The short version

• We collect only what we need to run Trinket.
• We never sell personal information, and we never use student data for advertising, marketing, or building profiles.
• Schools can create zero-data student accounts with no real name or email.
• When a school uses Trinket, the school controls its student data and we act on its instructions.
• You can ask to see, correct, export, or delete your data at any time: trinket@strivemath.com.

Who we are

Trinket at trinket.strivemath.org is a community-hosted, open source edition of Trinket run by Strive Math ("Strive", "we", "us"), an education technology company based in Singapore.

Our Data Protection Officer can be reached at trinket@strivemath.com. This policy covers Trinket only. Strive's other products are covered by the Strive Math privacy policy.

If you had a trinket.io account

Trinket was first run by Trinket.io (Forkable, Inc.). When trinket.io closed, its founders open sourced the service, and we now run it so that students and teachers can keep their work. Your account, trinkets, courses, and uploaded files were moved to this site. We use them only to run Trinket for you, under this policy.

If you'd rather we didn't keep them, email trinket@strivemath.com and we will delete your account and its work.

Zero-data student accounts

A school can give each student a login that holds no personal information at all: no real name, no email of their own, no date of birth. We call these zero-data student accounts. The school keeps the list of which student has which login; it never comes to us.

The placeholder email looks like lin482k@usernames.strivemath.com. It exists only because our sign-in system needs an email field. It is not a real inbox, and nothing is ever sent to it. Password resets for these accounts go through the student's teacher instead.

Only accounts a school creates under Organization, then Add students, are zero-data. Anyone who signs up on their own uses an email address or a Google account. Joining a class with a class code (/courses/join/…) needs a login first, so a student joining that way uses whichever kind of account they already have.

These accounts are pseudonymous, not anonymous. Class membership and the work a student writes can still identify them, so we treat everything in them as protected student data.

Creating them

1. Open Organization in the top bar and pick your school.
2. Choose Add students, enter how many students you need, and optionally pick a group and a course.
3. Download or copy the list and hand each student their login.

Passwords are shown once and stored only as a hash. A teacher can set a new one later, for one student or a whole group.

Children and students

Trinket is used in schools, including by children under 13. Our approach follows the US Children's Online Privacy Protection Act (COPPA) and similar laws elsewhere.

• Through a school. When a school or teacher creates student accounts, the school gives consent on behalf of parents for the educational use of Trinket. The school confirms it has the authority to do so. We use student data only to provide Trinket to that school.
• On their own. Children under 13, or under the age of digital consent where they live, should not create their own account. They should ask their teacher for a school login. If we learn that a child has signed up without the consent they need, we will delete the account.
• Parents. A parent can ask to see or delete their child's data. For school accounts, contact the school first, since only the school knows which login is your child's. We will work with the school to act on your request. You can also email trinket@strivemath.com.

Our commitments on student data

• We never sell student data.
• We never use student data for advertising, for marketing, or to build profiles for any purpose other than teaching.
• We use student data only to provide and improve Trinket for learning, and only as the school directs.
• We never show ads to signed-in students, in classes or courses, or in trinkets embedded on school pages.
• We won't make a material change to how we use student data without telling schools first.

For schools

For student accounts in an organization, the school is in charge of the data. We process it only on the school's instructions. In GDPR terms the school is the controller and we are its processor.

United States. Where student data is an education record under the Family Educational Rights and Privacy Act (FERPA), we act as a "school official" with a legitimate educational interest. The school keeps direct control of the records, and we don't share them except as the school allows or the law requires. We aim to meet state student privacy laws, such as California's SOPIPA and New York's Education Law 2-d.

Data protection agreements. If your school or district needs a signed agreement, such as a state or SDPC student data privacy agreement, send it to trinket@strivemath.com and we will review and sign it where we can.

When a school leaves. An organization admin can remove students at any time. To delete the organization, all its student accounts, and their work, email trinket@strivemath.com. We complete the deletion within 30 days and can confirm it in writing.

What we collect

Account information

• Teachers and individual users: a username, an email address, and a password, or a Google account. With Google sign-in, we receive your name, email address, and profile picture from Google. A display name is optional.
• School students: see zero-data student accounts above. Schools can also add students who already have their own account, which then works like any other account.
• Passwords are stored salted and hashed, never in plain text.

Work you create

Your trinkets (code and file names), courses, assignments, submissions, teacher feedback, and uploaded files. When you run Python 3, Java, R, or Pygame code, it is sent to our code runners, run, and not kept there. Other languages run in your browser. If you publish or share a trinket, anyone with the link can see it, so don't put personal information into work you share.

Organization and class data

The organization's name, its staff and their roles, its groups and classes, and which students are in each. Only that organization's members can see it.

Technical data

• Server logs: IP address, browser type, pages requested, and times, for security and fixing problems.
• Error reports: when something breaks, a report of the error and the page it happened on. They never include your account details, cookies, or code.
• Cookies: one session cookie keeps you signed in. We use no marketing, advertising, or tracking cookies.
• Your browser: the editor keeps a backup copy of your unsaved code and your editor settings in your own browser's storage, so work isn't lost if the connection drops. This stays on your device.
• Analytics: Trinket loads no third-party analytics or session recording.

How we use it, and why

We don't make automated decisions about you that have legal or similarly significant effects.

Advertising

Trinket does not show ads today. If we start, these rules will apply, and we will update this page and name our ad partner before any ad appears:

• Ads only for visitors who are not signed in, on public trinket pages.
• Never to signed-in students, never in classes, courses, or organization pages, and never in embedded trinkets.
• Contextual ads only, based on the page and not on you. No behavioural or cross-site targeting.
• Ad data is never combined with account or student data.

Who we share data with

We share personal information only with these service providers, under contracts that let them use it only to provide their service to us:

We will update this list before adding a new provider that handles student data. We also disclose information when the law requires it, or to protect the safety of our users or the service. If Strive is ever merged or sold, this policy will continue to apply to the data, and we will tell you first.

International transfers

We are based in Singapore, and our providers mainly store data in the United States. When we transfer personal data out of Singapore, the EU, the UK, or other countries with transfer rules, we rely on our providers' data processing agreements, including the standard contractual clauses approved for that purpose, so the data keeps a comparable level of protection.

Security

• All traffic is encrypted in transit (HTTPS).
• Data is encrypted at rest by our database provider.
• Passwords are salted and hashed.
• Organization data is visible only to that organization's members, with role-based access.
• Code runs in isolated sandboxes, separate from the database.
• Only the small team that runs Trinket can access production systems.

If something goes wrong

If a breach affects personal data, we will notify affected schools and users without undue delay, and within 72 hours of confirming it where the law requires. We will also notify the regulators the law requires, including Singapore's Personal Data Protection Commission.

How long we keep data

Your rights

Depending on where you live, you can ask us to:

• see the personal information we hold about you;
• correct it;
• delete it;
• give you a copy in a format you can take elsewhere;
• stop or limit a use of it, or withdraw consent.

Email trinket@strivemath.com. We reply within a few working days and complete requests within 30 days. We may need to check it's really you first. You can also download any trinket yourself from the editor.

For a school student account, we will work through the school, since only the school knows who the account belongs to.

If you're not happy with our answer, you can complain to your data protection regulator. For example: Singapore's PDPC, the UK's ICO, your EU country's data protection authority, or Quebec's Commission d'accès à l'information.

Changes to this policy

When we change this policy, we update this page and the date at the top. For a material change, especially one about student data, we will email organization admins and teachers at least 30 days before it takes effect. We won't use data already collected in a materially different way without the consent the law requires.

Contact

Questions, requests, or concerns: trinket@strivemath.com. This address reaches our Data Protection Officer.