Privacy policy

Accountless for students

Students join a session with a short code — no name, email, or account is required to play a simulation or take a test. Participants are pseudonymous by design: what we store is the choices made inside an activity (a contribution, an offer, an answer), tied to a session owned by a teacher, never to a named child.

The one exception is a certificate: if a learner chooses to put their name on a printable certificate, that name is rendered on their own device and is not stored on our servers.

Teacher accounts

Teachers create an account with an email address and password to run classroom sessions. We store the email and a securely hashed password. Teacher email is used only to operate the account and is never included in any research data or shared with third parties.

Cookie-less analytics

We measure page views with a first-party, cookie-less method. There are no advertising cookies, no third-party analytics SDKs, and no cross-site tracking. We honor your browser's Do-Not-Track signal for optional usage telemetry.

Educational research

Prevolio's activity data is valuable for research on how simulations help people learn and on classroom experimental economics. We use it in two ways, on two different legal bases:

• Anonymized aggregates and anonymized behavioral micro-data (for example, how public-goods contributions change over rounds) are used under our legitimate interest in educational research. This data carries no identifiers and is only ever published as statistics over groups of ten or more.
• Richer session context (country, grade band, class setting, whether the topic was taught first) and short surveys are collected only with a teacher's consent: an opt-in a teacher sets per session, which is off by default.

Children's privacy

Most learners on Prevolio are minors, so we apply the strictest standard of care in every region. The teacher or school acts as the gatekeeper for any research use and can share our parent/school information sheet with families. We never publish a child's name, free-text writing, or any detail that could identify them.

How research data is anonymized

Before any research use, data is de-identified against a published anonymization specification. In short: direct identifiers (emails, join codes, names) are removed; session identifiers are replaced with non-reversible surrogate keys; timestamps are coarsened; free-text writing is excluded from every published dataset; automated participants are filtered out; and any statistic covering fewer than ten students is suppressed.

Data retention and deletion

Gameplay records are kept as an append-only log to keep sessions consistent and to support research. A deletion request is honored at the research layer: the session is tombstoned and excluded from all research views and future exports. Optional usage telemetry is kept for a limited window and then collapsed into aggregates.

Your rights and contact

You can ask what data relates to a session, ask us to exclude a session from research, or object to a particular use. Teachers can turn a session's research opt-in off at any time. For any privacy request, contact us and we will respond promptly.