No ads, ever.
The game shows no ads and runs no ad tracking. Nothing a student touches carries a marketing pixel, and there is no targeted advertising anywhere.
Student data is not loot.
Infinilearn is played by thousands of kids, so the bar is simple: guard every player like they were ours. Here is how we do it, in plain English.
No ads. No selling data. No open chat. No student emails.
The short version · The rest of this page is the proofFour things that will never change.
We never sell student data.
Not to brokers, not to partners, not anonymized, not ever. Our revenue is memberships, so families are the customer, never the product.
Students never give us an email.
Kids sign in with a username and a six-digit PIN. Even our Google sign-in option only proves identity; the email behind it is never stored.
No open chat.
Players talk through preset phrases and emotes only. Parents and teachers can switch multiplayer off entirely, and it applies within a minute.
Locked down by default.
- Student data is encrypted in transit and at rest
- Deny-by-default access rules: nothing is readable unless a rule explicitly allows it
- Automated tests prove the denies as well as the allows before any rules change ships
- Sensitive changes like roles and subscriptions happen only on our servers, never from a browser
- Continuous backups with point-in-time recovery, and we have run real restores
- Built on Google Cloud and Vercel, infrastructure holding SOC 2 and ISO 27001 certifications
- Enforced email authentication: SPF, DKIM, and DMARC set to reject
Aligned with NIST CSF 2.0.
The NIST Cybersecurity Framework is what we name on district data sharing agreements. Here is what each function looks like in practice, and we are happy to walk your team through the full mapping.
Govern
Security has one accountable owner, written policies, and a signed data sharing agreement with every school that asks for one.
Identify
We keep a full inventory of what student data exists, where it lives, and who can reach it. Our DSA data schedules are filled out from that inventory, not from memory.
Protect
Encryption everywhere, deny-by-default access rules, least privilege, and server-only writes for anything sensitive.
Detect
Production errors and anomalies are exported and reviewed every day, not once a quarter.
Respond
Reported issues get triaged, fixed, and written up with a root cause. Every security finding ever reported to us has been resolved.
Recover
Continuous backups, point-in-time restore, and Git-driven deploys that can roll back in minutes.
Our Data Security and Privacy Plan.
This section is the written data security and privacy plan that district agreements, including New York Education Law 2-d, ask providers to publish. It applies to all student data a school provides to Infinilearn, and a district's signed agreement always takes precedence over our standard terms.
Legal compliance. We comply with FERPA, COPPA, and applicable state student privacy laws, and with each district's signed data privacy agreement, including its Parents Bill of Rights for Data Privacy and Security where state law provides one.
Safeguards. The protections on this page are the plan: encryption in transit (TLS) and at rest (AES-256 on Google Cloud), deny-by-default access rules proven by automated tests, least privilege, server-only writes for sensitive fields, and continuous backups with point-in-time recovery.
Who can touch student data. Production access is limited to the founder. Any future employee or contractor receives least-privilege access only after completing privacy and security training, and everyone with access is bound by confidentiality obligations.
Subprocessors. We use a short list of infrastructure providers: Google Cloud (Firebase) for database and authentication, Vercel for hosting, and Resend for email delivery. Each is bound by written terms to protect student data at least as strictly as our agreements require, and none may use it for its own purposes. The current list is always published in our privacy policy.
Incidents. We maintain a written incident response process: contain, investigate, fix, and document the root cause. If an incident compromises student data, we notify affected districts promptly, no later than 72 hours after confirmation, or faster where an agreement or state law requires, and we cooperate fully with the district and authorities.
Return, deletion, and destruction. A district can request its student data back in a readable format (such as CSV), or request deletion, at any time. We honor deletion requests within the timeline of the governing agreement, delete remaining district data when an agreement ends after notice, and confirm destruction in writing.
We invite people to try to break in.
Independent security researchers have tested Infinilearn from the outside, and we run recurring audits of our own code from the inside. Every real finding, from either direction, has been fixed. Not filed in a backlog. Fixed.
Our access rules ship with automated test suites that run against a real database emulator: over a hundred cases proving that the right people get in and, just as deliberately, that everyone else stays out.
Classrooms are why we exist, so the legal side is built in, not bolted on. Students can play without ever providing contact information, which is how we approach COPPA. When schools use Infinilearn, they own their students' records and we act as a school official under FERPA, bound by the data sharing agreements we sign. When a school or parent asks us to delete data, we delete it and confirm in writing.
Found a vulnerability? Email adrian@infinilearn.com. Reports go straight to the person who can fix them, usually the same day.
