Universal Learning

Privacy Policy

Effective August 24, 2026

Universal Learning is operated by Let's Learn, Nemo!, a sole proprietorship based in Massachusetts ("we," "us," "our"). This policy explains what we collect when you use universal-learning.studio, why we collect it, and what you can ask us to do about it.

It covers the whole platform: courses run for a school or university, courses we offer directly, and the open tools at /tools.

We have tried to write this in plain language. If something here is unclear, email us and we will explain it.

1. The short version

  • We collect what is needed to run a course and almost nothing else.
  • We do not sell your information, and we never have.
  • There are no advertising trackers, no analytics scripts, and no third-party cookies on this site.
  • We never see or store your password. Sign-in happens through Google.
  • The open tools at /tools run entirely in your browser and require no account.

2. Who this policy is for

  • Students enrolled in a course on the platform.
  • Parents and guardians of students under 18.
  • Teachers, teaching assistants, and graders who run courses.
  • Visitors who use the open tools without an account.

3. What we collect

Account information, and how we handle Google user data

Universal Learning uses Sign in with Google as its only sign-in method. We request the minimum sign-in scopes only — your basic profile and email address. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service, and we cannot read them.

To be explicit about the Google user data we receive:

  • What we access. Your name and email address, and the Google account identifier that lets us recognise you on your next visit. Nothing else. We never receive, see, or store your Google password.
  • How we use it. Solely to create and secure your account, to show your name to your instructor and classmates in the courses you join, and to send you course email at that address. We do not use it for advertising or profiling.
  • How we store it. In our own database, held by Supabase (Section 7), encrypted in transit and protected by row-level security (Section 11).
  • How we share it. We do not sell it, and we do not share it with anyone outside the service providers listed in Section 7 who process it on our behalf. It is visible to the staff of courses you enrol in.
  • How long we keep it. For as long as your account is active. You can ask us to delete it at any time (Section 12), subject to the record-retention rules in Sections 9 and 10.
  • Transfers. We do not transfer Google user data to third parties for any purpose other than operating the platform, and we do not use it to develop, improve, or train generalised machine-learning models.

We also store the role your account has on the platform (student, teacher, teaching assistant, grader, or administrator).

Course information

Once you are enrolled in a course, we store the records that make a course work:

  • Your enrollment, and the name you enrolled under
  • Requests to join or leave a course, including any reason you provide and the reason an instructor gives if a request is declined
  • Your work: assignment submissions, module attempts, answers, and uploaded files or images
  • Your results: scores, grades, feedback, and proficiency units earned
  • Support messages you send to your instructor through the platform
  • Announcements sent to you, and whether they were emailed

Activity information

While you have the platform open, we record a last-active timestamp and a running count of active minutes in each course. Instructors use this to see who is engaging with the material. We do not record which pages you visit, what you click, how long you look at a particular question, or anything about your activity outside the platform.

Technical information

Our hosting and database providers keep standard server logs, which include IP addresses and browser type. We use these only to keep the service running and to investigate abuse or outages.

Separately, when you start and submit a module attempt, we record the IP address the request came from and store it with that attempt. Only your instructor and platform administrators can see it. Teaching assistants and graders cannot. We keep it because an attempt is an academic record and questions about one are sometimes raised long after it was taken.

An IP address is a rough signal, not an identification: people sharing a campus or home network share an address, and mobile addresses change on their own. We do not treat it as proof of anything by itself.

4. What we do not collect

  • No payment information. The platform does not process payments. We do not store card numbers or bank details.
  • No advertising or analytics trackers. There is no Google Analytics, no advertising pixel, no session recorder, and no third-party tracking cookie on this site.
  • No passwords. Sign-in is handled by Google.
  • No location tracking, contacts, camera, or microphone access.
  • No data from the open tools. Everything at /tools runs in your browser. Files you open there are never uploaded to us.

5. Cookies

We set cookies for one purpose: keeping you signed in. These are session cookies managed by our authentication provider. Clearing them signs you out. There are no advertising or tracking cookies on this site, so there is no cookie banner to dismiss and nothing to opt out of.

Web fonts are served from our own domain, not from a font provider, so loading a page does not tell anyone else that you visited it.

6. How we use your information

We use what we collect to:

  • Create and secure your account
  • Enroll you in courses and show you the right material
  • Deliver, score, and record your coursework
  • Show your instructor your progress and activity
  • Send you course email: announcements, and notices about enrollment requests
  • Answer your support messages
  • Keep the platform working, and investigate abuse or technical problems
  • Give your instructor a record of where a module attempt was started and submitted from, if a question is later raised about it

We do not use your information to build advertising profiles, and we do not use student work to train machine-learning models.

7. Who we share it with

We do not sell your information and we do not share it for advertising.

We share it in three situations:

With your instructor and course staff. Teachers see the roster, work, grades, and activity for their own courses, and the IP address recorded with each module attempt in those courses. Teaching assistants and graders see only what their assigned permissions allow, and are not shown attempt IP addresses.

With the service providers who run the platform. Each of these processes data on our behalf, under their own security obligations:

  • Supabase — database, authentication, and file storage
  • Vercel — website hosting and server logs
  • Resend — sending course email
  • Google — sign-in only (we receive your name and email address)

When the law requires it. We will disclose information if we are legally required to, or where it is necessary to protect someone's safety.

If the platform is ever transferred to another operator, we will give notice before your information moves.

8. Students under 18

The platform is not intended for children under 13, and accounts may not be created for them.

Students between 13 and 18 may use the platform, but only with the permission of a parent or legal guardian. By allowing a student under 18 to create an account or to enroll in a course, a parent or guardian confirms that they have reviewed this policy and consent to the collection and use described in it. For any course we offer directly, the parent or guardian is the person entering into the agreement on the student's behalf.

A parent or guardian may, at any time, ask us to:

  • Show them what information we hold about their child
  • Correct anything that is wrong
  • Delete their child's account and personal information

Email us and we will verify the request and act on it. Where the student is enrolled in a course run by a school, we may need to direct the request to that school first — see the next section.

9. Courses run through a school

Some courses on the platform are offered through a college, university, or school. For those courses, the records we hold — enrollment, coursework, and grades — may be education records under the Family Educational Rights and Privacy Act (FERPA) and comparable state laws.

For those courses:

  • The school controls the record. We hold and process it at the direction of the instructor, acting as a school official with a legitimate educational interest.
  • We do not disclose those records to anyone outside the course, except as described in Section 7.
  • Requests to inspect, amend, or challenge an education record should go to the school's registrar, not to us. We will support the school in responding.
  • If the school ends the course or asks us to return or delete the records, we will.

For courses we offer directly, no school is involved and this section does not apply.

10. How long we keep things

We keep your account and coursework for as long as your account is active.

When an instructor removes a student from a course, the enrollment is archived rather than erased. The student disappears from the active roster, but the coursework and grades remain available to the instructor, because a grade record has to survive the end of a term. A separate purge step removes the records permanently, and an administrator must approve it.

If you close your account, we delete your profile and your work, except where we are required to keep an academic record for a school (Section 9) or where we need to retain something to resolve a dispute or meet a legal obligation.

Server logs held by our hosting providers roll off on their own schedules, typically within 30 days.

The IP address recorded with a module attempt is kept for as long as that attempt is kept, and is deleted with it.

11. How we protect it

  • All traffic to the site is encrypted in transit (HTTPS).
  • The database enforces row-level security: the rules about who can read a given row are applied by the database itself, not just by the application, so a bug in a page cannot expose another student's work.
  • Access is scoped by role. Teaching assistants and graders receive only the permissions an instructor grants them.
  • We never hold your password, so it cannot be stolen from us.

No system is perfect. If we discover a breach affecting your personal information, we will notify you and the Massachusetts Attorney General's office as required by Massachusetts law (M.G.L. c. 93H).

12. Your choices and rights

You may ask us to:

  • See the information we hold about you
  • Correct anything inaccurate
  • Delete your account and personal information
  • Export your coursework in a portable form

Email us and we will respond within 30 days. We may need to verify your identity first, and for courses run through a school we may need to route the request through that school.

You can also stop course email at any time by asking your instructor or by unenrolling from the course. Note that some messages — such as the outcome of an enrollment request — are part of running the course and are sent to everyone affected.

13. Where your information is held

The platform and its providers store data on servers in the United States. If you use the platform from outside the United States, your information will be processed here.

14. Changes to this policy

If we change this policy in a way that matters, we will update the effective date above and post a notice on the site. Continuing to use the platform after a change means you accept the updated policy.

15. Contact us

Let's Learn, Nemo! Massachusetts, United States letslearnnemo@gmail.com

If you have a question about this policy, or a request under Section 12, email us and a person will read it.