Student Data Privacy
This page is for school districts, schools, colleges and universities using our equation tools with students: the LTI tool in a learning platform (Canvas, Schoology, Blackboard, Brightspace, Moodle and others), our plugins, or fxEditor in a school's own systems. In short: we do not ask for students' personal information, we keep what a platform sends us for at most 24 hours, and we never sell it, advertise with it or build profiles from it.
It adds to our Privacy Policy; see also the Security summary and the Accessibility Conformance Report.
Our commitments
- Only what is needed. The LTI tool is registered asking for no personal data: no names, email addresses or class lists, no grades, and none of the LTI Names and Roles or Assignment and Grade services.
- The school is in control. We use student data only to provide the service the school has asked for, on its instructions, and under its direct control.
- No sale, no advertising, no profiling. We do not sell student data, use it for targeted advertising, build profiles of students, or use it for any purpose other than providing and supporting the service. The LTI tool, plugins and rendering service show no ads.
- Deletion. Launch data deletes itself within 24 hours. We delete anything else we hold for a school on request, or when its agreement ends.
- Security. All connections are encrypted (HTTPS). See Security.
- We will tell you. If student data is ever involved in a breach, we will notify the school without undue delay, and as the law of its state requires.
What the LTI tool receives
Teachers use the LTI tool to add equations to course content, by LTI Deep Linking. Every LTI 1.3 launch carries some information from the platform, even when, as here, the tool asks for no personal data. This is all of it:
| Data element | Received? | Used for | Kept for |
|---|---|---|---|
| Student or teacher name, email address, photo | Not requested. If a platform is set to send them anyway, they are ignored. | Nothing | Deleted with the session, within 24 hours |
| Opaque user id (an identifier the platform makes up, not a name or student number) | Yes | Linking the editing session to the launch | The editing session; at most 24 hours |
| Role (for example Instructor) | Yes | Allowing content to be added | The editing session; at most 24 hours |
| Course (context) id, and where in the course the equation is going | Yes | Returning the equation to the right place | The editing session; at most 24 hours |
| Platform issuer, client id and deployment id | Yes | Verifying the launch; matching it to the school's licence; counting use per deployment | While the school's registration lasts (these identify the platform, not a person) |
| Class lists (Names and Roles service) | No | — | — |
| Grades, assignments, submissions | No | — | — |
| The equation written (LaTeX) | Yes | Rendering it as an image or MathML for the course page | In the school's course page, for as long as the school keeps it; in our rendering records as below |
Launch records are stored in a database on our servers in New York, United States, with an automatic expiry of at most 24 hours. Usage is counted per deployment — how many equations, not who wrote them.
When students view equations
An equation inserted as an image is loaded from our rendering service (latex.codecogs.com) when anyone, including a student, views the page. Like any web server, it receives the viewer's IP address and the address of the page. It sets no cookies, and does not record the viewer's browser details. We record the time, the equation, the website it was shown on, and the IP address anonymised before it is written (the last part removed, so it identifies a network, not a device). We use these records only to run and protect the service and to count use against the school's licence.
The editor's own files are also loaded from our servers (fxtex.codecogs.com) when a teacher opens it. It remembers display preferences, such as whether to show the LaTeX, in the user's own browser.
FERPA
Under the Family Educational Rights and Privacy Act, we act as a school official with a legitimate educational interest: we perform a service the school would otherwise do itself, under its direct control as to the use and maintenance of education records, and we use any education records only for the purposes the school authorised. We do not disclose them to anyone else except our hosting provider, as the school's agreement allows, or as the law requires. Parents and eligible students who wish to see or correct records should ask the school, and we will help it respond.
COPPA
We do not collect personal information directly from children under 13. The LTI tool asks the platform for none, and students who answer an online quiz give only the candidate number their teacher assigned. Where a school uses our tools with children under 13, it does so for its own educational purposes, and may give consent on parents' behalf as the Children's Online Privacy Protection Act allows; we use the information only for that purpose. Accounts on our website are for teachers [[TODO: minimum age for student accounts and academic licences]].
State student privacy laws
Many US states have their own student privacy laws, such as California's Student Online Personal Information Protection Act (SOPIPA) and AB 1584, New York's Education Law § 2-d, and the Illinois Student Online Personal Protection Act (SOPPA). Their common requirements — no targeted advertising, no sale, no profiling, use only for the school's purposes, reasonable security, deletion on request, and notice of breaches — are the commitments above. We will sign a state's standard agreement, and provide the parents' bill of rights and supplemental information that New York requires.
Data privacy agreements
We will sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA), and the state versions of it, and we will consider a district's or university's own data privacy agreement. [[TODO: link CodeCogs' signed agreements on the SDPC Resource Registry, once signed]] To start one, email support@codecogs.com with your district or institution's name and state.
Deletion and the end of an agreement
- LTI launch data is deleted automatically within 24 hours, without anyone asking.
- On a school's request, or when its agreement ends, we delete the student data we hold for it [[TODO: within how many days]] and confirm in writing. Usage counts with no personal data, and billing records, are kept as our Privacy Policy says.
- Equations in the school's course pages are the school's, and stay in its learning platform.
Contact
For questions about student data, a data privacy agreement, or a request to delete data, email support@codecogs.com with “Student data” in the subject, or use the contact form. CodeCogs is a trading name of Zyba Ltd, registered in England and Wales, company number 5190331.