Student privacy at Boost
For principals, district IT and privacy reviewers. Teachers use Boost to turn a lesson into a classroom game, and students join from a link or QR code. Here's exactly what we collect from students, who handles it, and how long we keep it.
- No student accountsStudents never sign up, sign in or give an email address.
- No ads, no trackersPages students use load no third-party ads, analytics or tracking tools.
- Never soldStudent data is used only to run the game for the teacher.
- Student DPAsWe review DPAs, including the SDPC National Data Privacy Agreement.
What we collect when students play
| What | When | Details |
|---|---|---|
| Student name | Only when the teacher turns on class results for a quiz. The student types it on the start screen. | First name and last initial by default. A teacher can ask for full names instead. |
| Answers and scores | Only for class results games | Each answer, whether it was right, time per question, finish time, and a “late” flag for homework due dates. The teacher sees them on a results page and in a results email. |
| Play session info | Every game | A random player ID saved in the browser (so a refresh doesn’t lose the student’s place), plus the device’s IP address and browser type, which we use to count players, apply the teacher’s player limit and stop abuse. 30 days after the last play, we delete the IP address and browser type and remove the player ID. |
| Game views | Every game | Time spent on the game, browser type, the device’s IP address and a rough country worked out from the browser’s time zone, so the teacher can see how many people played and roughly where. We delete the IP address and browser type after 30 days. Country and time spent stay in the teacher’s game stats until the teacher deletes their account, or sooner if the teacher sets them to delete automatically. |
| Votes | Rank Battle games only | To show vote totals and allow one vote per player. Each vote is stored with the random player ID, which we remove 30 days after the game’s last vote. |
Class results are stored with a scrambled version of the player ID, separately from IP addresses, and we don't link the two. Only the teacher who owns the game can see its results.
What we don't collect or do
- No student accounts. We never ask students for an email address, phone number, birthday, home address or photo.
- No ads and no third-party trackers on student pages. The game pages students use don't load Google Analytics, Google Ads, Tag Manager, reCAPTCHA, payment or sign-in scripts.
- Teachers can't add trackers or sign-up forms to student games. Those tools are off for games made on teacher plans. A teacher can turn them on for one game only by confirming it's for adults (such as a staff training or parent night) and that no students will play it.
- No selling, renting or profiling. We don't sell student data, use it for advertising, or build profiles of students. We use player counts (never names) to show the teacher how many students played and when a game reached their plan's player limit.
- Not used to train AI. Student names, answers and scores are never sent to our AI provider.
Where data is stored and who processes it
Boost data is stored on Amazon Web Services in the United States. These companies handle data when teachers and students use Boost:
| Company | What it does for Boost | Gets student data? |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database and file storage in the United States | Yes: everything Boost stores |
| Google Workspace (Gmail) | Sends teachers their class results emails | Class averages and the hardest questions, in the teacher’s results email. No student names |
| Cloudinary and Unsplash | Serve pictures inside games | No. Like any website, they see the device’s IP address when a picture loads |
| Video sites and picture links a teacher adds (such as YouTube or Vimeo) | Show videos and pictures the teacher puts in a game | No. They see the device’s IP address when the video or picture loads, and video sites may set their own cookies. Teachers choose whether to add them |
| OpenAI | The AI game builder, for teachers | No. Only the lesson text a teacher pastes and the game being edited |
| Stripe | Payments, for teachers and schools only | No |
| Mailchimp | Newsletters and tips for teachers | No. Teacher email addresses only |
| Google Analytics, Tag Manager and Ads | Measure our website and ads, on teacher pages only | No. These never load on pages students use |
We'll update this list before adding any company that receives student data.
How long we keep it
- Class results stay in the teacher's account for 12 months after the class is played or the homework is due, then we delete them automatically. Teachers can delete them sooner, and we delete them sooner when the school asks.
- IP addresses and browser type from play sessions and game views are deleted after 30 days, along with the random player IDs saved with play sessions and votes.
- When a teacher deletes their account, we close it right away and permanently erase their games, class results, play and view records and personal information 30 days later (we keep billing records for taxes). Backup copies are deleted on a rolling schedule within about 12 months and are used only to recover from an outage or to test that recovery works.
- A school or district can ask us to delete student data from its teachers' accounts at any time. Email us and we'll delete it within 30 days.
- Parents can ask to see or delete their child's information through the teacher or school, or by emailing us. Students don't have accounts, so we work with the teacher to find the right records.
Security basics
- All traffic uses HTTPS (encrypted in transit), on port 443 only.
- Teacher passwords are stored as one-way hashes, never in plain text.
- Only the teacher who owns a game can see its class results.
- If we ever learn of unauthorized access to student data, we'll tell the affected schools and teachers without undue delay, as the law requires.
Student Data Privacy Agreements
We review Student Data Privacy Agreements, including the SDPC National Data Privacy Agreement (NDPA) with your state's exhibit or your district's own agreement, and we'll work with you on one. Tick “We need a Student Data Privacy Agreement” when you request a quote, or email us, and we'll follow up.
Request a quote or ask about a DPAMore for schools
- For school IT: domains to allow and the 1-minute network check
- Privacy Policy and Terms of Use
- Questions, deletion requests or a DPA: email contact@boostplatform.app
Boost is run by Revlab Technology, LLC, 305 Myrtle Oak Ct, St. Augustine, FL 32092. Last updated November 10, 2026.