TRUST & SECURITY
The safest student data is the data we never collect.
ClassBreak was designed so that students never need accounts, logins, or personal information. This page is the procurement checklist version of that promise — every claim links to the policy that backs it.
No student accounts. Ever.
Students never create accounts, never log in, and never give us an email or password. ClassBreak is operated by teachers, for teachers — the students just play.
Student data deletes itself
The only student data that ever exists is a self-chosen display name during a live game (it need not be their real name), auto-deleted within 24 hours. No real names, ages, emails, or lasting identifiers.
Teacher data, minimal
Only the teacher’s account holds data: name, email, usage statistics, subscription status. Encrypted in transit and at rest; passwords never stored in plain text.
Safeguarding controls built in
School plans include an admin dashboard where designated safeguarding leads manage teacher accounts, audit usage, and can request full data export or deletion for their institution.
EVERY BYTE, ACCOUNTED FOR
Everything we hold, in one table.
| Data | Whose | Why | Deletion |
|---|---|---|---|
| Name & email | Teacher | Account authentication | Deleted with the account |
| School name (optional) | Teacher | Provided by the teacher for their profile and school plans | Deleted with the account |
| Usage statistics | Teacher | Streaks, sparks, course progress | Deleted with the account |
| Subscription status | Teacher | Billing via Stripe | Deleted with the account |
| Class Play display name + optional wellbeing response | Student (self-entered, no account) | Live game participation only | Auto-deleted within 24 hours |
| Technical data (IP address, browser & device type, usage logs) | Teacher | Diagnosing issues & improving the service | Retained only as long as needed for diagnostics |
Analytics are cookie-free and anonymised (Plausible + Vercel Web Analytics). Marketing pixels only load after explicit cookie consent.
SUBPROCESSORS
Who touches the data, and why.
Google Firebase / Google Cloud
Authentication & database
Australia + United States
Stripe
Payment processing (card details never touch our servers)
Global (PCI-DSS Level 1)
Vimeo
Video hosting for game & course videos
United States
Vercel
Web hosting & privacy-friendly analytics
Global edge network
Plausible
Cookie-free, anonymised analytics
European Union
COMPLIANCE
GDPR (UK & EU)
Full rights to access, correct, and delete data on request.
Australian Privacy Act
Compliant, with data stored on Google Cloud infrastructure in Australia and the US.
COPPA
Not directed at children; we do not knowingly collect data from anyone under 13 — and the no-student-accounts design means there is nothing to collect.
FOR PROCUREMENT
Purchase orders
Accepted for school plans — paperwork sent same day.
Invoicing
One invoice for the whole staff, tiered by staff count.
Data export / deletion
Safeguarding leads can request a full copy or deletion of all institutional data.
Refunds
30-day full refund, no questions.
THE FULL DOCUMENTS
Read the policies behind this page.
Something your checklist needs that isn’t here?
Safeguarding leads and business managers get answers within one business day.