Privacy & security
How we keep information safe
For principals, IT leads and anyone reviewing Crateclass for their school. Last updated 20 October 2026.
At a glance
- Students never give an email, phone number or photo
- Every connection is encrypted; passwords are hashed
- Teachers can only reach their own classes; students only their own class
- No ads, no tracking cookies, data never sold
- Schools stay in control of their students' information
Where it runs
| Service | What it does |
|---|---|
| Supabase | Database and teacher sign-in (including Google and Microsoft sign-in) |
| Netlify | Hosts the website pages |
| Stripe | Card payments — we never see card numbers |
| Google Fonts, Cloudflare (cdnjs) | Fonts and the 3D library used by the pages |
Access control
- Every request to the database is checked on the server: a teacher can only read or change their own classes, and a student only their own class.
- Row-level security is switched on for every table, and the browser can only call approved functions — never the tables directly.
- Student passwords are hashed with bcrypt. After repeated wrong passwords, sign-in pauses, and the pause grows longer each time.
- Teachers sign in with an email and password or with their school Google or Microsoft account. Admin tools are limited to named accounts.
- Student sessions expire, and signing out ends them on the server.
Data we keep
Only what's needed to run the classroom — see the privacy policy for the full list. Students have a made-up display name; their real name can be stored only as a private note that their own teacher sees.
Retention and deletion
- Teachers can remove students and classes at any time.
- When a plan ends, classes are kept for 12 months, then deleted.
- Schools or teachers can ask for everything to be deleted, and we do it within 30 days.
Content and safety
- No chat, messaging or free-text sharing between students.
- Trading and the market can be switched off by the teacher, and every trade is visible to them.
- No advertising, no in-app purchases for students, and no links out to social media.
If something goes wrong
If we find or are told about a security problem, we act straight away to contain it, work out who is affected, and tell affected schools and families. If a privacy breach is likely to cause serious harm, we notify the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.
Reporting a vulnerability
Found something that doesn't look right? Please tell us (choose "Privacy or deleting data"). We'll reply quickly and won't take action against good-faith research.