Safety & Data Protection

What we collect

We collect a limited set of information to power focus tracking, streaks, study tools, and GPA features.

• Account basics: email and a securely hashed password
• In-app activity: focus sessions, XP, streaks, quests, boss runs
• Optional academic info: GPA entries, course names, transcript-derived data
• Basic device/usage info: IP address, browser type, and logs for security and reliability

What we never collect

LevelUp is not spyware. We never monitor the full device or student behavior outside the app.

• No keystroke logging
• No browsing history or full URL logs outside LevelUp
• No screen recording or screenshot capture
• No microphone or camera monitoring
• No location tracking beyond optional AR features like city-level AR Hunt events (where clearly disclosed)

Student rights

Students should understand and control what LevelUp knows about them.

• See their own focus history, streaks, and XP
• Edit their profile information
• Request deletion of their account and associated personal data (subject to school requirements)
• Export effort summaries and Proof of Grind style reports to share with adults they trust

Parent & guardian rights

Parents and guardians can ask questions, understand what's being tracked, and request changes.

• Request information about what data LevelUp stores for their child
• Ask for corrections or deletion of student accounts where applicable and aligned with school policy
• Ask how focus minutes, streaks, and study data are being used in school contexts

School & district rights

Schools use LevelUp to support MTSS, 504s, IEPs, and engagement — not as a full SIS.

• Access engagement and effort metrics (focus minutes, streaks, sessions) for students under their care
• Request exports of engagement data to support MTSS, 504/IEP reviews, and student support teams
• Request bulk deletion or anonymization for students tied to their school
• Run pilots without SIS integration and choose how deeply to connect LevelUp into existing systems

Security practices

• Encryption in transit (HTTPS) for all app traffic
• Encryption at rest and modern cloud infrastructure with built-in security features
• Restricted internal access to production data for operations and maintenance only
• Monitoring and logging to detect abuse, suspicious activity, or performance issues

Third-party services

LevelUp relies on a small set of trusted services:

• Stripe for secure payments (we never store full card details)
• Google Sign-In for authentication (where enabled)
• Hosting, logging, and monitoring providers to keep the app reliable and safe
• Analytics tools to understand feature usage and improve the product (without selling student data)