Welcome to BalanceBoard ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our student academic management and wellness platform at balanceboard.app. We built BalanceBoard specifically for high school students, and we take your privacy—especially as a minor—with the utmost seriousness.
By using BalanceBoard, you agree to the collection and use of information in accordance with this policy. If you are under 18, we encourage you to review this policy with a parent or guardian. If you do not agree with any part of this policy, please do not use our service.
This policy should be read together with our Terms of Service, AI Disclaimer, Mental Health Disclaimer.
When you sign in with Google OAuth, we receive and store:
With your explicit permission via Google OAuth, we access read-only data from Google Classroom:
What we do NOT access: The content of your submitted assignments, teacher details, class rosters, enrollment codes, your grades, your private messages in Classroom, other students' data, or any data outside your own account. We operate with minimum necessary scopes and can never write to or modify your Google Classroom data.
This is among the most sensitive data we handle. It is stored with encryption and is accessible only to you. See Section 9 for our specific commitments.
See our AI Disclaimer for full details on how Anthropic processes this data.
We use the information we collect to:
Core Commitment
We do not sell, rent, or trade your personal data to anyone, for any purpose, ever. We do not use your data for targeted advertising or share it with data brokers.
We share data with the following trusted third-party services to operate BalanceBoard. Each is bound by data processing agreements and privacy obligations:
Supabase (Supabase, Inc.)
Our database and file storage provider. All your data (profile, tasks, wellness entries, social data) is stored on Supabase-hosted PostgreSQL servers. Data is encrypted at rest and in transit; see Supabase's published security and compliance documentation for its current certifications.
Data shared: All user data stored in our platform.
Anthropic, PBC
Our AI provider. Purpose-specific information is sent to Anthropic only when you deliberately invoke an AI task-planning action or, after a separate choice, request an AI wellness insight. BalanceBoard does not claim a vendor retention or training term beyond the terms/settings actually applicable to its API account. See AI Notice.
Data sent to Anthropic when using AI task planning: The current sanitized, length-limited message, plus up to 100 pending-task records containing ID, title, subject, due date, priority, and local-date context. Prior chat turns are not sent by the current route.
Data sent to Anthropic when using AI Wellness Coach: Up to 7 recent wellness check-ins containing structured fields such as mood, sleep hours, stress level, energy, water intake, exercise, screen time, outdoor time, social quality, and study time. Journal notes are deliberately excluded. This context is not linked to your name, email, school, or grade.
Data sent to Anthropic when using the AI Task Slicer: A length-limited copy of the title and description/notes of the single task you choose to slice. Because Google Classroom assignment descriptions and any teacher instructions you paste into a task's notes become part of that description, they are included when — and only when — you press the slice button on that task. Not linked to your name or email.
NOT sent to Anthropic: Your name, email address, school, grade, Google account ID, OAuth tokens, wellness journal notes, other users' data, or uploaded files.
Google LLC
We use Google OAuth for authentication and Google Classroom APIs for assignment syncing. Your authentication tokens are stored encrypted. We operate under Google's API Services User Data Policy, including the Limited Use restrictions detailed in Section 4.
Data shared: basic Google account details for sign-in; encrypted Classroom authorization tokens only if you later choose to connect Classroom.
Vercel, Inc.
Our hosting and deployment infrastructure. Vercel may log IP addresses and request metadata for operational purposes per their privacy policy.
Data shared: Request logs, IP addresses (infrastructure-level only).
Google Analytics (Google LLC)
We use Google Analytics on our public marketing and informational pages only (homepage, blog, comparison and legal pages) to understand how visitors find BalanceBoard. It is never loaded inside the student app: your dashboard, tasks, wellness check-ins, and AI conversations send nothing to Google Analytics. IP addresses are anonymized and Google advertising features (Google Signals, remarketing) are disabled.
Data shared: Anonymized visit data on public pages only (pages viewed, referring site, device type). No account data, no wellness data, no in-app activity.
Upstash, Inc.
Our rate-limiting provider. To prevent abuse of AI and account features, request counters are kept in Upstash-hosted Redis. These counters are keyed by an account identifier (such as your user ID or account email) or, for logged-out visitors, an IP address, together with request timestamps. No message content, task content, or wellness data is sent to Upstash, and counters expire automatically after a short period.
Data shared: Account identifier or IP address, request counts/timestamps (short-lived).
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency subpoena). We will notify you of such requests where legally permitted.
The automated phrase check only displays resources and does not contact third parties. If a person deliberately sends information to support, we may disclose limited information when required by law or valid legal process, or when reasonably necessary to address an imminent threat, subject to applicable law. See our Safety Policy.
BalanceBoard does not currently provide counselor dashboards, school rosters, or institutional student-data access. No counselor or school receives account, task, or wellness data through BalanceBoard.
If the service or its assets are acquired, merged, or transferred, account data may be part of that transaction, subject to applicable law and the notices and choices required at that time.
BalanceBoard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, Google Classroom data is used only to:
Google Classroom data is NOT used to:
FERPA protects the privacy of student education records. When BalanceBoard accesses your Google Classroom data (courses, assignments, submission status), that data may constitute education records under FERPA. Our commitments:
Minimum Age: 13
BalanceBoard is not directed to children under 13 and does not knowingly collect personal information from children under 13. If you are under 13, please do not register or use BalanceBoard.
If we discover or are notified that a user is under 13, we will immediately:
For users aged 13–17 (minors): BalanceBoard can hold personal data including tasks, wellness check-ins, mood logs, and stress indicators. We strongly encourage parents and guardians to:
If you are a parent or guardian and believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@balanceboard.app — we will respond within 24 hours and take immediate action.
| Data Type | Retention Period | Notes |
|---|---|---|
| Account profile | Until deletion requested | Access is disabled and deletion begins promptly |
| Google OAuth tokens | Until disconnected or expired | Encrypted; refreshed automatically |
| Tasks & assignments | Until deleted or account closed | You can delete individual tasks |
| Wellness check-ins | Until deleted or account closed | Exportable from Settings |
| AI requests/responses | No BalanceBoard conversation-history table | The AI provider may process request data under its applicable API terms/settings |
| Sync and technical logs | Limited to operational and legal needs | Hosting and backup providers may retain limited records under their applicable schedules |
When you request deletion, account access is disabled and BalanceBoard begins deleting registered account data and revoking connected Google access. Incomplete steps are retried and their status is shown in Settings. Provider backups may follow the providers' separate schedules.
We implement industry-standard security measures to protect your data:
No system is 100% secure. If you discover a security vulnerability, please responsibly disclose it to support@balanceboard.app. Do not publicly disclose security issues before we have had 30 days to respond.
If a data breach affects your personal information, we will provide notices within the time and through the channels required by applicable law.
Regardless of where you live, you have the following rights regarding your data:
Right to Access
Request a copy of all personal data we hold about you. Contact us at support@balanceboard.app.
Right to Correction
Update inaccurate data via your Profile settings or by contacting us.
Right to Deletion
Request deletion of your account and associated data via Settings → Delete Account.
Right to Portability
Export supported account, task, and wellness data as a structured JSON file via Settings → Export Data. The export includes a manifest showing any section that could not be read.
Right to Restrict Processing
Request that we stop processing your data for specific purposes while retaining the data. Contact us to invoke this right.
Right to Object
Object to our processing of your data for certain purposes (e.g., AI analysis). You can disable AI features in Settings.
Right to Withdraw Consent
Revoke Google Classroom access at any time by disconnecting the integration in Settings. Your existing synced assignments will remain but no new syncs will occur.
Right to Non-Discrimination
We will not discriminate against you for exercising any of these rights.
To exercise any right, email support@balanceboard.app with the subject line "Privacy Rights Request." We will respond within the timeframe required by applicable law.
Wellness data — including mood scores, stress levels, sleep quality, and daily notes — is among the most sensitive data we hold. We apply additional protections:
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights:
Additionally, the California Student Privacy Alliance (CSPA) and California Education Code Section 49073 provide additional protections for student data. We commit to complying with these provisions where applicable.
To submit a CCPA request, email support@balanceboard.app with subject "CCPA Request."
Under CalOPPA (California Business and Professions Code §§ 22575–22579), which requires commercial websites collecting personally identifiable information (PII) from California residents to post a conspicuous privacy policy, BalanceBoard discloses the following:
Do Not Track (DNT) Signals
CalOPPA requires us to disclose how we respond to browser "Do Not Track" signals. BalanceBoard does not currently respond to DNT signals because we do not engage in cross-site behavioral tracking or advertising in the first place. Your activity on BalanceBoard is never used to track you across third-party websites.
If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data.
Legal Bases for Processing:
Your GDPR rights include: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with your local supervisory authority.
Note: BalanceBoard accounts are currently offered only in the United States. Public pages may still be visited from elsewhere. Our infrastructure (Supabase, Vercel) may process data outside the EU/UK. Where applicable, international transfers rely on Standard Contractual Clauses or equivalent safeguards.
To exercise GDPR rights: support@balanceboard.app with subject "GDPR Request."
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
Continued use of BalanceBoard after the effective date of updated terms constitutes acceptance. If you do not agree to material changes, you may delete your account before the effective date.
BalanceBoard
Email: support@balanceboard.app
Website: balanceboard.app
For privacy-specific concerns, include "Privacy Request" in your email subject line. We aim to respond within 30 days for all privacy-related requests, and within 72 hours for urgent security issues.