Privacy & data

What leaves the student's device

• Student video: nothing. The webcam stream is processed in the browser to check that the student's face is centered in the camera (camera alignment). It does not track where the student's eyes are looking. It is not uploaded, not stored, and not shared.
• Student audio: To turn speech into text, BrightSpeaker uses the speech recognition built into the browser. That browser company receives the student's audio: Google for Chrome and Chromebooks, Microsoft for Edge, and Apple for Safari on iPad and Mac. We don't receive or store that audio, and it is covered by the browser company's own terms, not a contract with us. Video is never sent.
• Transcript: the text of what a student said during a session. By default it is not saved: it is shown on the results screen and then discarded. A student can turn on “Save my words on this device” before a session; the text is then kept in the browser's local storage for 30 days and deleted automatically, and it can be deleted sooner from the history page. If authenticated accounts ship later, we will document where transcripts live before any school deployment uses them.
• Scores, XP, and badges: numerical results of a session (including a word count), stored in the browser's local storage on that device.
• Day-30 pilot summary: At day 30, the teacher may share a counts-only summary with us: no names and no words.

What we don't collect

• We don't ask for a student's birthdate, phone number, home address, or parent email.
• We don't use third-party ad trackers or advertising cookies. See the Cookie Policy for the current browser-storage and consent notice.
• We don't build a profile of a student to sell or share.
• We don't enable peer-to-peer messaging or social features that would create a moderation surface in a K–5 product.

Website analytics and error reporting

We use privacy-focused operational tools to understand whether the public website works and to diagnose software errors. Vercel Web Analytics measures aggregate page visits on our marketing pages without cookies. It is not loaded on student pages (practice, the map and islands, history, the teacher report, or the teacher dashboard).

Sentry receives privacy-filtered error reports and a small sample of performance timings: no video, audio, transcripts, scores or student identifiers. It is configured not to send default personal information, request bodies, cookies, request headers, or user identity, and Session Replay is not enabled.

If you contact us

When you use the contact form, the name, email, role, school and message you enter are sent to us by email. The IP address of the request is used for rate limiting.

Who we work with (sub-processors)

To run the product, we rely on a small number of services. Today these include:

• Vercel — hosts the website and provides cookie-free aggregate web analytics on marketing pages only.
• Sentry — privacy-filtered error reports; no video, audio, transcripts, scores or student identifiers. Session Replay is disabled.
• Clerk — Clerk provides sign-in for the teacher dashboard pilot; public sign-up is closed.
• Neon — our managed PostgreSQL database; not currently used for student data in the browser demo.
• Resend — delivers contact form messages to us by email.

Browser speech services (not our contractors)

The browser's built-in speech recognition turns a student's speech into the live transcript. The browser company receives that audio under its own terms; we have no contract with them for it.

• Google — Chrome and Chromebooks.
• Microsoft — Edge.
• Apple — Safari on iPad and Mac.

When we sign a data privacy agreement with a school, we'll disclose the current sub-processor list there as well.

About COPPA and FERPA

Bright Speaker is designed for K–5 schools. That means COPPA (for students under 13) and FERPA (for education records) apply to any real deployment. We do not yet hold formal compliance certifications like a COPPA Safe Harbor attestation or a SOC 2 report. We'll be transparent about what we've completed and what's in progress in any procurement conversation. If a school or district requires a data processing agreement to run a pilot, we'll review the language with you and be explicit about what is ready versus still in legal/compliance work.

Deletion and questions

You can clear all session data for your browser from the history page. If authenticated accounts and teacher/admin dashboards ship, the related deletion controls will be documented before schools rely on them.

Questions, corrections, or a data-deletion request? Write us here.

Last updated: 2026-09-26.