
No passwords to steal: grown-ups use sign-in links or passkeys. Children's picture passwords and codes are stored hashed and encrypted.
Sign-in cookies can't be read by page scripts. Children's names, answers and sign-in codes are never put in web addresses or in our server logs.
Every request checks who is asking and whether they may see that child.
To be confirmed: our written information security program (named coordinator, yearly risk review) is being written.

If a data breach affects your information, we will tell the affected schools and parents without unreasonable delay, as the law requires. To be confirmed: our target is within 7 calendar days of discovery.

Children and teens

Vibe Maker Academy is made for students from kindergarten to grade 12, with an adult (a teacher or parent) setting up every child. Children cannot sign themselves up. We treat every student's data with the same care, whatever their age.

Changes to this policy

We will post any change here with a new date. Before a change that affects children's data, we will tell schools and parents first, and we will not use data already collected in a new way without permission.

Contact

Tzvi Grossman, doing business as Young and Refined
249 South Highland Avenue, Los Angeles, CA 90036
info@vibemakeracademy.com