Student privacy

What we promise schools about their students’ data, in one place.

The short version

• No adverts and no tracking. Students in school classes, and anyone who tells us they are under 13, see no adverts, and Google Analytics does not run for them. Once one of them signs in on a computer, that browser stops loading both, on every later visit too.
• Nothing public. In a school class, profiles, photos, share links and names on the public leaderboards are all switched off. In open races, strangers see "Typist 123" instead of a student's name.
• Never sold. We do not sell, rent or trade student data, and we do not use it for marketing.
• The school decides. Teachers can delete the accounts they made, or a whole class; students can leave a class and delete their own accounts. Deleted data leaves the live site at once and our backups within 14 days.
• We sign agreements. We will sign a data privacy agreement with your school or district, including the Student Data Privacy Consortium's National Data Privacy Agreement.

What we keep about a student

For a student a teacher adds with picture sign-in: the name the teacher typed, turned into a sign-in name such as "AminaK", the two pictures that are their password, and the class they belong to. These accounts have no email address and no typed password.

For a student who makes their own account: the name they chose, a scrypt hash of their password (never the password itself), an email address only if they add one, and their year of birth if we ask for it.

For both: their results (speed, accuracy, time taken, and which test, lesson or class task it was), their XP, streak and lesson progress, and their badges. Every run is replayed on our server key by key to check it, and the record of key presses is then thrown away: we keep the numbers, not what was typed.

Like any website, our server sees the internet address a device connects from. We use it to stop abuse, such as too many sign-in attempts, not to identify anyone. To count visits we keep a random id for each browser with events such as "finished a test"; these stay on our server.

What we never do

• Show adverts to students in school classes or to anyone under 13, personalised or not.
• Send their visits to Google Analytics or any other outside tracking service.
• Sell, rent or trade student data, or use it to build profiles for marketing.
• Make a student's name, results or photo public, or let a school class make share links.
• Send students marketing email. The only emails are about their own account, such as confirming an address or resetting a password, and progress reports they turned on themselves.
• Use student data for anything except running CamelKeys for the school and keeping it safe.

Who can see what

A teacher sees the names, results and progress of the students in their own classes, and nothing about those students from anywhere else on the site. Students see their own results and their class's tasks. The site's owner can see stored data when it is needed to keep the site running, answer a support request or deal with a security problem.

Deleting data

A teacher can remove a student they added with picture sign-in, which deletes that account and all its results. Delete this class, at the bottom of a class's page, deletes the class, its tasks and every account the class made. Students who joined with their own accounts can leave a class, unless their teacher made the account, and anyone can delete their own account from the Account page.

A school or district can also ask us to delete the data of all its students: write to us from a school address, tell us which classes, and we will confirm once it is done.

Deleted data disappears from the live site straight away. We keep a daily copy of the database for 14 days in case something breaks, so a deleted record is gone from every copy within two weeks.

COPPA, FERPA and state laws

COPPA. The US Children's Online Privacy Protection Act lets a school give consent, in place of parents, for its students under 13 to use an online service for the school's own educational purposes, as long as the service uses their information only for that. That is how we use it. The Federal Trade Commission's updated COPPA rule has applied since 22 April 2026.

FERPA. When a school uses CamelKeys, we act as a "school official" under the exception in FERPA for services a school hands to an outside provider: we are under the school's direct control in how its students' education records are used and kept, we use them only for the school's purposes, and we do not pass them on.

State laws. Many states have student privacy laws of their own. California's Student Online Personal Information Protection Act, for example, bans targeted advertising to students and the sale of their information. The commitments on this page are written with laws like these in mind, and a signed agreement can set out your state's terms in full.

Data privacy agreements

We will sign a data privacy agreement with your school, district or state alliance. The Student Data Privacy Consortium's National Data Privacy Agreement, which most state alliances use, is the quickest: send us your state's version. Once one district in a state has signed with us, others there can usually join the same terms without starting again.

Security

• Every page and every request uses HTTPS.
• Passwords are stored only as scrypt hashes, and picture sign-in attempts are limited for each student and each internet address.
• Sign-in uses a cookie that scripts on the page cannot read.
• Results are worked out again on our server from the key presses, not taken from the browser.
• The database sits on a single server that only we can reach, with a daily backup kept for 14 days.

Services we use

CamelKeys runs on a server we rent from a hosting company. Beyond that, outside services see student data only in these cases:

• Email delivery: if a student added an email address, an email service sends the messages about their account and any reports they asked for. Picture sign-in accounts have no email address.
• Google: only if a student chooses to sign in with Google. Google tells us their Google account's id, email address and name; the name only suggests a sign-in name and is not kept.
• Anthropic: only if a student asks for an AI coach plan. The numbers from that test (speed, accuracy, slow keys and letter pairs, and the language) go to Anthropic's service to write the plan. No name and no typed text.
• Payments: payment companies handle Premium purchases. School classes are free, and no student ever needs to pay.

If something goes wrong

If student data is ever exposed, we will tell the schools affected as soon as we know, explain what happened and what we are doing about it, and meet the notice times in the law and in any agreement we have signed with you.

Questions

Write to hello@camelkeys.com. The full privacy policy covers everyone who uses the site, and for teachers explains how classes work.