Data & security
Effective October 23, 2026 · Version 2026-10-23
This page is CodeBreeder LLC’s written data retention policy and information security program for Study Desk, as described in our Privacy Policy.
Data retention policy
We keep personal information only as long as it is needed to run Study Desk, then delete it. A cleanup job runs every hour and removes expired data in small batches, so a large backlog can take a few hours to clear.
| Data | Where | Kept for | Then |
|---|---|---|---|
| Parent email and consent record | Our database (Cloudflare D1) | While the account is in use | Deleted when the parent deletes the account, or automatically 2 years after the last sign-in |
| Sign-in codes (hashed) and hashed network address | Our database | 10 minutes to use | Deleted by the hourly cleanup |
| Sessions (hashed), device names, last used | Our database | Up to 180 days | Deleted on sign-out, account deletion, or expiry. For a device marked “sign out and erase”, see the erase record below. |
| Encrypted family sync copy | Our database (Cloudflare D1) | While the account is in use | Deleted when the parent deletes the account or starts sync over, or with an inactive account after 2 years. Each new copy replaces the previous one, which is kept for devices still downloading it and removed by the hourly cleanup once it is an hour old (normally within two hours; longer only if a cleanup backlog builds up). Starting sync over replaces the copy at once with an empty one that only the new family key can write to. An upload that is never published (the device stopped, or the account was deleted meanwhile) is refused and its parts are removed by the hourly cleanup once they are an hour old. |
| Link codes (family key locked with a one-time code) | Our database | 10 minutes | Deleted when used, or by the hourly cleanup |
| Random ids of the family’s sync copies (the current one and any from before starting sync over) | Our database | While the account is in use | When the account is deleted, every one of them is marked deleted (below), so even a device that still holds an id from before starting over erases itself |
| Random id of a deleted sync copy | Our database | 2 years | Lets other devices know to erase themselves; contains nothing else |
| Weekly summary email text | Passed through, not stored by us | Only while it is sent | Handled by Resend under its terms |
| Daily study helper counts | Our database | 35 days | Deleted by the hourly cleanup |
| Spoken answers and dictation (short recordings, only while the microphone button is on) | Passed through, not stored by us | Only while the request runs | Turned into text by Cloudflare Workers AI (a parent’s dictation from Parent view by OpenAI only with zero data retention; a child’s recording never). Neither the recording nor the text is kept. |
| Homework photos and text sent to the study helper | Passed through, not stored by us | Only while the request runs | Handled under the AI provider’s own terms |
| Speech audio for card words (only when natural voice is on; made by Workers AI, or by OpenAI only with zero data retention) | Cloudflare cache, labeled by a hash of the words, and the device | Up to 1 year in Cloudflare’s cache; on the device until the device is erased | The cache copy expires. It is the spoken words of the card, so it holds whatever the card says. |
| Consent links | Our database (hashed) | 7 days | Deleted when used or by the hourly cleanup |
| Erase record: a hash of the erased device’s old session and of its random device id | Our database | 1 year | Deleted by the hourly cleanup |
| Feedback a parent sends (message, kind, optional rating, app version, device type; linked to the account, which gives the email) and our reply | Our database | Until handled, then 1 year from that day | Deleted by the hourly cleanup; when the account is deleted, hidden at once and removed with it |
| Error reports (kind of error and code location only, app version, device type, screen; no message text and no account) | Our database | 90 days after last seen | Deleted by the hourly cleanup |
| Tester results and notes (invited testers only) | Our database | Until testing ends | Deleted when testing ends for that account, or when the account is deleted |
| Shared weekly study totals (sums per subject across sharing families) | Our database | While useful | The sums don’t record which family sent what; a week can be shared until 14 days after it begins, and admins see it only after that and only when at least five families shared it. The one-way code that marks a family’s week as sent is deleted after 8 weeks. |
| Admin sign-ins (hashed) and the admin log | Our database | Sign-ins 12 hours; log 1 year | Deleted by the hourly cleanup |
| Students, cards, progress, PIN | The family’s devices (readable) and our database (encrypted only) | Until the parent removes the student, erases the device, or deletes the account | Erased from every synced device and from the encrypted copy |
Information security program
Responsibility
Frandy Slueue, for CodeBreeder LLC, is responsible for this program. It is reviewed at least once a year and whenever Study Desk changes how it handles data.
Collect less
- We never ask for or collect photos of children; students get an avatar from the app’s own drawings.
- Sync never sends students’ names, chosen avatars, grade levels, schools, cards or progress in readable form. The optional study helper, natural voice, spoken answers and weekly summary features are the exceptions, described in the Privacy Policy. Devices encrypt them with AES-256-GCM using a family key the server never holds; link codes protect the key with PBKDF2 (210,000 rounds) and expire after 10 minutes.
- No passwords: parents sign in with a single-use emailed code.
- Error reports carry no account and no message text: only the kind of error and the file, line and function in Study Desk’s own code, checked against a strict pattern on the server. Optional study totals are sums across families; the dashboard shows only closed weeks (no more sharing) with five or more families.
- No ads or analytics trackers. The only outside script is Cloudflare Turnstile, loaded on the sign-in screens. Fonts and libraries are served by Study Desk itself.
Protect what we keep
- Sign-in codes and session tokens are stored only as keyed SHA-256 hashes, so a database leak would not let anyone sign in.
- Codes expire after 10 minutes, allow 5 tries, and are limited per email and per network address each hour. Cloudflare Turnstile checks for bots before any code is emailed.
- Parents can see every signed-in device and sign out or erase any of them. An erase request is remembered for a year, so the device erases itself whenever it next comes online. A device that never comes back online can’t be erased remotely.
- Each sign-in code and consent link works once, and every try is counted before it is checked, so parallel requests can’t get extra tries. Email limits are reserved before an email is sent.
- Natural voice and the study helper have daily limits per family, and only signed-in families who confirmed consent can use them.
- The app is served with a strict Content Security Policy, and every backup file or synced copy is checked field by field before use, so a damaged or hand-made file can’t run code.
- Session cookies are HttpOnly, Secure and SameSite=Strict, so page scripts and other sites cannot read or send them.
- All traffic uses HTTPS. The API only accepts requests from the Study Desk site itself.
- The admin dashboard has its own address, is never served on the app’s addresses, and is open only to the owner and at most two helpers. Each sign-in needs a single-use emailed code (kept only as a hash) and lasts 12 hours; it can also sit behind Cloudflare Access. Admins see account facts, feedback, error reports and tester results, never students’ information. Only the owner can sign out a family’s devices, delete an account at the family’s request, or change admins, and every admin sign-in and change is logged for a year (a family appears in the log only as a short account reference, never by email).
- Secrets (signing key and provider keys) are stored as encrypted Cloudflare secrets, never in the code.
Service providers
We use Cloudflare (hosting, database, Workers AI, and turning children’s spoken answers into text), OpenAI (natural voice and a parent’s dictation, used only once OpenAI approves zero data retention for our account), DeepSeek (study helper for parent text), and Resend (email). OpenAI’s terms don’t allow children’s personal data without zero data retention, and card words or a dictation can hold a child’s name, so until that approval is in place nothing goes to OpenAI. Children’s recordings are never sent to OpenAI. Each receives only what its job needs, as listed in the Privacy Policy. We review their security and privacy terms before use and at each yearly review.
Testing and updates
Changes are checked with automated tests, including checks that no student details reach the server in readable form, and with an independent code review before they are released. Dependencies are pinned to exact versions and updated on purpose.
How we operate (not enforced by the code)
The Cloudflare account that runs Study Desk uses two-factor sign-in, and only its owner can reach the database. We review our providers’ security and privacy terms before using them and once a year. These are our own practices; the code above can’t enforce them.
If something goes wrong
If we learn of unauthorized access to personal information, we will stop it, find out what happened, tell affected parents by email without unreasonable delay, and notify authorities where the law requires. Report a security problem to frandyslueue@gmail.com.