Privacy at HQ
What stays in your browser, what is sent to a service, and what to check before classroom use.
Updated October 23, 2026
Keep student information out of tool inputs. Do not enter student names, email addresses, student IDs, grades tied to a student, IEP or accommodation records, or other sensitive or identifying details. Removing a name does not always make a piece of writing or a classroom record non-identifying. Use classroom aliases that do not readily identify a child.
Follow your school or district’s review and authorization process before classroom use. No student account is required for the currently offered tools, but that does not mean no information is processed. Writing Feedback remains a fictional-writing-only pilot.
Data by tool
The entries below distinguish classroom content from the website requests, browser identifiers, security checks, and analytics described later on this page.
| Tool | Data and processing | Storage, sharing, and controls |
|---|---|---|
| Classroom Timer, Math Manipulatives, Graph & Data Lab, Puzzle Maker, Combination Lock | Their classroom activities run in your browser rather than sending the entered activity content to HQ for generation. | Download or copy anything you want to keep. Closing a page is not a reliable way to clear all website data; see the browser-storage guidance below. |
| Classroom Screen | Board text, layout, timer settings, saved screens, recovery copies, and resource links are handled in the browser. Opening an embedded website or Google resource sends requests to that provider. | Working boards, named screens, recovery copies, and resource links can persist locally. A shared screen link contains screen text and resource URLs; recipients can open an independent copy. Clearing the current board does not remove saved resource links or all saved copies. |
| Flashcard Challenge | The deck is encoded in the shared link; the QR code carries the same link. Practice runs in the student’s browser. | Anyone with the full link can recover its deck. Changing a deck later does not revoke an older link. Best scores are saved locally. Shared links and downloaded copies must be managed separately from browser storage. |
| Generated teacher materials | Form Quiz Builder, Instruction Builder, Math Practice Studio, Science Lab Builder, Math Number Talk, CER Builder, and Science Phenomena send requests and selected supporting text/options to generation services. Requests can include a browser identifier; follow-up steps can send generated material. Existing Google-file routes use Google Apps Script and Google files. | Existing Form/Instruction Builder notices say HQ source files may be removed after seven days. That is not a verified maximum-retention or deletion guarantee. Use Make Your Own Copy to keep a file in your Google account, then review its sharing and response settings before classroom use. |
| Grade 6 ELA PDF pilot | This limited pilot accepts a lesson topic for original fictional sources. While processing is authorized, requests and generated packets are handled by HQ’s generation services. A browser session cookie controls online access; a request ID alone does not restore access. Do not submit student information. | The pilot uses one shared 24-hour access window, not a new 24 hours for each save. The active page shows exact deadlines: new requests close 94 minutes before online access ends, and generation closes one hour before access ends. Online review and download close at the shared access deadline; downloaded PDFs remain usable. Losing the session cookie or switching browsers loses online access. Access expiry is not a promise that every backend or provider copy has been deleted. |
| Writing Feedback pilot | Selecting Get personalized feedback sends writing, grade level, feedback focus, optional assignment details, and a Turnstile token to HQ’s feedback endpoint for processing through the OpenAI API. HQ also uses connection IP information for rate limiting. Use fictional writing only. | Draft comparison is kept in the page session. Optional device saving has a 24-hour validity window, with expired entries removed when the tool next checks them—not guaranteed background deletion at the deadline. Finish & clear clears the tool’s writing state on that device, not service-provider records. |
| Live Challenge | HQ processes room codes, teacher questions, classroom nicknames, team/class labels when used, answers, response timing, and results to run a live room. A browser identifier supports reconnection. | Room data can be shown to the teacher; nicknames and results can also appear to the class depending on settings and game mode. The teacher can download results. Rooms are configured for about four hours; room expiry is separate from local saved sets, downloaded exports, and infrastructure logs. |
| Contact form | Your name, email address, subject, and message are sent through a Google Apps Script endpoint so HQ can receive and respond to your request. | Use this as an adult/support channel. Do not include student records or unnecessary identifying details. A fixed correspondence-retention period and dedicated privacy-request procedure are not published here; use the Contact page for questions before sending sensitive information. |
Browser storage and clearing your device
- Browser identifiers: the shared site script saves a browser identifier (
hq_browser_id_v1) used by generated-tool requests. Live Challenge saves a separate reconnect identifier (hq_live_client_v1). These identifiers have no automatic expiry set by these tools. They persist until removed by you or your browser, and can be created again on a later visit. - Saved classroom work: Classroom Screen drafts, named screens, recovery copies, and resource links; Live Challenge saved question sets and unfinished teacher drafts; and Flashcard best scores can persist in local storage. Some generated-resource previews also place a plan in local storage. These are separate from server-side room or file lifetimes.
- Writing drafts: on shared school devices, do not use Save on this device. Use Remove saved draft or Finish & clear when finished. The latter does not clear every HQ storage key, other people’s copies, or provider logs.
- Full local clearing: use your browser’s site-data settings to remove storage for the HQ site you used. This can also remove saved classroom work and reconnect information, so export any non-sensitive work you need first. Close open HQ tabs afterward. Clearing site data does not erase browser history, downloaded files, shared links, or data already sent to a service.
A Classroom Screen or Flashcard share link includes the content after the # character. That fragment is not ordinarily part of the initial HTTP request, but the full link still exposes its contents to anyone you share it with and can remain in browsing history or messages. Do not share private classroom content this way.
Hosting, security, analytics, and other providers
Cloudflare hosting and security: loading HQ and using its networked tools involves requests through Cloudflare services. Network information such as an IP address and browser/request details can be processed to deliver and protect the service. HQ-specific request logging and retention have not yet been fully documented in this notice.
Cloudflare Web Analytics: the live site includes Cloudflare’s analytics beacon for page-use and performance measurement. Cloudflare describes this service as not tracking individual users across its customers’ sites. That statement is about Web Analytics, not a promise that hosting, security, or application logs do not exist. See Cloudflare’s analytics data-collection explanation.
Turnstile: Writing Feedback and the Grade 6 ELA pilot use Turnstile when their connected services are enabled. Its security script can load before a writing or lesson submission. Turnstile processes security signals such as IP address and browser information. Security verification is separate from sending writing or lesson information after you choose the relevant submission button. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy.
AI and Google services: writing and generation can involve external AI processing; existing Google-file generation and the contact form use Google Apps Script. Copies you make in Google Drive, resources you embed, downloaded results, and files you share are subject to the relevant account settings and provider policies. Do not collect student responses in an HQ-owned source form; first make and review your own copy.
OpenAI and other generation providers: Writing Feedback uses the OpenAI API. Its requests set store:false, but this does not establish zero retention for security or other provider processing. HQ does not make a no-training or zero-retention promise here. See OpenAI’s API data controls. Account-specific retention, processing locations, and the complete provider arrangements for other generated tools are not specified in this notice. Keep student-identifiable information out of all generation requests.
Questions, deletion, and school review
You can use the Contact page to ask a privacy question. Identify the tool and describe the issue without sending a student’s work or identifying information in the initial message. Local storage must be cleared on the device; copies and exports held by teachers or other recipients must be managed separately.
Limits of this notice: This page does not provide a complete schedule for backend, support, provider, or infrastructure-log retention, or promise a deletion deadline. It also does not supply a legal-operator address or a verified school data-processing agreement. Ask through the Contact page for the information your school requires before relying on HQ for student information. Local clear controls cannot delete copies or records already held by others. This notice is not a certification that HQ meets your school’s requirements.
Official resources for families, educators, and reviewers
These resources explain privacy considerations. Linking to them does not mean HQ is approved, certified, endorsed, or enrolled in a government or privacy program.