Welcome to The Academy of Heroes ("we," "us," or "our"). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our web application and services (collectively, the "Service"). We are committed to safeguarding the privacy of all users, and in particular the privacy of students and children who use our platform.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Who We Are and How to Contact Us

Academy of Heroes is an educational gamification platform designed for use in K–12 classrooms. Teachers subscribe to the Service and manage classroom accounts for their students.

For any privacy-related questions, requests, or concerns, please contact us at:

Email: privacy@academy-heroes.com

2. Scope — FERPA and School Relationships

Academy of Heroes operates as a school official under the Family Educational Rights and Privacy Act (FERPA) when providing services to schools and teachers. Student data we collect and process on behalf of a teacher or school constitutes education records under FERPA. We use student education records solely to provide and improve the Service as directed by the teacher or school, and not for any other commercial purpose.

Teachers and schools are responsible for obtaining any parental consents required under FERPA or applicable state law before enrolling students in the Service.

3. Children's Privacy — COPPA Compliance

The Academy of Heroes is intended for use in school settings under direct teacher supervision. We recognize that some students using our platform may be under the age of 13, and we take our obligations under the Children's Online Privacy Protection Act (COPPA) seriously.

Student accounts are either created directly by a teacher or self-registered by a student using their teacher's unique Guild Code. A student cannot join without a valid teacher-issued Guild Code, and the teacher must approve each account before it becomes active. Teachers manage student accounts thereafter.
We collect only the minimum information necessary to provide the educational service: a student name (in first-name-and-last-initial format), class association, and gameplay progress data.
Student names are automatically shortened to first-name-and-last-initial format at every entry point — student self-registration, teacher manual entry, CSV upload, Google Classroom import, and after-the-fact name editing. Full last names are silently truncated to a single initial before the record is stored. This is an enforced data-minimization measure, not just guidance.
We do not require or collect email addresses from students during account registration. If a teacher imports a roster from Google Classroom, the school-issued Google email associated with each student account may be stored to support that integration.
We do not display advertising to students or use student data for targeted advertising.
We do not sell or share student personal information with third parties for commercial purposes.
Parents and legal guardians may request to review, correct, or delete their child's information by contacting the child's teacher, who can initiate deletion through the teacher dashboard. Alternatively, contact us directly at privacy@academy-heroes.com.

By creating or enabling student accounts on behalf of their students, teachers represent that they have the authority to do so, accept our Terms of Service and this Privacy Policy on behalf of each student they enroll, and, where required, have obtained appropriate parental or guardian consent. Students are not required to separately accept these policies.

4. Information We Collect

We collect the following categories of information depending on the type of account:

Teacher Accounts

Registration Information: Name, email address, classroom name (used as the teacher's default guild name), and login credentials. We do not collect or store the teacher's school name or school address.
Billing Information: Subscription plan and payment transaction records. Payment card details are processed by our third-party payment processors (Stripe and PayPal) — we do not store full payment card numbers.
Classroom Content: Quest hubs, chapters, missions, and other educational content created within the Service.
Usage Data: Feature usage, login timestamps, and interaction with the platform to support account management and service improvement.

Student Accounts

Identity: Student name and/or character name as entered by their teacher.
Classroom Association: Class code linking the student to their teacher's classroom.
LMS Email (only if imported): If a teacher imports a student from Google Classroom, the school-issued Google email tied to that account is stored to support the integration. Students who self-register with a Guild Code or are added manually by a teacher do not provide an email address.
Gameplay and Progress Data: Experience points (XP), gold, level, quest progress, quiz responses, battle outcomes, inventory, and avatar log history. This data is essential for the educational and gamification features of the Service.
Messages: Communications sent within the platform, including direct messages between a student and their teacher and posts in the Guild Hall chat (such as a class or company channel). These messages are stored so participants can view the conversation history, and a teacher can clear them at any time.
Voice Data (Battle Sessions): When a teacher enables live voice chat during a Battle session, audio is transmitted in real time through Agora.io, our voice infrastructure provider. We do not record or store voice audio — it is streamed live and not retained.
AI-Processed Content: Written answers submitted during Solo Patrol activities, questions asked of the in-app Oracle helper, and gameplay-stats inputs used to generate Hero Chronicles are sent to third-party AI providers for automated grading and content generation. The Service is architected so that only de-identified content reaches the AI — student names, email addresses, and account IDs are never included in any AI request. For grading and Oracle flows, the AI receives only the question text and the student's written response. For Hero Chronicle generation, the AI receives the student's chosen character name (a player-selected fantasy alias, not the student's real name), gameplay statistics, and the student's composed avatar sprite (a fantasy character built from a shared library of game art, not a photograph or any image of the real student). Students are advised in the application not to include personal information in their typed answers.

Automatically Collected Information

Session Cookies: We use session cookies strictly necessary to maintain logged-in state and ensure the application functions correctly.
Advertising & Analytics Tags (Consent-Gated): Our public-facing marketing pages may load the Facebook Pixel (Meta), the Google Ads conversion tag (gtag.js, ID AW-18030623601), and Google Analytics 4 (ID G-W7VYMKZ8C3). These tools may set cookies or similar identifiers to measure the effectiveness of our advertising, track conversions from ad clicks, enable retargeting, and report visitor analytics. None of these scripts load until the visitor opts in via our cookie consent banner. Visitors can choose Reject All, Accept All, or use the Customize panel to grant Analytics or Advertising cookies independently. Choice can be changed at any time via the "Cookie Preferences" link in the page footer (or the small persistent floating link on marketing pages without a footer). When a known student session is detected on the page, the Advertising option is suppressed entirely and no Advertising cookies are loaded under any consent state. These tags are never loaded inside the authenticated teacher or student application, regardless of consent state. You may additionally opt out of interest-based advertising through your browser settings or at YourAdChoices.com.
Conversion Measurement (Paid Subscriptions): Separately from the consent-gated marketing tags above, when a teacher completes a paid subscription, Academy of Heroes records that conversion with our advertising platform (Google Ads) to measure the effectiveness of our own marketing — a business purpose under applicable privacy law. It is performed server-side, using the teacher's email in hashed (non-reversible) form together with the advertising click identifier from their visit where available (teachers who did not arrive via one of our ads have none; measurement then uses the hashed email alone). It applies only to adult teacher / billing accounts — never to students, reflects a completed purchase, and involves no student data. Academy of Heroes uses this data solely to measure its own marketing and does not use it to build advertising profiles of teachers; it is provided to Google Ads for that conversion-measurement purpose under Google's data-processing terms.
Log Data: Standard server logs including IP address, browser type, and pages visited, used for security and error diagnosis only. These logs are generated by our hosting providers (Vercel) and database/storage providers (Google Firebase) as part of normal infrastructure operation.

4A. Behavioral and Gameplay Data

Academy of Heroes collects detailed records of each student's gameplay activity: experience points, levels, gold, quiz answers (correct and incorrect), chapters completed, battle and duel outcomes, daily training results, and patrol completion records. This information is used strictly for the educational and gamification features of the Service — to power XP and leveling, drive narrative progression, reward learning effort, and let teachers see classroom-level engagement.

Academy of Heroes does not use this behavioral data to build advertising profiles, label academic ability for sale or sharing, train any third-party AI model, or share with any third party for marketing purposes.

Detailed gameplay records may constitute "education records" under FERPA when they relate to a specific identifiable student. Parents and guardians may request inspection, correction, or deletion through their child's teacher or by contacting privacy@academy-heroes.com.

5. How We Use Your Information

We use the information we collect solely to:

Provide, operate, and maintain the Academy of Heroes Service.
Allow teachers to manage their classroom, track student progress, and create educational content.
Power the gamification features: XP calculations, quest progression, battle mechanics, leaderboards, and rewards.
Process subscription payments and manage billing for teacher accounts.
Send service-related communications to teachers (e.g., subscription confirmations, important updates).
Diagnose technical issues, improve security, and enhance platform performance.
Create and use de-identified or aggregated data — information that cannot reasonably be used to identify any individual — for analytics, research, and to improve and develop the Service. We do not attempt to re-identify this data.

We do not sell personal information. We do not use student data for advertising, profiling, or any purpose outside of providing the educational service.

6. How We Share Your Information

We do not sell or rent personal information to third parties. We may share information only in the following limited circumstances:

Service Providers (Data Processors): We use a limited number of reputable third-party service providers to operate the Service — including cloud hosting and database infrastructure, payment processing, transactional email delivery, AI-powered grading and content generation, real-time voice communication, and optional learning-management-system integrations. Each operates under its own privacy and data-processing terms, and we share only the information needed for the provider to perform its function. Where student-related content is processed by an AI provider, only de-identified content is transmitted — no student names, IDs, or contact information are included. A current list of our service providers is available to schools and teachers on written request at privacy@academy-heroes.com.
Advertising & Analytics Partners (Public Pages Only): On our public marketing pages, and only after a visitor opts in through our cookie consent banner, we use third-party advertising and analytics tools (as described in Section 4) to measure marketing performance and understand site traffic. These tools are never loaded inside the authenticated teacher or student application. Separately, Google Ads also receives server-side paid-subscription conversion data (a hashed teacher email and ad-click identifier where available) so we can measure which marketing brings paying customers. This is limited to conversion measurement for adult teacher accounts and contains no student data.
Legal Requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.
Business Transfers: In the event of a merger, acquisition, or sale of assets, user information may be transferred. We will notify users of any such change in ownership.

Google API Services — Limited Use. Academy of Heroes' use and transfer of information received from Google APIs (including Google Classroom) adheres to the Google API Services User Data Policy, including its Limited Use requirements. Information obtained through Google APIs is used solely to provide the integration features you choose to enable (such as importing your class roster or syncing grades), is never sold, and is never used for advertising or to train AI models.

7. Data Security

We implement industry-standard security measures to protect your information, including:

Encrypted data transmission via HTTPS/TLS on all connections.
Secure cloud storage via Google Firebase with role-based access controls.
Authentication required for all account access; student accounts are accessible only by the student, their associated teacher, any co-teachers that teacher has authorized, and authorized Academy of Heroes personnel acting to provide support or maintain the Service.
We review the security of our platform and third-party integrations on an ongoing basis as part of our development process.
In the event of a data breach affecting personal information, we will notify affected teachers and schools without undue delay after we confirm the incident, consistent with applicable law.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Data Retention

Active Accounts: Data is retained for as long as the account is active and in use.
Communication Records: Text messages stored in the Guild Hall chat, the Forum, direct teacher-to-student messages, and in-app notifications are automatically deleted approximately one year after they were sent. Teachers may also clear any channel manually using the in-app clear controls. Mission submissions and patrol responses are retained as student education records under FERPA until the student is removed from the classroom, at which point they are deleted as part of the standard cascade deletion below.
Student Account Deletion: When a student is removed from their classroom — by the teacher or via a parent/guardian request — Academy of Heroes performs a complete cascade deletion of the data tied to that student, including their account, gameplay records, messages sent and received, forum posts, daily training and patrol records, mission submissions, in-app notifications, uploaded files, any Hero Chronicle generated for them, teacher notes about that student, and the authentication record.
Teacher Account Deletion: When a teacher account is terminated or cancelled, the teacher account and all associated student accounts and classroom data are permanently deleted from our active systems.
Backup Retention: Deleted data may persist in our routine system backups for a limited period, consistent with our backup infrastructure, before being permanently purged. These backups are a separate administrative recovery mechanism and do not affect what users, teachers, or the application can see — once data is deleted from the active service, it is immediately removed from the live experience for all users.

9. Your Rights and Data Control

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information. For student data, requests may be directed to the student's teacher or to us at privacy@academy-heroes.com.
Portability: Request a copy of your data in a portable format.
Opt-out: We do not sell personal data, but you may contact us to opt out of any non-essential communications.

Nevada Residents (NRS 603A): Nevada law (NRS Chapter 603A) gives Nevada residents the right to opt out of the sale of their covered information. We do not sell personal information — to any party, for any purpose. If you have questions about this, contact us at privacy@academy-heroes.com.

California Residents (CCPA/CPRA): California residents have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information is collected, the right to delete it, the right to correct it, and the right to opt out of its sale or sharing. We do not sell personal information. On our public marketing pages, only after a visitor opts in via our cookie consent banner, we use advertising and analytics tools that may constitute "sharing" of browsing data for cross-context behavioral advertising under CCPA. You control this through the banner (Reject All, or decline the Advertising category), and may additionally opt out via YourAdChoices.com or your browser's cookie settings. Separately, Academy of Heroes treats its server-side measurement of completed paid subscriptions (described in Section 4) as a business-purpose use rather than "sharing," on the basis that the uploaded data is provided to Google solely for conversion measurement under Google's Conversion Customer Data Terms; the sharing opt-out above applies to the consent-gated client-side advertising tags, not to this business-purpose measurement. To exercise your rights, contact us at privacy@academy-heroes.com. We will respond within the timeframe required by the CCPA.

California Students (SOPIPA): As an operator of a K–12 educational service, we comply with California's Student Online Personal Information Protection Act (SOPIPA). We do not use student personal information to deliver targeted advertising, do not build advertising profiles of students, and do not sell student information.

Parents and Guardians: Parents or legal guardians of students under 13 may request to review, correct, or delete their child's information by contacting the child's teacher or emailing us directly. We respond to verified requests as promptly as reasonably practicable and within any timeframe required by applicable law.

10. Teacher-Generated Content and Our Limitations

The Service provides teachers with free-form content creation tools (quest descriptions, mission instructions, broadcast messages, forum posts, image uploads). Academy of Heroes does not collect sensitive student personally identifiable information as part of its normal operation. However, a teacher could theoretically enter such information into these free-form fields.

Teachers are explicitly prohibited from entering sensitive student PII — such as legal last names, addresses, dates of birth, or grades linked to identifiable students — into content fields not designed to store it. If a teacher does so, the teacher bears responsibility for the resulting exposure. (Our liability limitations for such teacher-entered data are detailed in our Terms of Service.)

Communication Features and Independent Recording

The Service includes chat, forum, broadcast, and voice communication features. Text messages in the Guild Hall are stored so participants can view the conversation history; a teacher can clear a channel's messages at any time. Live voice chat during Battle sessions is not recorded or stored. In all cases, we have no technical means to prevent any participant from independently capturing, screenshotting, or recording content displayed on their screen or audio transmitted through their device using external tools or devices. Users of the Service's communication features should be aware of this limitation and conduct themselves accordingly.

Image Uploads

Teachers may upload images (boss images, reward images, profile images) that may be visible to their enrolled students. Academy of Heroes does not review uploaded images in advance. We will investigate and act on any reported violations. Teachers are solely responsible for ensuring any images they upload are appropriate for their student audience.

11. Royal Library — Community Content

Teachers may voluntarily submit their own original educational quest content to the Academy of Heroes Royal Library, a community content-sharing feature. All submissions are reviewed by Academy of Heroes administrators before being made available to other teachers, and we may reject any submission — including any that appears to contain third-party copyrighted material. By submitting content, teachers grant Academy of Heroes the license described in our Terms of Service. Content submitted to the Royal Library must not include any student personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our Service. If we make material changes, we will notify teachers via the application or by email at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, requests, or to exercise your data rights, please contact us:

Privacy Email: privacy@academy-heroes.com
General Support: support@academy-heroes.com
State of Operation: Nevada, USA
Mailing Address: Available upon request at privacy@academy-heroes.com

We respond to privacy requests as promptly as reasonably practicable and within any timeframe required by applicable law. For requests concerning student data, we may require verification that you are the account-holding teacher or the parent/guardian of the student in question.