Privacy policy

From children with an online login

• A first name or nickname, a grade and an avatar.
• A username, and a password that is either a word or three pictures in order. We store the password only as a salted hash, which can't be turned back into the password.
• A scrambled form of an email address, usually a school email. The device where the email is typed (in the game, or in a grown-up's browser on this website) turns it into a one-way code before sending it, and we scramble that code again with a secret key. We never receive the email itself, and we never send mail to it. We use it only to make sure each person has one account.
• Their game progress and saves, such as missions finished, rewards earned and the adventure journal.
• A record of their practice answers: the question, the answer given, whether it was right and when.
• For each device that stays signed in, a scrambled copy of its sign-in token and a short label such as "Chrome on Windows."

From grown-ups

• Your name, email address and password. Our sign-in service keeps your password only as a hash.
• Your role (parent, home-school parent, teacher or school admin) and the statement you agreed to when you signed up, with the date.
• For teachers and school admins: your school and your classes.
• What you create here, such as classes, skill assignments and their notes.

Collected automatically

To slow down repeated sign-up attempts, we keep a scrambled form of the network (IP) address for one day. Our hosting providers keep routine technical logs, such as IP addresses and request times, to run and protect the service. This website uses cookies to keep grown-ups signed in. The game saves to the device's own browser storage. We don't use advertising or tracking cookies.

Cadets that play offline

A cadet without an online login saves only on the device. We receive nothing from it.

What we don't collect

We don't ask for a birthday, a home address, a phone number or a photo. The game has no chat, and no one can send a message to a child through Comet Crew.

• To run the game and sync a child's progress between their devices.
• To pick practice at the right level and to build the reports grown-ups see.
• To let grown-ups add children, link to them, set new passwords and assign skills.
• To email grown-ups about their account: confirming sign-up, sign-in links and password resets. We don't send marketing email.
• To keep Comet Crew secure and to stop misuse.

We don't use anyone's information for advertising. The reading and math levels and the Ohio readiness estimates in the reports are projections from practice in the game. They are not official NWEA MAP or state test scores, and we label them "projected."

A child's information can be seen by:

• The child, when they're signed in.
• The grown-ups linked to them: their parents or guardians and, if the child is in a class, the class's teachers and the school's admin.

A grown-up becomes linked only by making the child's account, by typing a one-time code from the child's game, or, for a class, when a parent enters the teacher's class code for their child. We keep a record of each link and when it was made. Nobody else who uses Comet Crew can see a child's information.

We also share information with the companies that run Comet Crew for us, and only so they can do that work:

• Supabase, our database, sign-in and server provider. Your data is stored with Supabase in the United States (US East).
• Cloudflare, which hosts the game and this website.
• Our email provider, which sends grown-ups' account emails.

A small number of people who run Comet Crew can reach the database when they need to keep the service working or handle a request, such as a deletion. We do not sell or rent personal information, and we do not share it for advertising. We will share information if a law or court order requires it.

• Every connection to Comet Crew is encrypted.
• The database itself checks who is asking. A grown-up's account can read only the children linked to it, and a child's sign-in reaches only that child's own records. A request that goes around the website still can't reach another family's data.
• Children's passwords, emails and device sign-in tokens are stored only in scrambled form.
• A child's sign-in pass expires after 60 minutes, and the device has to renew it.
• Link codes from the game last 15 minutes and work once.
• We limit repeated sign-up, sign-in and code attempts to stop guessing.

Comet Crew is made for children in grades 1 to 6, and many of them are under 13. The Children's Online Privacy Protection Act (COPPA) gives parents a say in what websites and apps collect from children under 13. Here is how that works with us.

• A child can play with an offline cadet, and then we collect nothing.
• An online login can be made by a parent or guardian on this website, by a teacher or school for school use, or in the game by the child or a grown-up.
• Parents and guardians who sign up here confirm that they are the child's parent or legal guardian.
• Teachers and school admins confirm that they add students for their school, with their school's permission. COPPA lets a school give consent in place of parents when the information is used only for school.
• When a child makes their own login in the game, we collect only the items listed under "From children with an online login." We don't know their email address, and we can't contact them.
• On a shared device, a grown-up can turn on "Only grown-ups can make new accounts here" in the game's Grown-Ups area, behind the PIN.
• We never ask a child for more information than the game needs.

Parents and guardians can see their child's information by linking to their account. You can also ask us to correct or delete it, and you can stop further collection by asking us to delete the online login. Your child can keep playing with an offline cadet. To do any of this, email privacy@cometcrew.app.

When a school or teacher uses Comet Crew, we handle student information on the school's behalf, and we consider it confidential. The Family Educational Rights and Privacy Act (FERPA) protects students' education records.

• We use student information only to provide Comet Crew to the school, its students and their families.
• We never sell student information or use it for advertising.
• Inside a school, the school admin sees every class, and each teacher sees their own classes.
• Removing a teacher from the school, or a student from a class, never deletes a child's account or progress.
• A school can ask us to delete its students' information at any time by emailing privacy@cometcrew.app.

If your school or district needs a signed student data privacy agreement, email privacy@cometcrew.app.

• We keep an online account and its play history until it is deleted.
• "Remove from this device," in the game's Grown-Ups area, deletes that device's copy of a cadet. The online account stays safe.
• Unlinking a child, or removing them from a class, takes away that grown-up's access. It doesn't delete the child's account.
• To delete a child's online account and everything tied to it, or your own grown-up account, email privacy@cometcrew.app from the address on your grown-up account. Include the child's username. We'll reply when it's done.
• We delete sign-up attempt records after one day.

• Play offline. An offline cadet saves only on the device.
• Use a nickname instead of a full name.
• On a shared device, have the game ask for the password each time a cadet opens. A grown-up can turn this on in the Grown-Ups area.
• Set a new password on this website for any child you're linked to.
• Unlink a child, or remove a student from a class, at any time.
• Ask us to show, correct or delete your information or your child's.

When we change how we handle personal information, we'll update this page and the date at the top. If a change affects information we already hold, we'll email the grown-ups on Comet Crew accounts before it takes effect.

Questions, requests or worries about privacy? Email privacy@cometcrew.app. A real person reads every message.