Privacy Policy
Plain-language, minimal-collection, education-first. Last updated July 2026.
What we collect
LewisLab collects the minimum needed to run a learning platform: your email, display name, and role (student or teacher) at registration; the structures you build and save; assignment submissions and attempt outcomes used for progress tracking; which interactive lessons you have started or completed and a tally of your most common mistakes, never a click-by-click log; and per-user preferences (theme, motion, autosave cadence). Guests can use the core tools with no account at all, guest work stays in your browser's local storage until you choose to sign up and claim it.
What we never do
We do not sell personal data, run third-party advertising, or use student work to train external AI models. Analytics used to improve the platform (for example, which chemistry mistakes are most common) are aggregated and de-identified.
Student privacy (FERPA)
Classroom features are designed around FERPA principles: teachers see only the classes they teach and only the students actively enrolled in them (enforced server-side on every request, not only hidden from view); students see only their own records; and educational records are used solely to provide the service. Today, data deletion is self-service only, from the account holder's own Settings page; there is no separate process yet for a school to request deletion of a student's data on that student's behalf. Role changes, score overrides, and account unlocks are captured in an append-only audit log.
Your rights (GDPR)
You can access, correct, or export your data at any time from Settings, and you can delete your account, including saved structures, submissions, and progress records, from Settings → Account. Deletion is permanent and takes effect immediately for personal data, with backups purged on a rolling schedule.
Security
Passwords are stored only as salted bcrypt hashes. Sessions live in httpOnly, Secure, SameSite cookies, never in browser storage readable by scripts. All traffic is encrypted in transit, inputs are validated on every request, and repeated failed sign-ins trigger a temporary account lockout.
Contact
Questions about this policy or a data request? You can already exercise your rights directly from Settings → Account (export and delete your own data, no request needed). For anything else, reach out through the channel you used to learn about LewisLab and we will respond promptly.