Privacy Policy

At Ethyra, accessible from ethyra.com, one of our main priorities is the privacy of our users. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.

This Privacy Policy applies only to our online activities and is valid for users of our website and platform with regards to the information that they shared and/or we collect. This policy is not applicable to any information collected offline or via channels other than this website.

By using our website, you hereby consent to our Privacy Policy and agree to its terms.

Information We Collect

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

If you contact us directly, we may receive additional information about you such as your name, email address, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

When you register for an account, we may ask for your contact information, including your name and email address.

Teachers and Graders

Name and email address (via account creation)
Class names and descriptions
Assignment content, rubrics, grading preferences, and AI directives

Students

Name and email address (via account creation)
Submissions (text and files) uploaded for grading
Account type selection (Teacher or Student) during onboarding

Information Collected Automatically

IP address (recorded in audit logs for compliance purposes)
Timestamps for record creation and access events
A sidebar preference cookie (sidebar_state) containing no personal information
Product usage analytics (Microsoft Clarity) on our marketing website and the teacher product experience. Clarity may collect interaction data such as pages visited, clicks, scrolls, and session replays (a reconstruction of on-screen activity). We use this only to understand how people use Ethyra so we can improve the product — for example, fixing confusing flows and improving usability. We do not use Clarity to sell your data, to run ads, or to build commercial profiles for sale. Clarity is not loaded for student accounts. We configure masking so sensitive on-screen content (such as text that may include student work) is obscured in recordings whenever feasible.

How We Use Your Information

We use the information we collect in various ways, including to:

Provide AI-assisted grading of student submissions
Manage classes, rosters, and assignments
Authenticate users and enforce access controls
Maintain audit logs for compliance purposes
Communicate with teachers regarding their account (via Loops; student contacts are deleted during onboarding)
Improve and maintain the platform, including through product usage analytics described above

What We Do Not Do

We do not sell personal information to any party
We do not use Clarity or other analytics to sell user or student data
We do not use student data for targeted advertising
We do not build commercial profiles on students
We do not use student data for AI model training

Cookies

Ethyra uses a first-party cookie (sidebar_state) to store the open/closed state of the navigation sidebar. This cookie contains no personal information, is SameSite=Lax, and expires after 7 days.

Ethyra uses temporary session storage for onboarding status and post-onboarding navigation, which is cleared when the browser tab closes.

On our marketing website and for signed-in teachers, Microsoft Clarity may set cookies or similar storage used for product analytics and session insights. These are not used by Ethyra to sell your data or to serve third-party advertising. Clarity is not enabled for student accounts.

Ethyra does not use advertising SDKs or advertising tracking pixels.

Third-Party Service Providers

Ethyra shares data with the following service providers to operate and improve the service:

Provider	Data Shared	Purpose
WorkOS	Name, email, account metadata	Authentication and identity management
AI Processing Provider	Submission content, assignment materials	AI-powered grading and feedback generation
Loops	Teacher email address	Teacher onboarding emails (student contacts are deleted)
Database Provider	All data described above	Persistent data storage
Microsoft Clarity	Product usage and interaction data (e.g., pages visited, clicks, scrolls, session replays), subject to masking controls; not enabled for student accounts	Help Ethyra understand product usage and improve the website and teacher experience. Ethyra does not use this data to sell personal information or for Ethyra advertising. Microsoft processes Clarity data under Microsoft’s terms and privacy statement.

Except as described above, we do not transfer or disclose your information to third parties for purposes other than operating, securing, and improving Ethyra.

Children's Information (COPPA Compliance)

Ethyra requires users to be 13 or older to create an account, as stated in our Terms of Service. By creating an account, users affirm they meet this age requirement. Ethyra does not knowingly collect personal information from children under 13.

When used by schools and teachers, under-13 students are managed through teacher-created roster entries without requiring their own accounts. Teachers can add students to class rosters and share claim codes for students to link to their roster entries.

Parental Rights

Parents or legal guardians may contact us to:

Review personal information associated with their child
Request deletion of their child's data
Refuse further collection of their child's information

To exercise these rights, contact us by email or direct your request through your child's school.

If you believe that your child provided personal information on our website outside of the school context, we strongly encourage you to contact us immediately and we will promptly remove such information from our records.

Student Data Privacy (FERPA Compliance)

Ethyra is committed to compliance with the Family Educational Rights and Privacy Act (FERPA). When schools use our service, we act as a "school official" under FERPA with a legitimate educational interest in the student data we process.

We are committed to:

Protecting student education records and not disclosing personally identifiable information without proper authorization
Using education records only for the purposes for which the disclosure was made
Not re-disclosing education records to unauthorized parties
Maintaining append-only audit logs of all access to student data
Deleting student data upon school or parent request

Parents and eligible students (aged 18 or older) have the right to inspect and review their student's education records and request amendments to records they believe are inaccurate. These rights are exercised through the student's school.

Data Retention and Deletion

Ethyra retains personal information only as long as reasonably necessary for the educational purpose for which it was collected.

Active class data is retained while the class is active
Archived class data is retained for 45 days after archival
Account data is deleted within 30 days of a deletion request
Audit logs are retained as long as the associated education records exist, as required by FERPA

Account Deletion

Users may delete their account at any time through the account settings. Upon deletion, all associated data (assignments, grades, classes, submissions) is permanently removed. Audit logs are anonymized (personal details removed) while the compliance record is preserved.

Teachers may also delete individual student data through the platform at any time.

Data Security

Ethyra maintains administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personal information. These include:

Encryption in transit (TLS) for all communications
Encryption at rest (AES-256) for all stored data
Role-based access controls with multi-tenant data isolation
Server-side JWT authentication and expiration validation
Parameterized database queries to prevent SQL injection
Append-only audit logging with tamper-proof database triggers

CCPA Privacy Rights (Do Not Sell My Personal Information)

Under the CCPA, among other rights, California consumers have the right to:

Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers
Request that a business delete any personal data about the consumer that a business has collected
Request that a business that sells a consumer's personal data, not sell the consumer's personal data

Ethyra does not sell personal data. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. If a change materially affects the collection, use, or disclosure of children's personal information, we will obtain new consent before implementing the change.

We advise you to review this page periodically for any changes. Changes are effective immediately after they are posted on this page.

Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at hello@ethyra.com.

Consent