This policy covers AI Worksheets, including aiworksheets.online, app.aiworksheets.online and api.aiworksheets.online. It explains what we collect, who processes it and how to delete it.
Information we collect
Account information: email address, name and role (teacher, student or admin). Teachers can also create student accounts with a name, username and password and no student email. A teacher may add a guardian email to a student account.
Worksheets and files: the worksheets you create, and the PDFs, images and audio files you upload.
Student work: the answers students submit, plus grades and feedback.
Classes and assignments: class rosters, assignment settings and grade records.
Usage analytics: events about how exercises are used. Each event is stored with a shortened network address (only the first three parts of the IP address, never the full address in analytics) and without the browser type. We delete these events automatically 90 days after we receive them. We keep per-question totals, such as how often answers were checked and the most common wrong answers; they contain no IP address and are not linked to an account. Our application logs note each event only by account id and event name.
AI usage records: who ran an AI task, the name of the file, and which AI model was used. We keep these to track cost and quality.
Logs and error reports: our logs identify users by account id, not by email.
Web server log: our web server keeps a request log to run and protect the service: a shortened IP address (the last part removed), the time, the page or API address requested (without query parameters or class join codes), the response status and size, how long it took and the host name. It records no browser or device details (no user agent) and no referring page. If a request fails at the server, the error record can include the full IP address. Both logs are deleted automatically after 14 days.
Google Classroom
Google Classroom is optional. When a teacher connects it, we ask for one fixed set of Google permissions. We use them to:
List the courses the teacher can pick from.
Import course rosters: student names, Google user IDs and email addresses.
Create coursework in the courses the teacher picks.
Post grades back to Google Classroom.
We encrypt the Google access and refresh tokens (AES-256-GCM) before storing them. All Google calls are made from our servers, and the tokens never reach the browser.
We do not sell Google user data or use it for advertising. We do not use it to train AI models, and Google Classroom data is not sent to AI providers.
Teachers can disconnect Google Classroom in the app at any time. We then ask Google to revoke our access and permanently delete the Google access and refresh tokens we stored, even if Google can’t be reached. Grades not yet sent stop, and are sent only if the teacher reconnects and retries them. Classes imported from Classroom, links to shared coursework and grades already sent stay as history.
Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use information
To let teachers create, assign and grade worksheets.
To let students complete and submit worksheets.
To build worksheets from uploaded documents and to grade written answers with AI.
To turn worksheet text into audio.
To sync grades with Google Classroom when a teacher uses it.
To keep the service running, find errors and control cost.
We do not sell data or use it for advertising.
Who processes your data
We share data only with the providers that run the service. They process it to provide their part of the service.
Hosting provider: runs our servers.
Supabase: database, sign-in and file storage. Supabase also sends account emails (sign-up confirmation and password reset).
Google (Gemini API): receives uploaded documents to build worksheets and, where needed, students’ written answers for AI grading and feedback. It may also generate images for worksheets and spoken audio for listening exercises. Under Google’s terms for our account, Google does not use this content to train or improve its products. It keeps the content for a limited time only, to detect abuse and keep the service secure.
Sentry: receives error reports. We do not send personal data by default.
AI providers process this content only to return results to us. We may also disclose information when the law requires it or to protect the security of users and the service.
Embedded videos: teachers can attach YouTube or Vimeo videos to a worksheet. Nothing is loaded from YouTube or Vimeo until you press Play on a video; the player then uses the most private mode each service offers: YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo with “do not track” on. YouTube (Google) and Vimeo are separate third parties: when you play a video, they may store data on your device under their own cookie policies.
Security
We encrypt Google tokens, check access on every request and scrub error reports. No system is completely secure.
Deleting your account
You can delete your account from your profile: choose Delete account, then type the word it asks for. The account is deleted straight away and this can’t be undone. To protect you, you must have signed in during the last 10 minutes; if not, we ask you to sign in again first.
A student account that a teacher created is deleted by that teacher, from the class. Students with such an account ask their teacher.
What is deleted, and what is kept:
Teachers: your worksheets, workbooks, classes and assignments, with your students’ work on those assignments. Student accounts you created are deleted too, unless another teacher also has the student in a class.
Public worksheets that other teachers use are not lost: each of those teachers gets their own private copy first, so their assignments keep working.
Students: your answers and results, and your place in your classes, in every class.
Everyone: your profile, the files you uploaded, your plan and usage history and, if you connected it, your Google Classroom connection (we ask Google to revoke our access and delete the stored tokens).
What we keep: records of AI usage, for cost and quality, with your account id and file names removed; the log of admin actions, which keeps account ids but no names or emails; usage analytics, which are not linked to any account; and our server logs and AI response logs, until they are deleted on their usual schedule.
If a deletion stops partway, try again: anything already deleted stays deleted, and trying again finishes the job. If you can’t, write to privacy@aiworksheets.online.
Data retention and deletion
Accounts: kept until you delete yours, as described above.
Worksheets: a worksheet that has assignments cannot be deleted.
Assignments: an assignment with student work is archived. It is deleted permanently only if the teacher confirms.
Grade-sync records: deleted together with their assignment.
Usage analytics events: deleted automatically 90 days after we receive them. Per-question totals, which contain no IP address and are not linked to an account, are kept.
Web server logs: shortened IP address, no browser details, deleted after 14 days.
Google tokens: kept until the teacher disconnects Google Classroom, asks us to delete them or the account is deleted.
Children and education data
AI Worksheets is made for schools, teachers and students. Students join a class with a code from their teacher, either with an account the teacher created or one they create themselves. Schools and teachers are responsible for getting any parent or guardian consent that the law requires.
Notifications
We send no assignment emails. The only emails are account emails from Supabase (sign-up confirmation and password reset). Assignment reminders appear inside the app.
Changes to this policy
When we make important changes, we will email teachers and show a notice in the app. Students with username accounts have no email, so they will see the notice in the app.
Contact
Questions, or a request to delete your data? We reply within 30 days.