Last updated 24 July 2026
The short version
- A student never creates an account. No email, no password, no name typed by a child.
- A teacher types their class list. That list, and what the teacher notices, is the data.
- The class screen at the front of the room is built so it cannot show a student’s name — not by policy, by the shape of the database function it reads.
- We do not sell anything, run advertising, or profile children.
- A school can ask for everything it owns to be exported or deleted, and we do it.
What we store
About a teacher: the email address they sign in with, a display name, their class names, and the join code for each class.
About a student: the display name their teacher entered, which class they are in, which companion they chose, and the moments of the lesson the teacher chose to record — a keepsake for an effort noticed, a quiet answer, a request for help, a note that a classmate was kind. A student is identified inside the product by a random identifier, never by an email address or a school ID we ask for.
Technical: when a screen crashes we record the error message, the code location, the page path and the browser — so we can fix it. That report carries no class, no learner and no lesson content, and nothing can read it back through the app.
We do not collect a home address, a date of birth, a photograph, a voice recording, or location.
Who can see it
Access is enforced by the database itself (row-level security), not by the app being well behaved:
- A teacher sees only the classes they created.
- A student sees only their own companion and their own keepsakes — never a classmate’s.
- The projector reads through one function whose result has no student-name column in it. The room sees the class name, the mission, the clock and a shared light. It is incapable of showing who was recognised.
- Criteva staff do not read class data as routine. It is reachable only for a support request a school makes, or a fault we are asked to fix.
Why we hold it
To run the lesson the teacher asked us to run: to keep a roster so a child can find their own name, to carry a keepsake from a teacher’s laptop to a child’s device, and to keep a prepared lesson so it is there on the classroom computer. That is the whole purpose. Our lawful basis is the school’s instruction — we act as the processor and the school remains the controller of its students’ data.
Where it lives, and for how long
Data is stored with Supabase (PostgreSQL) and the site is served by Vercel. Both are third-party infrastructure providers acting on our instructions; neither is given the data for their own purposes.
A class and everything attached to it — the roster, companions, keepsakes, lesson — exists until the teacher deletes it or the school asks us to. Deleting a student removes that child’s companion and keepsakes with them. Crash reports are kept for 90 days.
What a school can ask for
A copy of everything held about its classes, correction of anything wrong, or deletion of all of it. Write to privacy@criteva.com from a school address and we will respond within 30 days. Parents should ask through their school, which holds the relationship with the child.
Hong Kong schools: this describes our handling under the Personal Data (Privacy) Ordinance. If your school needs a signed data-processing agreement before using the product, ask us for one.
Things we deliberately do not do
- No advertising, no third-party trackers, no analytics that follow a child.
- No public scores, rankings, points, or streaks — by product design, not just policy.
- No selling or sharing of data with anyone for their own purposes.
- No training of AI models on your students’ data.
Changes
If this page changes in a way that affects what we hold or who can see it, we will tell schools using the product rather than quietly editing the page.