HeroClass Privacy Policy

Prepared October 11, 2026. This is a draft for review, not a statement that every proposed safeguard or retention process has been implemented. Bracketed items must be resolved before this becomes the effective policy.

1. Who handles your information

HeroClass is operated by Andrew Watts, doing business as HeroClass, at 1390 Deerwood Trail, Oakville, Ontario L6M 2G4, Canada. For privacy questions and requests, contact heroclassstudio@gmail.com.

This policy covers visitors to heroclass.ca, teachers and other adult account holders, and students participating in authorized classrooms. It describes personal information handling; subscription, cancellation, payment and refund rules are in the Terms of Service draft and Cancellation and Refund Policy.

When a school uses HeroClass, it makes decisions about classroom participation and school records. HeroClass operates the platform and has its own privacy responsibilities.

2. Information collected

Teacher accounts: name, school name, account/contact email addresses, authentication information, plan choice, optional signup notes, classroom settings, and account identifiers. Teachers may register using email/password or Google sign-in. Information received through Google sign-in depends on the requested permissions and account configuration.

Student accounts: first name, last initial, gamer tag, teacher/classroom identifiers, avatar class and avatar gender selection, and authentication records. Student registration does not ask for a student email address. Students enter a teacher-provided classroom code and choose a password. The reviewed account flow stores a password hash separately from the classroom profile. A first name and initial are limited identifiers, but linked account and classroom records can still identify a student. Avatar selections should not be treated as verified demographic information.

Classroom activity: depending on the features used, we record student/team membership, XP, levels, game health, powers, virtual currency, classroom economy transactions, quests, game participation/results, activity feeds, and teacher changes to these records. These are classroom/game records and may reveal information about a student's participation or behaviour. Do not submit sensitive medical, safeguarding, or other records the platform is not authorized to handle.

Billing: Stripe processes payments. HeroClass receives subscription/customer identifiers, status, billing-period information, and transaction records needed to administer access and billing.

Support: information you provide when contacting us, including your email and the issue described. Avoid sending passwords, complete card details, or student records unless a secure and necessary process has been agreed.

Technical information: hosting, authentication, payment, and other providers may process IP addresses, browser/device details, request timestamps, error/security logs, and identifiers. Google Ads measurement on certain pages may also process advertising-related identifiers and visit/conversion information for teacher campaign measurement. The tags also appear on public pages; their presence does not restrict collection to signed-in teachers. ## 3. Why information is used

We use information to authenticate users, connect them to the appropriate classroom, deliver classroom/game features, administer subscriptions, respond to support requests, investigate technical problems and misuse, and meet applicable legal obligations. Teacher campaign measurement is intended to evaluate advertising directed at adults considering HeroClass, separately from educational use of student information.

Proposed student-data commitments: we do not sell or rent student information, use it to target advertising, or authorize unrelated AI model training with it.

4. Children and school authorization

Students, including children under 13, may use HeroClass only in an appropriately authorized classroom. The school/teacher and HeroClass must establish the notices, consent, or other lawful authority applicable to their respective activities before processing student information. A classroom code, a child's login, or acceptance of general terms does not replace required parent consent or school approval. HeroClass remains responsible for its own legal duties.

Schools in each country must follow their local educational and privacy rules. Child-consent ages and the circumstances in which a school can authorize processing differ by jurisdiction. HeroClass is reviewing requirements for the school markets it serves, including COPPA and FERPA where applicable. This draft does not establish or certify compliance.

5. Who can see information

Teachers and authorized classroom staff access classroom information to manage the class. Depending on enabled features, classmates may see displayed names/gamer tags, teams, game statistics, activity feeds, and other classroom/game interactions. Information shown on a classroom screen may be visible to people present.

HeroClass's operator and authorized service providers may access information where needed for support, operation, security, or lawful requests. We may disclose information when required by applicable law or lawful process, or where lawfully necessary to address fraud, security threats, or safety concerns. Disclosure must be limited to what is appropriate for the purpose.

6. Providers and international processing

Google Firebase/Google Cloud: hosting, account authentication, database storage, and backend functions. Some reviewed functions run in the US central region. Google's published information says Firebase Authentication processes data in the United States. HeroClass does not promise Canadian-only storage.

Stripe: payment checkout, subscription management and billing. Stripe processes payment and fraud-prevention information under its applicable terms and privacy notice.

Google Ads: teacher marketing measurement on pages where the Google Ads tag is enabled. This is a different purpose from operating student/classroom accounts.

Email/support providers: contacting heroclassstudio@gmail.com sends information through Google's Gmail service.

Providers may process information in other countries, where laws and lawful government-access rules may differ.

7. Cookies and browser storage

HeroClass uses browser storage such as local storage and session storage to remember classroom context, tool preferences or state, and certain gameplay requests. Authentication can persist sign-in state using browser storage, including IndexedDB. Sign out on shared devices. Clearing or blocking storage may sign you out or affect features; it does not delete server-side classroom records or cancel billing.

Google Ads tags currently appear on the main homepage, teacher signup, teacher dashboard, marketing homepage and payment-success page in the reviewed source. These tags can use cookies and similar technologies for advertising measurement. Stripe checkout and Google sign-in may also involve provider cookies. HeroClass therefore does not claim to be cookie-free.

Planned consent controls will disable optional teacher advertising measurement until an affirmative choice wherever required, allow rejection without loss of core service access, and support withdrawal through Cookie Settings. These controls have not yet been implemented or verified. Essential authentication/security storage is separate from optional advertising measurement.

8. Retention and deletion

Proposed classroom retention policy: each classroom's school-year cycle lasts 12 months. Student/classroom data for that cycle is retained for another six months, then deleted, for a total of 18 months from the cycle's start. Teacher accounts remain while active; subscription and cancellation rules are in the Terms. When cancellation takes effect, that account's student/classroom data is deleted; returning users must resubscribe and start fresh.

The scheduled classroom deletion process has not yet been implemented or verified in this drafting work. Cycle dates, advance notice, and backup/provider deletion schedules remain to be finalized.

Teacher account records, invoices and legally required records are distinct from classroom data. Some information may need to be retained to comply with law or resolve a dispute.

9. Access, correction and other rights

Contact heroclassstudio@gmail.com to request access, correction or deletion, ask about retention, or raise a privacy concern. Parents and students may also contact their school about school-controlled records. We will coordinate as appropriate without using that referral to avoid HeroClass's own duties. We may verify identity and authority in a proportionate way before releasing or changing records.

Depending on applicable law, you may also have rights to withdraw consent, object to processing, restrict processing, or receive portable data. Withdrawal does not make earlier lawful processing unlawful and may affect features that require the information. We will explain any lawful limitations and respond within applicable deadlines. You may complain to the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada, the Ontario IPC for applicable school-board matters, an EU supervisory authority, or the Australian OAIC, as appropriate.

10. Security and changes

The reviewed system uses authentication, hashed student passwords in the account flow, and classroom permission rules. No system is completely secure. We will update this policy when practices change, identify its effective date, and provide notice of material changes. New uses or disclosures will require any additional lawful authority or consent required by law; continued use alone does not replace that requirement.

---