Privacy Policy

1. Information We Collect

Google Sign-In information

When you use Google Sign-In, Reflectα obtains the following information through Google OAuth / OpenID Connect:

• Your Google Account email address
• The unique identifier for your Google Account (sub)
• Email verification status
• Hosted-domain information used to confirm an organizational account, when Google provides it

Reflectα requests only the openid and email scopes. It does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or user files.

User and school information

• Name, school, grade, class, student number, and other profile information required for operation
• User type, account status, affiliation, assigned cohort, and authorization level
• Information used to manage available authentication methods, including Google Sign-In and Login ID/password

Learning records

• Monthly learning motivation
• Optional written responses
• Learning goals, action plans, strategies for anticipated distractions, and confidence levels
• Reflections recorded after each period

Operational and audit information

Reflectα records creation and update timestamps for responses, goals, and reflections, along with revision numbers and internal identifiers for the acting user, in order to investigate errors, detect update conflicts, and maintain audit records.

2. How We Use Information

Collected information is used only as necessary for the following purposes:

• Authenticating eligible users and processing sign-in
• Displaying, creating, and editing a student's own learning records and history
• Showing authorized teachers response status, statistics, goals, and reflections
• Educational and research aggregation, analysis, and operational review
• Security, abuse prevention, incident response, and auditing
• Maintenance and improvement of the service

3. Handling of Google User Data

Information obtained from Google is used to authenticate eligible users and match them to pre-registered Reflectα accounts. After the first successful authentication, the Google unique identifier is linked to the corresponding Reflectα account and used for subsequent identity verification.

• OAuth authorization codes, access tokens, and ID tokens are not stored persistently.
• The Google OAuth client secret is managed on the server and is not disclosed to users.
• Google user data is not used for advertising, ad targeting, or sale.
• Google user data is not disclosed to third parties beyond the purposes described above.

4. Access Scope and Disclosure

Student features display and update only data linked to the authenticated student. Teacher features display only data within the school and authorization scope assigned to that teacher.

• Teacher accounts can view only the current research cohort; existing cohorts do not appear in their filters.
• Academic accounts retain the established teacher viewing scope for their school.
• Admin accounts can use the Student functions and teacher functions equivalent to Academic as needed for administration.
• Responses from internal test accounts are excluded from standard research analytics.

When data is exported for educational or research use, identifiers may be replaced with pseudonymous values. Because written responses may still allow a person to be inferred, exported data is handled carefully.

Personal information is not disclosed to third parties for unrelated purposes unless required by law, necessary to protect life, safety, or property, or based on appropriate authorization or consent.

5. External Services

Reflectα primarily uses the following external services:

• Google OAuth / OpenID Connect: identity verification during sign-in
• Google Apps Script / Google Spreadsheet: application processing and data storage
• Vercel: static hosting for this website, the Privacy Policy, and the Terms of Use

If an operator enables Slack notifications, Reflectα may send limited notification information such as the response year and month. Standard notifications are not designed to send student names, motivation values, or complete written responses.

This public website currently uses no advertising, behavioral tracking scripts, analytics, or contact form. Selecting “Open Reflectα” takes you to the application hosted on Google Apps Script.

6. Storage and Security

Access to authentication data and learning records is controlled by user type and server-side authorization checks. After sign-in, the session token is kept in browser memory and is not stored in the URL, localStorage, or sessionStorage.

For accounts that use passwords or access keys, plaintext credentials are not stored in the data store. Internal test accounts that support both Google Sign-In and Login ID/password are managed under the same student ID.

7. Retention, Correction, and Deletion

Data is retained for the period necessary for education, research, auditing, and service operation, in accordance with school policies, research plans, and other applicable operational rules. When information is no longer needed, it is deleted or made less identifiable where operationally feasible.

For correction of registered information, suspension of use, deletion, or other requests, contact the school, the service operator, or the contact address below. Research records and audit trails may not be immediately deletable when applicable rules require their retention.

8. Use by Minors

Reflectα is primarily intended for students and teachers who have received access instructions from a school or related organization. Use by minors, use of data for research, and any related explanations or consent procedures are managed in accordance with the school, research plan, and applicable policies.

9. Changes to This Policy

This policy will be updated when material changes are made to the service's features, collected information, purposes of use, or external services. The latest update date appears at the top of this page.

10. Contact

For questions about how Reflectα handles data, contact emiri@reflectalpha.com.