Privacy Notice & Student Data Policy

1. No Accounts, Profiles, or Credentials

Curvat.io is intentionally designed without user registration or mandatory sign-ins. Students, teachers, and self-learners can create, edit, explore, and share graphs without ever providing a name, email address, password, student ID, or institutional login.

Because we do not maintain user profile databases, we do not store, process, monetize, or sell student or educator personal records.

2. 100% Client-Side Mathematical Execution

When you enter formulas, functions, geometry commands, or adjust sliders in Curvat.io, all computation runs entirely on your device using client-side JavaScript (powered by JSXGraph, MathJS, and MathLive).

Core mathematical computation and graph state remain client-side. The direct calculator sends anonymous aggregate usage events to Google Analytics. Mathematical expressions, graph state, URL fragments, and exported files are not included. Minimal LMS embeds disable analytics entirely.

3. Graph Links & Stateless URL Compression

Sharing a graph creates a stateless URL containing a compressed payload in the URL hash (fragment):

• Everything after the #g=... symbol stays entirely inside the user's browser and is never transmitted to the web server in HTTP request headers.
• Anyone with your shared link opens a fresh client-side copy of the graph without creating an account or modifying your original work.
• Exported .curvat graph snapshot files are saved directly to your local computer filesystem.

Ordinary calculator graph storage: None stored server-side. Mathematical formulas, slider coordinates, and graph documents remain in stateless URL fragments (#g=...) or locally saved .curvat files. Small interface preferences (such as keyboard dock state, hint dismissals, and dialog choices) may be stored locally in browser storage. Information voluntarily submitted through Feedback or Gallery submission may be stored in Firebase/Firestore for review and support.

4. Classroom & LMS Embed Privacy (FERPA & COPPA Design)

Curvat.io is built specifically to meet the high privacy expectations of K-12 school districts, community colleges, and universities:

• Automatic Analytics Suppression in LMS & Opt-Out: When Curvat.io is embedded inside an LMS (such as Canvas, Moodle, Blackboard, Google Classroom, Schoology, Brightspace) via an <iframe>, loaded via /embed/, accessed with ?embed=true, or visited with ?telemetry=off, all analytics tracking is completely disabled. No telemetry scripts run, and no network requests are sent to measurement endpoints.
• Direct Web Usage Measurement: When visitors navigate directly to curvat.io on the open web, anonymous Google Analytics measurement is configured with advertising signals denied (ad_storage: 'denied', ad_personalization: 'denied'). An anonymous session identifier is used solely to record aggregate visitor counts, active users, and feature usage. IP addresses are anonymized and advertising/personalization signals are completely disabled. In LMS embeds (/embed/, ?embed=true) or with ?telemetry=off, analytics is suppressed entirely.
• Strict Mathematical Content Exclusion: Telemetry is strictly limited to aggregate counter events (such as calculator loaded, graph rendered, visualizer toggled, share dialog opened, or export format). User mathematical input, raw formulas, parsed equations, slider values, coordinates, and URL hash fragments (#g=...) are strictly excluded and never transmitted.
• Educational Privacy (FERPA & COPPA Considerations): Designed to support privacy-conscious educational use. This statement is not a certification of legal compliance. Because Curvat.io does not require student accounts, does not collect student education records or personal information, executes mathematical graphing entirely in the local browser, and suppresses analytics in LMS embed mode, schools and districts can evaluate and integrate Curvat.io into lesson plans, assignments, and curriculum materials in alignment with their FERPA and COPPA compliance obligations. Curvat.io does not act as a certifying authority, and educational institutions maintain discretion over their edtech privacy reviews.

5. Self-Hosted Core Libraries & Technical Infrastructure

Core graphing libraries, mathematical rendering assets, icons, and fonts are served from Curvat’s own hosting origin. Standard technical transmission telemetry (such as IP address and browser User-Agent in server request logs) is handled by the hosting infrastructure solely as necessary to deliver web assets securely over HTTPS.

6. Voluntary Feedback & Community Submissions

Curvat.io provides an optional in-app feedback dialog and community gallery sharing features:

• Community Gallery Browsing: Browsing the Community Gallery is completely static and first-party. Pre-rendered models and curated community examples load from first-party assets. It initializes no App Check, requires no user accounts, and loads no reCAPTCHA cookies or scripts. Community submissions are opening soon, and no Firebase submission services initialize during ordinary gallery browsing.
• Voluntary Tester Feedback: If you explicitly choose to submit feedback via the feedback modal, your message, optional follow-up contact, and diagnostic metadata are sent securely to Google Cloud Firestore.
• Voluntary Gallery Submissions: Community submissions are opening soon. The launch Gallery currently contains curated examples, and no Firebase submission services initialize during browsing.

7. Institutional Inquiries & Contact

If you have questions regarding Curvat.io privacy practices, district security review, or institutional compliance assessments, please contact:

8. Frequently Asked Questions