Privacy Policy

Effective date: 2026-08-20

ClassWarm is built on a simple principle: your data stays yours. This policy explains what the service collects, and what we do — and don't do — with it.

1. What we collect

ClassWarm collects only what is necessary to operate the service:

• Account credentials. Your email address and a salted, hashed password.
• Class data you enter. The class names, behaviors, daily marks, and notes you record. This data is encrypted at rest (see Section 5 below).
• Standard server logs. Our application records the request method and path, the response status, how long the request took, a random request identifier, and a timestamp. These logs do not include your IP address or browser user-agent, and they are never used to build a profile of you. They are written to the server's standard output and rotated by the hosting environment; we do not archive them or send them to any third-party logging service.

We do not use advertising networks, analytics services, behavioral trackers, or social media pixels. We do not sell or rent personal information.

One third-party request is made on your behalf: the site loads its typefaces from Google Fonts, so Google receives your IP address and browser user-agent when those files are served. We send Google nothing else and receive nothing back.

2. How we use your information

We use your information solely to operate, maintain, and improve ClassWarm. We do not sell it, share it for marketing, or add you to any mailing list.

3. Student information

ClassWarm is designed to track a class as a whole, not individual students. It has no student accounts and asks for no student names or personal details. Please do not enter personally identifiable information about students into class names, behaviors, or notes.

You are responsible for using the service in line with your school's or district's data-privacy policies and applicable laws (such as FERPA). Because the class data you enter is encrypted under your password, we cannot review it for such information on your behalf.

4. Data retention

We retain your account and class data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us (see Section 10), and deleting a class removes its data immediately.

5. Encryption at rest

Your class data (class names, behaviors, and notes) is encrypted at rest under a key derived from your password. We cannot read this data in the database or in backups — and neither can anyone else, including us.

If you lose both your password and your recovery code, your class data is unrecoverable. We have no mechanism to decrypt it on your behalf. Keep your recovery code in a safe place.

6. Data sharing and disclosure

We do not sell or share your personal information. We may disclose information if required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights or safety.

The service is operated using third-party hosting infrastructure. Such providers may incidentally process request metadata (including your IP address) strictly to deliver the service, and act as our service providers under contract.

Cloudflare. Traffic to ClassWarm passes through Cloudflare, which provides DDoS protection and sits in front of our servers. This means Cloudflare receives your IP address and request metadata, and — because it terminates the encrypted connection at its edge before forwarding to us — it is technically able to observe request and response contents in transit. Cloudflare acts as our service provider and is contractually limited to processing this data to deliver and protect the service. This is the normal arrangement for any site behind a CDN or DDoS filter, but we would rather state it plainly than let "we can't read your data" imply more than it should.

7. Security

We take reasonable technical measures to protect your information. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

8. Do Not Track and cross-site tracking

Some browsers can send a "Do Not Track" (DNT) signal. There is no industry-standard agreement on how such signals should be interpreted, and ClassWarm does not respond to them differently — because there is nothing for them to change. We do not track you across third-party websites or over time, and we do not build behavioral profiles.

9. Children's privacy

ClassWarm is intended for teachers and other adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

11. Contact us

ClassWarm is operated by Shibby Ventures LLC. Questions about this Privacy Policy can be sent to [email protected].