Privacy policy

Account information

• Your name, email address, and a profile handle.
• If you sign up with a password: a one-way hash of it (bcrypt). We never store or see the password itself.
• Optional profile details you choose to add — school, grades, subjects, bio, avatar image.

Content you create

• Lessons and their version history, attached files, Google Drive links, comments, Field Notes, suggestions, standard requests, and saved searches.
• Which lessons you adapt from others, so attribution chains work.

If you connect Google

• Your Google account's basic profile and email, plus access and refresh tokens so the app can act on your behalf.
• The drive.file scope — the narrow one. It grants access only to files you specifically pick or that the app creates. We cannot see the rest of your Drive.

Technical

• A session cookie (a signed token) that keeps you logged in.
• Ordinary server logs kept by our hosting provider — IP address, timestamp, which page — used for security and debugging.
• A record of which version of these policies you accepted and when, so we can show you what changed if we update them. We don't log your IP address for this.

No advertising identifiers. No behavioural profiling. No session recording or heatmaps. No third-party analytics of any kind. No data brokers. We don't ask for, and don't want, information about your students.

• To run your account and show you your work.
• To publish lessons you choose to make public, and credit you for them.
• To power search — including semantic “similar lessons” matching.
• To send you the notifications you've earned (someone adapted your lesson, etc.).
• To keep the site secure and to investigate abuse or takedown reports.

That's the whole list. We don't repurpose your content for anything you wouldn't expect from reading it.

We use a small number of infrastructure providers. They process data on our instructions, for the purposes below, and nothing else:

To make search work by meaning rather than keyword, we generate a numeric “embedding” for each lesson. Doing that sends the lesson's title, summary, grades, subjects, standards, learning objectives, and author's notes to Google's Gemini embedding API. Your search queries are sent the same way.

Attached files are not sent. Neither are comments, Field Notes, or your profile.

This applies to private lessons too — the text above is processed so your own search finds them. If that's not acceptable for a given lesson, don't put sensitive material in those fields.

Google processes this under its API terms and we don't use it for advertising or profiling. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to others except as needed to provide the service, and we never use it for advertising.

Public: lessons you mark public, your display name, profile handle, and the optional profile details you add (school, grades, subjects, bio), plus comments and Field Notes you leave on public lessons.

Not public: your email address, your password hash, your Google tokens, and any lesson kept private.

Public lessons are also licensed CC BY-SA 4.0 — meaning others may legitimately copy them elsewhere. Publishing is public in the real sense; treat it that way.

We keep your data while your account exists. Delete a lesson and it goes, along with its files and versions. Delete your account and we remove your account record and your content.

Two honest caveats: routine encrypted backups age out on their own cycle rather than instantly, and copies of a public lesson that someone already downloaded or adapted under CC BY-SA are out in the world — we can't recall those. Deleting a lesson removes it from Kuricula going forward.

• Edit or delete any lesson, comment, or Field Note whenever you like.
• Export everything you've made from your dashboard, any time, as a ZIP.
• Disconnect Google by revoking access in your Google account settings.
• Delete your account outright.
• Ask us for a copy of your data, or for its deletion, at {{CONTACT_EMAIL}}. Depending on where you live you may have a formal right to this; we'll honour the request either way.

Passwords are hashed with bcrypt, traffic is encrypted in transit, and access to production data is limited to the people running the service. No system is perfectly secure, and we won't pretend otherwise — but we don't collect what we don't need, which is the most reliable protection there is.

Kuricula is for teachers and other adult educators. It is not directed to children, and we don't knowingly collect information from anyone under 13. Please don't upload student names, student work, grades, photos of children, or anything else identifying a student — that's a condition of using the site, not just advice. If you believe a child's information has ended up here, tell us at {{CONTACT_EMAIL}} and we'll remove it.

Our providers operate in the United States and other countries, so your information may be processed outside where you live.

If we change this policy meaningfully, we'll say so in the app rather than quietly editing the page, and update the effective date at the top.

Privacy questions, data requests, or anything that looks wrong: {{CONTACT_EMAIL}}.