PRIVACY_POLICY
Welcome to BalanceBoard ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our student wellness and academic management platform at balanceboard.app. We built BalanceBoard specifically for middle and high school students, and we take your privacy—especially as a minor—with the utmost seriousness.
By using BalanceBoard, you agree to the collection and use of information in accordance with this policy. If you are under 18, we encourage you to review this policy with a parent or guardian. If you do not agree with any part of this policy, please do not use our service.
This policy should be read together with our Terms of Service, AI Disclaimer, Mental Health Disclaimer, and Community Guidelines.
1. Information We Collect
1.1 Account & Identity Information
When you sign in with Google OAuth, we receive and store:
- Full name and email address (from your Google account)
- Profile photo URL (from your Google account)
- Google Account ID (used to uniquely identify you)
- Google OAuth tokens (access token and refresh token, encrypted)
- School name, grade level, and graduation year (provided during onboarding)
- Account role (student or, in the future, counselor)
- Onboarding completion status
- UI preferences (color theme)
- Privacy settings (anonymous mode, DM settings, school name display)
1.2 Google Classroom Educational Data
With your explicit permission via Google OAuth, we access read-only data from Google Classroom:
- Course names, sections, teacher names, and room information
- Assignment titles, descriptions, due dates, and point values
- Your submission status for each assignment (e.g., "turned in," "missing")
- Enrollment codes (stored for sync reference only)
What we do NOT access: The content of your submitted assignments, your grades, your private messages in Classroom, other students' data, or any data outside your own account. We operate with minimum necessary scopes and can never write to or modify your Google Classroom data.
1.3 Academic Task Data
- Tasks you manually create: title, description, subject, due date, priority, status
- Task category and estimated completion time
- Links back to Google Classroom assignments (Google IDs stored as reference)
- Sync history: when we last synced, how many courses and assignments were retrieved
1.4 Wellness & Mental Health Data
This is among the most sensitive data we handle. It is stored with encryption and is accessible only to you. See Section 9 for our specific commitments.
- Daily check-in data: mood (scale), energy level, stress level (1–10)
- Sleep data: hours slept, sleep quality (Good/Fair/Poor)
- Physical metrics: water intake (glasses), exercise minutes, screen time hours, study minutes
- Wellness "wins": boolean flags for daily healthy habits
- Daily notes (free-text journaling)
- Balance score (calculated from above metrics)
- Streaks (consecutive days of check-ins) and badges earned
- AI Wellness Coach conversation history (queries sent to Anthropic's Claude)
1.5 Social & Community Data (Anonymous)
Our Connect Hub features use anonymized names. However, we do associate social actions with your account internally for moderation and safety purposes:
- Study Pod membership, messages sent, files shared, and call participation
- Vent Room messages (auto-deleted after 24 hours) and reactions
- Peer Support Forum posts, comments, votes, and bookmarks
- Report submissions and moderation flags
- Randomly generated anonymous usernames assigned per session/pod
1.6 College Planning Data
- College application tracking (school names, status, notes)
- Target school lists (Dream/Target/Safety categorization)
- Test prep goals and deadlines (SAT, ACT, AP exams)
- This data is stored locally in your browser (localStorage) and optionally synced to our servers
1.7 Technical & Usage Data
- IP address (collected by Supabase and Vercel hosting infrastructure)
- Browser type, version, and operating system
- Referring URL and pages visited within BalanceBoard
- Device type (desktop, mobile, tablet)
- Session duration and feature usage patterns
- API request logs (timestamps and endpoints accessed)
- Error logs (for debugging — contain no personal content)
1.8 AI Interaction Data
- Messages you send to the AI Buddy or AI Wellness Coach
- AI responses generated for you
- Your current task list and workload context (sent to AI to enable intelligent responses)
- Stress and wellness signals detected in your conversations
- Natural language commands for task creation/deletion
See our AI Disclaimer for full details on how Anthropic processes this data.
2. How We Use Your Information
We use the information we collect to:
- Provide core services: Syncing your Google Classroom assignments, displaying your task dashboard, tracking wellness metrics, and enabling community features.
- Power AI features: Sending your task data and messages to Anthropic's Claude models to generate intelligent responses, detect stress, and provide wellness coaching.
- Personalize your experience: Calculating your balance score, generating wellness insights, and tailoring AI responses to your specific workload and stress patterns.
- Maintain safety and moderation: Linking anonymous social actions to real accounts internally so we can enforce our Community Guidelines and respond to reports of harmful behavior. Your anonymity is protected from other users, not from safety review.
- Send important notifications: Reminders for upcoming assignments, wellness check-in prompts, and security alerts about your account.
- Improve the platform: Analyzing aggregated (non-personally-identifiable) usage patterns to understand which features are most helpful and fix bugs.
- Comply with legal obligations: Responding to valid legal processes, protecting our rights, and maintaining records required by law.
- Crisis response: If we identify a genuine risk to your safety through your use of the platform, we may take action including referring you to emergency resources. See our Safety Policy.
3. Data Sharing & Disclosure
Core Commitment
We do not sell, rent, or trade your personal data to anyone, for any purpose, ever. We do not use your data for targeted advertising or share it with data brokers.
3.1 Service Providers (Sub-processors)
We share data with the following trusted third-party services to operate BalanceBoard. Each is bound by data processing agreements and privacy obligations:
Supabase (Supabase, Inc.)
Our database and file storage provider. All your data (profile, tasks, wellness entries, social data) is stored on Supabase-hosted PostgreSQL servers. Data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified.
Data shared: All user data stored in our platform.
Anthropic, PBC
Our AI provider. When you use the AI Buddy or AI Wellness Coach, your messages and relevant context are sent to Anthropic's Claude API for processing. Anthropic's API usage policy prohibits them from training on API-submitted data by default. See AI Disclaimer for full details.
Data sent to Anthropic when using AI Buddy: Your sanitized message (up to 500 characters), last 6 messages of conversation history (sanitized), task titles and due dates, and workload summary statistics (total pending, overdue count, subject breakdown). Your name and school name are included in context so the AI can address you personally. Your email, Google ID, and OAuth tokens are never sent.
Data sent to Anthropic when using AI Wellness Coach: Your last 7 days of wellness check-in data including mood, sleep hours, stress level, energy level, water intake, exercise minutes, screen time, outdoor minutes, social quality rating, and daily journal notes (if entered). This data is sent as structured text, not linked to your name or email.
NOT sent to Anthropic: Your email address, Google account ID, OAuth tokens, Vent Room messages, other users' data, or uploaded files.
Google LLC
We use Google OAuth for authentication and Google Classroom APIs for assignment syncing. Your authentication tokens are stored encrypted. We operate under Google's API Services User Data Policy, including the Limited Use restrictions detailed in Section 4.
Data shared: OAuth tokens exchanged during login; Classroom API calls with your credentials.
Vercel, Inc.
Our hosting and deployment infrastructure. Vercel may log IP addresses and request metadata for operational purposes per their privacy policy.
Data shared: Request logs, IP addresses (infrastructure-level only).
3.2 Legal Disclosures
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency subpoena). We will notify you of such requests where legally permitted.
3.3 Safety Emergencies
If we have a good-faith belief that disclosure is necessary to protect the safety of any person (including you), we may share information with emergency services, school authorities, or law enforcement. This is a last resort and only applied in genuine crisis situations. See our Safety Policy.
3.4 Future: School Counselor Access
We are developing features that would allow licensed school counselors to access student wellness summaries with the student's explicit, opt-in consent. This feature is not currently active. Before it launches:
- You will be clearly informed of what data counselors can see
- Consent will be required separately (not bundled with account creation)
- You will be able to revoke counselor access at any time
- Counselors will be verified, licensed professionals bound by HIPAA-equivalent confidentiality obligations
- This Privacy Policy will be updated with a new section before the feature goes live
3.5 Business Transfers
If BalanceBoard is acquired, merged, or transferred to another entity, your data may be transferred as part of that transaction. You will be notified via email or prominent notice on the site at least 30 days before any such transfer. You may delete your account before the transfer occurs.
4. Google API Services — Limited Use Policy
BalanceBoard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, Google Classroom data is used only to:
- Display your enrolled courses and upcoming assignment due dates in your BalanceBoard dashboard
- Automatically populate your task list so you don't have to enter assignments manually
- Help the AI Buddy understand your current workload to provide relevant academic support
Google Classroom data is NOT used to:
- Serve advertisements or for any commercial purpose
- Share with third parties for their own use (other than our service providers listed above)
- Analyze for any purpose other than providing and improving BalanceBoard features
- Build profiles for sale or transfer
- Train AI models (we do not train on your Classroom data)
5. Student Privacy — FERPA & COPPA
5.1 FERPA (Family Educational Rights and Privacy Act)
FERPA protects the privacy of student education records. When BalanceBoard accesses your Google Classroom data (courses, assignments, submission status), that data may constitute education records under FERPA. Our commitments:
- We access education records only with your explicit authorization via Google OAuth consent — we never access Classroom data without user-initiated permission
- We operate in read-only mode — we cannot write to, modify, or submit anything in your Google Classroom account
- We do not re-disclose education records to third parties (other than the service providers listed in Section 3) without consent
- You retain the right to review, correct, and delete your education-related data at any time through Settings
- We do not use education record data for any purpose beyond providing BalanceBoard's features to you directly
- If a school district, administrator, or parent/guardian requests data about a specific student, we require a valid legal process (subpoena or court order) unless the student themselves authorizes the disclosure
- BalanceBoard is a student-initiated tool, not a school-deployed institutional tool. Institutional use requires a separate agreement with appropriate FERPA provisions.
5.2 COPPA (Children's Online Privacy Protection Act)
Minimum Age: 13
BalanceBoard is not directed to children under 13 and does not knowingly collect personal information from children under 13. If you are under 13, please do not register or use BalanceBoard.
If we discover or are notified that a user is under 13, we will immediately:
- Suspend the account and block further access
- Permanently delete all personal information associated with that account from our systems
- Revoke any Google OAuth tokens associated with the account
- Notify the email address on file of the deletion
For users aged 13–17 (minors): Many BalanceBoard features involve sensitive personal data including wellness check-ins, mood logs, stress indicators, and anonymous social interaction. We strongly encourage parents and guardians to:
- Review this Privacy Policy and our Terms of Service together with their teen
- Discuss what data is collected and how it is used
- Review the AI Disclaimer to understand what data is sent to Anthropic
- Help their teen make informed decisions about using wellness and social features
If you are a parent or guardian and believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@balanceboard.app — we will respond within 24 hours and take immediate action.
6. Data Retention
| Data Type | Retention Period | Notes |
|---|---|---|
| Account profile | Until deletion requested | Deleted within 30 days of request |
| Google OAuth tokens | Until disconnected or expired | Encrypted; refreshed automatically |
| Tasks & assignments | Until deleted or account closed | You can delete individual tasks |
| Wellness check-ins | Until deleted or account closed | Exportable from Settings |
| AI Buddy conversations | 90 days (rolling) | Used to maintain context; older logs purged |
| Vent Room messages | 24 hours | Auto-deleted by system; not recoverable |
| Study Pod messages | 30 days after pod inactivity | Active pods retain history |
| Peer Support posts | Until deleted by user or moderator | Deleted posts are gone within 24h |
| Sync logs | 90 days | For debugging sync issues |
| Technical/error logs | 30 days | Aggregated, not linked to identity |
| Moderation reports | 2 years | Required for safety record-keeping |
When you delete your account via Settings → Delete Account, we initiate a full data purge within 30 days. Some data may be retained in encrypted backups for up to 90 days before permanent deletion.
7. Security Measures
We implement industry-standard security measures to protect your data:
- Encryption in transit: All data transmitted between your browser and our servers uses TLS (HTTPS). Plain HTTP is not accepted.
- Encryption at rest: Supabase encrypts data at rest using AES-256.
- OAuth tokens: Google access and refresh tokens are stored encrypted and never exposed in client-side code or API responses.
- Row-Level Security (RLS): Our database enforces strict RLS policies — every query is filtered so users can only access their own data.
- Secure headers: We enforce X-Frame-Options, X-Content-Type-Options, and strict Referrer-Policy on all responses.
- Session management: JWT-based sessions with a 30-day maximum lifetime and automatic invalidation on sign-out.
- Rate limiting: API endpoints are rate-limited to prevent abuse.
- No plain-text storage: We do not store passwords — authentication is handled exclusively via Google OAuth.
No system is 100% secure. If you discover a security vulnerability, please responsibly disclose it to support@balanceboard.app. Do not publicly disclose security issues before we have had 30 days to respond.
In the event of a data breach that affects your personal information, we will notify you by email within 72 hours of discovery, as required by applicable law.
8. Your Privacy Rights
Regardless of where you live, you have the following rights regarding your data:
Right to Access
Request a copy of all personal data we hold about you. Contact us at support@balanceboard.app.
Right to Correction
Update inaccurate data via your Profile settings or by contacting us.
Right to Deletion
Delete your entire account and all associated data via Settings → Delete Account. Individual data types can also be deleted selectively.
Right to Portability
Export your wellness data and task history as a structured file (CSV/JSON) via Settings → Export Data.
Right to Restrict Processing
Request that we stop processing your data for specific purposes while retaining the data. Contact us to invoke this right.
Right to Object
Object to our processing of your data for certain purposes (e.g., AI analysis). You can disable AI features in Settings.
Right to Withdraw Consent
Revoke Google Classroom access at any time by disconnecting the integration in Settings. Your existing synced assignments will remain but no new syncs will occur.
Right to Non-Discrimination
We will not discriminate against you for exercising any of these rights.
To exercise any right, email support@balanceboard.app with the subject line "Privacy Rights Request." We will respond within 30 days.
9. Wellness & Mental Health Data — Special Protections
Wellness data — including mood scores, stress levels, sleep quality, and daily notes — is among the most sensitive data we hold. We apply additional protections:
- Private by default: Your wellness data is never shown to other users, peers, or anyone else. It is visible only to you.
- Not shared for advertising: We will never use your mental health or mood data to target you with advertisements.
- AI analysis limitations: When the AI Wellness Coach analyzes your data, it reads your recent check-ins to generate insights. This analysis is processed by Anthropic's Claude API. The data is not stored by Anthropic for training purposes per our API agreement.
- Crisis detection: Our AI may detect signals of significant distress in your messages. If it does, it will surface crisis resources (like the 988 Suicide & Crisis Lifeline). It does not automatically contact third parties. You are always in control.
- Future counselor access: If/when we add counselor features, counselors will only see wellness data you explicitly choose to share with them. They will not have access by default.
- Not a medical record: BalanceBoard wellness data is not a medical record and is not governed by HIPAA. See our Mental Health Disclaimer.
10. Anonymous Features & What Anonymity Means
Our Vent Rooms, Study Pods, and Peer Support Forum use randomly generated usernames to protect your identity from other users. However, anonymity is not absolute:
- We maintain an internal link between your real account and your anonymous posts for safety and moderation purposes
- If a post violates our Community Guidelines and is reported, we can (and will) identify the author to take action
- If required by valid legal process, we may be required to reveal the identity behind an anonymous account
- Vent Room messages are deleted after 24 hours — but our system logs which account sent which message during that 24-hour window
Anonymity protects you from social embarrassment. It does not protect you from accountability for harmful behavior.
11. California Residents — CCPA Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights:
- Right to Know: You can request that we disclose what categories of personal information we collected, the sources, our business purpose, and which third parties we share it with.
- Right to Delete: You can request deletion of personal information we have collected from you (with exceptions).
- Right to Opt-Out of Sale: We do not sell personal information. Therefore, no opt-out is needed.
- Right to Non-Discrimination: We will not deny service or charge different prices based on your exercise of CCPA rights.
Additionally, the California Student Privacy Alliance (CSPA) and California Education Code Section 49073 provide additional protections for student data. We commit to complying with these provisions where applicable.
To submit a CCPA request, email support@balanceboard.app with subject "CCPA Request."
12. EU & UK Users — GDPR Rights
If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data.
Legal Bases for Processing:
- Contract performance: Providing the services you requested (account management, task tracking)
- Consent: Google Classroom access, wellness tracking, AI features
- Legitimate interests: Security, fraud prevention, service improvement (balanced against your rights)
- Legal obligation: Compliance with applicable laws
Your GDPR rights include: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with your local supervisory authority.
Note: BalanceBoard's primary market is the United States. Our infrastructure (Supabase, Vercel) may process data outside the EU/UK. Where data is transferred internationally, we rely on Standard Contractual Clauses or equivalent safeguards.
To exercise GDPR rights: support@balanceboard.app with subject "GDPR Request."
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Send an email notification to your registered email address
- Display a prominent banner in the app for 30 days after the change
Continued use of BalanceBoard after the effective date of updated terms constitutes acceptance. If you do not agree to material changes, you may delete your account before the effective date.
14. Contact Us
BalanceBoard
Email: support@balanceboard.app
Website: balanceboard.app
For privacy-specific concerns, include "Privacy Request" in your email subject line. We aim to respond within 30 days for all privacy-related requests, and within 72 hours for urgent security issues.