Privacy Policy

1. Introduction

Downtime ("the Platform", "we", "our", "us"), by Leon Classroom, is a live lesson assistant. It turns what is said in a lesson into notes, questions, games and lesson plans, using speech-to-text and AI models.

We take the privacy of our users seriously, especially when it comes to students. This Privacy Policy explains what data we collect, how we use it, who processes it, how long we keep it, and the choices you have. By using the Platform, you consent to the practices described in this policy.

2. What We Collect

From Teachers:

• Account data: email address, name and avatar.
• Payment information, processed by Stripe. We do not store your card details.
• Lesson data: the transcript of what is said in your lesson (which can include students speaking aloud), messages in an online meeting's chat, and the notes, materials and lesson plans made from the lesson.

From Students:

• A typed first name when joining a game or activity. Students never create an account or sign in.
• Game interactions: answers, drawings, scores and chat messages, and each game's final scores.
• Activity answers given on their own device, including any photos, drawings and spoken answers they choose to submit.
• If the teacher saves a class: the first names students play under, and their game results, kept with that class.
• IP address, used solely to run the service.

2b. From Website Visitors

Before you create an account, and whether or not you ever do, we record one summary of each visit to our website (leonclassroom.com):

• Which sections of the page you reached, how long you spent in each part of it, and how far you scrolled.
• Which buttons and links you clicked, and which questions you opened in the FAQ.
• If you highlighted text, which section it was in and roughly how much — never the words themselves.
• On the contact page, which fields you started filling in, and whether you sent the form. We never record what you typed unless you send it.
• Your browser, operating system, screen size, IP address and approximate location.

We do not record your mouse movements, do not take screen recordings, and do not read anything you type and choose not to send.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Providing the service: Real-time transcription, turning the lesson into notes and materials, and running games and activities.
• Improving content quality: Analysing usage patterns to improve the accuracy and relevance of what the Platform produces.
• Analytics: We record page views, button clicks and a summary of how each visit went — described in section 2b — against a first-party visitor identifier stored in your browser, along with your IP address, approximate location and browser type. Once you create an account that identifier is linked to it, so earlier visits from the same browser become part of your account record.
• Advertising measurement: If you reach us from one of our adverts, we store that advert and campaign identifier in your browser so we can tell which adverts lead to teachers signing up. We send a record of sign-ups and subscriptions to Meta Platforms Ireland Limited for the same purpose. Your email address, phone number and name are converted into irreversible hashes before they leave our servers; we never send them in readable form. The record also carries your IP address, browser details and the advert's click identifier. Meta also uses this data for its own advertising purposes.
• Running the service: Our team is notified when lessons start and end, with the teacher's name, email address and lesson topic, and sometimes the first name of a game's winner.
• Communication: Responding to support requests and providing service updates.

4. Lesson Audio and Content

• Lesson audio: In the classroom, your browser sends speech directly to Soniox, which turns it into text in real time and does not store the audio or the text (zero data retention). In an online lesson, Skribby's meeting bot joins your Zoom, Meet or Teams call and passes the call's audio to Soniox in the same way. The bot records no video, and its copy of the audio is deleted as soon as the lesson ends. We keep no recording of a lesson.
• Spoken answers: When a student answers aloud in an activity on their own device, the answer is transcribed by Soniox on the same terms, and the recording is kept with the activity so the teacher can review it.
• Transcripts: The transcript is stored with the lesson and processed by AI models to produce notes, questions, games and lesson plans.
• AI processing: Lesson text is processed by AI models reached through OpenRouter, restricted to providers that do not store it or train on it. Pictures are generated, and photos or drawings that students submit are read, by Google's Gemini models through OpenRouter. The Class Simulator demo sends the topic you type to Anthropic's Claude to write a sample lesson.
• What is made from the lesson: Notes, summaries, questions, games and lesson plans are stored with the lesson for ongoing use.

5. Third-Party Processors

We work with the following service providers to run the Platform:

• Soniox — Speech-to-text, in real time, with zero data retention. Privacy Policy
• Skribby — The meeting bot that joins online lessons. Audio only, deleted when the lesson ends. Privacy Policy
• OpenRouter — Access to the AI models that process lesson text (restricted to providers that do not store it or train on it), generate pictures and read students' photos and drawings. Privacy Policy
• Anthropic — Writes the sample lesson in the Class Simulator demo. Privacy Policy
• Stripe — Payment processing. Privacy Policy
• Twilio SendGrid — Sending account and service emails. Privacy Policy
• Cloudflare — Bot protection (Turnstile) on sign-up, sign-in and contact forms. Privacy Policy
• IPinfo — Approximate location from your IP address. Privacy Policy
• Discord — Our team's internal notifications, described in section 3. Privacy Policy
• Linode (Akamai) — The servers the Platform, its database and its support chat run on. Privacy Policy
• Pexels, Pixabay and Openverse — Receive search terms taken from a lesson's topic, to find photos for it. No personal data is sent.
• Meta Platforms Ireland Limited — Advertising measurement. Unlike the providers above, Meta is not only acting on our instructions: it uses the sign-up and subscription records we send for its own advertising purposes, which makes it a separate recipient of your data rather than a processor. This applies only if you reached us from one of our adverts. Privacy Policy

Support chat (Chatwoot), error tracking and search run on our own servers, not a third party's.

6. Data Retention

We keep data for the following periods:

• Game rooms and in-game chat: Deleted automatically 2 hours after the game.
• Activity answers: Deleted automatically after 7 days, except the photos, drawings and spoken answers students submit, which are kept with the lesson.
• Lesson records: Transcripts, meeting chat, notes, materials, game results and the files students submit are kept until you ask us to delete them, or to delete your account.
• Saved class lists: Kept until you ask us to delete them, or to delete your account.
• Meeting bot audio: Deleted as soon as the lesson ends. If a deletion ever fails, Skribby deletes it after 7 days.
• Account data: Kept until you request account deletion.
• Analytics and advertising measurement: Visit records, including IP address and approximate location, are kept for 180 days and then stripped of anything that identifies a device. Advert cookies expire after 90 days. For a sign-up that came from an advert, the IP address, browser details and click identifier are cleared after 180 days; the hashed identifiers are kept. Records already sent to Meta are held under their own retention terms and cannot be recalled by us.

7. Children's Data

• Students do NOT create accounts on the Platform. They join games and activities through links or codes provided by their teacher.
• Minimal data is collected from students: only a typed first name is required. No email address, password, or other personal identifiers are collected.
• The teacher is responsible for obtaining any required parental consent before allowing students to participate, in accordance with applicable laws.
• Game rooms and activity answers expire automatically (section 6). Game results, saved class lists, and the photos, drawings and spoken answers students submit are kept with the teacher's lessons until deleted at the teacher's request.
• We do not knowingly collect personal data from children under the age of 13 without teacher or parental consent. If we become aware that we have collected data from a child under 13 without appropriate consent, we will take steps to delete it promptly.

8. Cookies

• Signing you in: directus_token keeps you logged in, and active_org remembers which school you are working in. Both are required for the Platform to work.
• Understanding our visitors: dt_vid is a random identifier that lets us tell a repeat visit from a new one, so our visitor counts are not inflated. It holds no name, email or account details, and is kept for 12 months. dt_vs records which version of that identifier you have.
• Advertising: dt_attr and dt_ref record which of our adverts brought you here, so we can measure which ones lead to teachers signing up. They are set only if you arrive from an advert, and are kept for 90 days. dt_touch lasts one minute and makes sure that arrival is recorded once. These are advertising cookies.
• Remembering this notice: dt_consent records that you have seen the cookie banner, so it is not shown on every page.
• We do not sell your data, and we set no cookies belonging to third-party advertising networks. The advertising cookies above are our own, set by our sites.

9. Your Rights

Under applicable data protection laws, including the Personal Data Protection Act 2010 (PDPA, Malaysia) and the General Data Protection Regulation (GDPR, where applicable), you have the following rights:

• Right to access your personal data that we hold.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") of your personal data.
• Right to data portability, allowing you to obtain your data in a structured format.
• Right to withdraw consent for data processing at any time.

To exercise any of these rights, email support@leonclassroom.com or use our contact page.

10. Data Security

We implement appropriate technical and organisational measures to protect your data:

• All data is transmitted via HTTPS/TLS encryption.
• Authentication tokens are securely managed and stored.
• Live game and activity data is isolated per session and expires automatically.
• We conduct regular security reviews of our systems and practices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date.

Continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.