Who we are
OHM School is operated by Persist and Vital Ventures ("OHM School", "we", "us"). We are responsible for the personal information described in this policy. You can reach us about anything in it at support@ohmschool.org.
Who may use OHM School
OHM School is a learning platform for kindergarten to grade 12. Anyone who creates their own account confirms they are at least 13 and accepts the Terms. A child under 13 can use OHM only through a managed account that a parent or legal guardian creates from their own parent account, after confirming they have authority to do so and reviewing this policy and the Terms. We keep a record of that authorization, and of any later withdrawal. Course creator accounts, which use only the AI course creator, are for adults of 18 or over.
Information we collect
- Account details: email address (or, for a managed child, a username and PIN), display name, role, and an optional profile photo.
- Learning profile: age or grade, language and English level, goals, interests, learning preferences, and any support needs or extra-challenge preference a learner or parent chooses to share.
- Learning activity: lessons, answers, quiz and test scores, time spent learning, notes, whiteboard work, review cards, tutor and Study Buddy conversations, and certificates.
- SI Ready work: answers, drawings, reflections and projects a learner writes in SI Ready, and any photos of project work they choose to add. Photos are stored privately, location and camera details are removed before they are saved, and they are shown only through links that expire within minutes.
- Spoken questions: when a learner talks to the AI tutor in voice mode, a short recording of what they say (up to about a minute). It is used to understand the question and is not kept; the conversation is kept as text.
- Family features: links between parents and learners, letters a parent sends, week plans, and the access each guardian has.
- Secure unit tests: when a learner starts one, and only with their camera and microphone permission, short image and sound samples taken during the test (see below).
- Plans and payments: which plan a student has and who pays for it (the student, if 13 or older, or a parent), how many tutor messages and course credits have been used this month, a course creator's credit history, and our payment provider's reference for the person paying. Card details are entered on the payment provider's own page and never reach us. Children under 13 never enter payment details.
- Device and security data: time zone, when an account was last used, sign-in events, request identifiers, and error reports.
How we use information
We use information to sign people in, deliver and personalize lessons, grade work, keep progress, show parents how their child is doing, issue certificates, keep the service reliable and secure, prevent abuse, and answer support and privacy requests. We do not sell personal information or use it for targeted ads.
Safety. Messages a learner writes to the AI tutor and similar features are checked for signs that they may be at risk of harm. If a message suggests that, the learner gets a caring reply with ways to reach a trusted adult, their linked parent is told, and our team is alerted. The alert says that a check-in is needed; it does not repeat the learner's words.
Secure unit tests. At the start of a secure unit test, a photo and a short voice sample are taken. During the test, short camera and microphone samples are checked automatically against them and for exam rules: the same person throughout, one person present, facing the screen, no phone, no second voice. The check only compares the learner with themselves at the start of that test; it does not look anyone up or name anyone. The images and sound are not stored. Only the results of the check, and a one-way fingerprint of the starting photo that cannot be turned back into it, are kept with the test attempt.
Who helps us run OHM
We use a small number of service providers to run OHM School. Each receives only what its job needs, and may use it only to provide that service to us.
- Hosting, database and sign-in: store accounts and learning records and run the website.
- AI providers: when a learner uses the AI tutor, Study Buddy, Explore, AI grading or lesson features, the question and the context needed to answer it (such as the learner's first name, grade, interests, the lesson, and earlier messages in that conversation) are sent to an AI model provider to produce the response. A question spoken in voice mode is sent as the recording. Secure unit test samples, and the starting photo and voice sample they are compared with, are checked this way too.
- Voice: lesson and tutor text that is read aloud is sent to a speech provider; a learner's own voice is never used for this. While a learner speaks in voice mode, some browsers show live captions using the browser's own speech service (for example, Google's in Chrome), under that browser maker's terms.
- Lesson pictures: illustrations are created from the lesson's own text and the learner's age range, never from anything that identifies a learner.
- Payments: take card payments, run monthly and yearly plans, and send receipts. The provider receives the payer's name, email, billing address and what was bought (the payer is a parent, or a student aged 13 or older paying for themselves), never a child's learning records.
- Email: to send account emails, password resets, safety alerts and the weekly family update, an email provider receives the address and the message.
- Videos, images and reference sources: lessons show videos, pictures and facts from public video, image, encyclopedia and library services. When a page shows them, your browser or our servers request them from those services, which can see the request and your IP address but no account details.
- Password safety check: when a password is chosen, we check it against a public list of leaked passwords by sending only the first five characters of its scrambled (hashed) form, never the password.
- Bot protection: when you sign up, sign in, or ask for a password reset or confirmation email, a security check (Cloudflare Turnstile) looks at technical signals from your browser, such as your IP address and browser type, to tell people from automated bots. It is used only to keep accounts safe, never for advertising.
- Notifications: if you turn on device notifications, your browser's notification service delivers them.
- Error monitoring and analytics: technical error details, and, only if you allow it, visits to our public pages (see Cookies and analytics).
Our database is hosted in the United States, and these providers may process information in the United States and other countries. If you would like the names of the providers we currently use, email support@ohmschool.org and we will send you the list. We share personal information with others only to run OHM, when the law requires it, or to protect someone's safety.
Children and parents
For a managed child account, we collect only what the child needs to learn on OHM: the information listed above, entered by the parent or created as the child learns. Children's information is never used for advertising and is never sold.
A parent can see their child's progress, including SI Ready projects the child sends for review (never their private reflections or their conversations with Ollie), update the child's learning profile and grade, download the child's data, withdraw authorization (which switches off sign-in at once), and permanently delete the child's account, all from the family pages. To ask anything else about your child's information, email us. If you believe a child under 13 is using OHM without a parent's authorization, tell us and we will delete the account.
A parent who pays for Family Pro can also see how much of each seated child's monthly allowance has been used, including for a child with their own account.
Retention and security
We keep account and learning data while an account is active. When an account is deleted, its learning records, tutor conversations, SI Ready projects and photos, and profile photo are deleted with it, and a managed child's authorization record is removed. A minimal record that the deletion happened is kept for 90 days for security. Encrypted backups are not edited, so deleted data stays in them until they expire, within 30 days. Technical logs that contain no lesson content may be kept longer for security. Records of payments are kept for as long as tax and accounting law requires, even after an account is deleted, and our payment provider keeps its own records of the payments it processed.
We protect information with access controls, encrypted connections, and restricted server credentials. No online service can promise perfect security, and we will tell affected users if a breach puts their information at risk.
Your choices
You can review and correct your profile, download a copy of your account and learning records (a one-time, signed-in download link that expires after 15 minutes), reset your password from the sign-in page, and permanently delete your account from your profile. A parent can do the same for a managed child, but not for a learner who has their own account and only shared their progress through a family link.
For any other privacy request, email support@ohmschool.org with "Privacy request" in the subject line. We aim to respond within 30 days.
Changes
We may update this policy as the service changes. The effective date above shows the current version, and we will point out important changes in the service.