Privacy Policy

1. Our approach

Blobby is built to keep as little personal information as possible. Students never need an email address, and by default only first names are stored. We don't sell data, show ads, use tracking cookies or run analytics. This policy explains what we keep, why, where it's stored and how long we keep it.

2. What we collect

From teachers:

• name, email address, password (stored only as a secure hash), time zone and what you use Blobby for;
• if you buy codes: your name, email, billing province or state and country, and any school and purchase order number you give. Card details go to Stripe, never to us.

About students and staff, entered by the teacher:

• the name shown in class (first names only while Private Mode is on, which is the default), a username and a PIN;
• class money records: balances, payments, bonuses, fines, purchases and jobs.

Other things:

• pictures a teacher uploads for the class store;
• messages sent with Report a problem, with the page and browser they came from;
• internet (IP) addresses, used briefly to limit repeated sign-up and login attempts and to protect the site from attacks.

3. How we use it

Only to run Blobby: to sign you in, show each classroom to the people in it, run paydays and the store, send account emails (confirming your email, password resets, trial and licence notices, deletion warnings), handle payments and answer support questions. We don't use it for advertising or profiling, and we don't sell or rent it to anyone.

4. Who can see it

Each teacher's classrooms are private. Other teachers, schools and districts can't see them. Inside a classroom, students see their own account and only what the teacher allows of the rest of the class.

The site's owner can look at account data when needed for support, security or legal reasons. Every such look is recorded in an audit log that can't be changed.

5. Where it's stored, and who helps us

We use a few trusted service providers, each only for its part of running Blobby:

• Supabase stores the database (accounts, classrooms, money records) in Canada (Amazon Web Services, Montreal).
• Cloudflare runs the website, sends our emails, and stores class store pictures in its western North America region, which may be in the United States. Visits pass through Cloudflare's worldwide network.
• Stripe processes card payments in Canada and the United States.

Information sent to providers outside Canada may be accessed under the laws of those countries.

6. Cookies and browser storage

We use one login cookie to keep you signed in, and a second one only while a teacher previews the student pages. Your browser also remembers a few preferences on your own device, such as your colour theme and table sorting. There are no advertising or tracking cookies.

7. How long we keep it

• Teachers can delete students, classrooms or their whole account at any time. Deleting is permanent and happens right away.
• Accounts unused for 18 months are deleted automatically, after warning emails 30 and 7 days before.
• Payment and invoice records are kept for six years, as Canadian tax law requires, even after an account is deleted.
• Deleted information may stay in encrypted backups for up to 30 days before it's gone for good.

8. Security

All traffic is encrypted (HTTPS). Passwords are stored only as secure hashes. Each teacher's data is kept apart from every other teacher's, and the admin tools sit behind an extra sign-in check. If a breach ever puts your information at real risk, we'll tell you and the privacy commissioner as the law requires.

9. Students and schools

Blobby is used by students only under a teacher's supervision, and students don't give us any information themselves: the teacher decides what goes in. Teachers should check their school's or district's rules (some require a privacy review or parent consent first). We're happy to help with a district's privacy review: email support@blobby.ca.

10. Your choices and rights

You can see, correct, export and delete your information in Blobby yourself, or ask us to do it. You can also ask what information we hold about you. Email support@blobby.ca and we'll answer within 30 days. If you're not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia.

11. Changes to this policy

If we change this policy in a way that matters, we'll tell teachers by email or on the site before it takes effect.

12. Contact

Privacy questions or requests: support@blobby.ca.