Privacy Policy

Effective Date: March 3, 2026

Our Commitment to Privacy

Humdrum is a writing tool for 4th–8th graders, used by schools and homeschool families. We follow the Children's Online Privacy Protection Act (COPPA). For schools, we use the school-official path, which allows a teacher or administrator to authorize student data collection for educational use. For families, a parent or guardian provides consent before any data is collected. This policy explains what we collect, how we use it, and the controls available to you.

Data We Collect

Student Content

We store student pen names, writing drafts, completed stories, quest progress, class preferences, and other settings required for autosave and feedback.

For students signing in through Clever: We receive whatever email address Clever provides (if any) and the student's name. Clever IDs are hashed before storage. Legacy accounts that previously stored unhashed IDs are migrated to hashed values and the raw ID is cleared on the user's next sign-in.

For guest/sandbox users: We generate a synthetic email address (not linked to any real email) for account purposes. No real email is collected from the student.

For email-based accounts (multi-writer sign-up): A parent or guardian provides their email address to create the account via a one-time verification code. This email is stored as the account owner's contact for authentication and account recovery. We also offer an optional newsletter sign-up that stores the submitted email address separately.

Teacher Accounts

When a teacher signs in with Clever we receive their email address, name, roster identifier, and school context to configure the classroom. The Clever ID is hashed before storage, and we log a consent record (user ID, version, method, timestamp) after the teacher confirms they are authorized to enable Humdrum.

Guest/Sandbox Accounts

Users can access Humdrum without Clever through our guest login. Before creating any account or storing any data, we require attestation from a teacher, parent, or guardian confirming they are supervising the student's use. We log this consent for audit purposes.

Classroom Roster Data

When teachers sign in through Clever, we sync class information including section names, grades, subjects, and term dates. District and school identifiers help organize classrooms correctly. All Clever IDs (teacher, student, section) are hashed before storage to protect privacy.

Feedback & Bug Reports

Students can submit feedback from within the app. When feedback is submitted, we store the message text, the page URL, and an internal account identifier. The account identifier is a persistent identifier collected solely to support internal operations — specifically, debugging issues that students report. It is not used to build profiles, serve advertising, contact individuals, or for any purpose beyond resolving technical problems.

System & Analytics Data

We collect technical information (browser type, device, timestamps) needed to keep the service secure. Aggregated usage metrics come from Plausible and Vercel; these analytics are used solely to support internal operations (monitoring reliability, improving the service) and do not use cookies, advertising identifiers, or track individual users.

Storage & Security

All application data lives in Supabase (Postgres + Auth) with row-level security so each account can only access its own records. Clever IDs are stored as hashed values, and consent logs help us verify ongoing authorization. Usage analytics are limited to Plausible and Vercel for aggregated, cookie-free metrics. We do not run advertising trackers or third-party remarketing tags.

Writing Analysis

Humdrum analyzes student writing in real time to detect creative techniques such as simile, metaphor, personification, alliteration, onomatopoeia, hyperbole, and imagery. This analysis powers the educational feedback students see — showing them how their writing skills are growing over time.

How it works: As a student writes, the text is periodically sent to Amazon Web Services (AWS Bedrock) for evaluation. The model identifies whether specific creative techniques are present and returns a result. The student's text is processed in real time and discarded immediately by the service — it is not stored, logged, cached, or used for model training.

When it runs: This analysis runs whenever your child writes in the app.

What we store: We store a record of each technique detected, including the technique type (e.g. simile, metaphor), confidence level (high, medium, or low), and which story it was found in. This per-story data tracks a student's writing growth over time. We do not store the text that was analyzed — no student sentences, phrases, or writing excerpts are retained from the analysis process.

Third parties: The cloud service processes the text solely for Humdrum's educational feedback. No student writing is shared with, sold to, or made available to any third party for any other purpose.

Story Sharing

Children can choose to share a story with their account owner — a parent or guardian for family accounts, or a teacher for school accounts. Sharing is always initiated by the child; adults cannot request or pull stories.

What happens when a child shares: A snapshot of the story (text, word count, and associated metadata such as title) is stored so the recipient can read it. For family accounts, the story is delivered via email to the parent's registered email address. For school accounts, the story appears in the teacher's in-app inbox. The snapshot persists even if the child later deletes the original story.

Reactions: The recipient can send a single reaction ("loved") back to the child. The child sees this as a heart icon on their story.

Limits: Children can share one story per day. Each story can only be shared once. Shared stories are only visible to the specific recipient — they are not published or shared with any third party.

How We Use It

Classroom data powers autosave, progress tracking, and teacher feedback. Aggregated analytics help us improve Humdrum and monitor reliability as part of supporting internal operations. We also analyze student writing across all writing activities to provide real-time educational feedback — see "Writing Analysis" above for details. We do not sell, rent, or use this information for advertising or marketing.

Retention & Deletion

We keep personal information only as long as needed for the purpose it was collected. We do not store personal information before consent is obtained.

How Long We Keep Data

Active accounts: Data is retained while the account is actively used.

Inactive family accounts: After 12 months of no sign-in activity, we notify the parent at their registered email. If no action is taken within 30 days, we delete the account and all associated student content, writing data, skill tracking, and account information.

School accounts: At the end of the school year plus 90 days, we notify the teacher or school administrator. If no action is taken within 30 days, we delete student content, roster data, and account information associated with that classroom. Schools may request earlier deletion at any time.

Feedback messages: Deleted when the associated account is deleted, or after 12 months if the account no longer exists.

Consent records: Retained for 3 years after account deletion for compliance defense purposes, then deleted.

Analytics data: Retained in aggregate, de-identified form that cannot be linked to individual users. This data contains no personal information.

Writing analysis: As described in the Writing Analysis section, student text sent for real-time analysis is processed and discarded immediately. Per-story detection records (technique type, confidence level) are stored to track growth, and these are deleted when the account is deleted. No student text is retained.

Deletion Process

When data is deleted — whether by request, inactivity, or school year end — we remove student writing, pen names, quest progress, skill tracking data, account information, and associated feedback from production database. Backups containing deleted data are purged within 30 days.

Your Rights

Parents, guardians, teachers, and school administrators can request a data export or deletion at any time by contacting hello@noticehumdrum.com. We will complete deletion requests within 30 days. You may also request to review any personal information we hold about your child or students.

If a school revokes authorization through Clever, we disable the classroom and delete associated data following the school account timeline above.

Parent, Teacher & School Controls

Parents and guardians can contact us at any time to review, export, or delete their family's data. Teachers and administrators can reach us at hello@noticehumdrum.com to review classroom data, request exports, or withdraw authorization. Withdrawing authorization stops future data collection, and we will delete retained records following the timelines described above.

Contact Us

If you have any questions about our privacy policy, please contact us at hello@noticehumdrum.com.