Privacy Policy

What we collect

• Your name and email address when you sign in.
• Classes you create or join, your role, tags, help requests, and polls.
• If a teacher imports from Google Classroom, the names and email addresses of students in the selected course.
• HTTP-only cookies to keep you signed in. We do not use tracking or advertising cookies.

How we use it

We use this data to run the help queue, polls, and class management features. We do not sell your data, show ads, or use it to build advertising profiles.

Limited use of Google Classroom data

HelpQueue's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Classroom roster data is used only to populate the pending students list in the class you import into.

Who we share data with

We do not sell, rent, or trade your data, and we do not share it for advertising. We do not transfer Google user data to third parties except as described here. We share the minimum necessary with the service providers that operate HelpQueue on our behalf:

• WorkOS — authentication. Receives your name and email address to create and verify your sign-in session.
• Cloudflare — application hosting and database. Stores all class, roster, request, and poll data, and serves the site.
• Google Cloud — hosting for our code execution and visualizer services. These receive only the code a student writes, never names, email addresses, or Google Classroom roster data.

These providers process data only to deliver their service to us and may not use it for their own purposes. We may also disclose data if required by law, or to protect the safety of users, and we will transfer data if HelpQueue is ever acquired or merged, in which case this policy governs until you are notified of any change.

How we protect your data

• All traffic is encrypted in transit with HTTPS/TLS. Data is encrypted at rest by our hosting and database providers.
• Session cookies are HTTP-only, same-site, sealed with an encryption key, and marked secure in production, so they cannot be read by scripts in the browser.
• Google OAuth flows are protected against cross-site request forgery with a state parameter, and we request the narrowest Classroom scopes we can.
• Every permission check runs on the server. Roster data is visible only to teachers of the class it was imported into, and never to other classes or other users.
• API keys and OAuth secrets are stored as encrypted secrets and are never sent to the browser.
• Access to production data is limited to the maintainer of HelpQueue and used only to operate and support the service.

Data retention

Account and class data are kept while the class exists. Pending invitations are deleted when the invited student signs in or when a teacher cancels the invitation.

Your rights

You can sign out, leave a class, or ask us to delete your account at any time. Email us and we will respond within 30 days.

Children

HelpQueue is intended for classroom use. If you are under 13, you may use HelpQueue only with the involvement of your school or guardian.

Changes

We may update this policy. The "Last updated" date will reflect any changes.

Contact

help@classbrook.com