PSYSIMS · LEGAL & POLICIES
Privacy Policy
This policy explains what information PsySims processes, why it is used, which service providers support the platform, and how account and classroom data are handled.
Information we collect
PsySims may process Teacher or staff account information such as email address, display name, school or organization, country, authentication information, account status, subscription status, security events, and service usage. Classroom features may also process class names, minimal student identifiers chosen by educators, assignments, participation data, and results needed to provide those features.
How we use information
We use information to authenticate users, provide and secure the service, deliver lessons and activities, operate classroom and Student Portal features, enforce access levels, maintain account and subscription state, troubleshoot problems, prevent abuse, and understand service usage.
Authentication
Email/password authentication is currently supported. If Google or Microsoft sign-in is enabled and you choose to use it, the provider handles your provider credentials and may share basic account information needed to complete sign-in. PsySims does not require Google or Microsoft access merely to use email/password sign-in.
Infrastructure and service providers
PsySims currently uses Vercel to host and deliver the Next.js application, Supabase for authentication, database, RLS/RPC-backed application data, and account metadata, and Cloudflare including R2 for storage and delivery of PsySims-managed uploaded files. Private files remain authorization-gated and may be delivered through short-lived signed URLs.
Payments and transactional email
When paid billing is enabled, Stripe may process payment details and return billing identifiers and subscription status to PsySims; PsySims does not need to store full payment-card details to use hosted payment processing. Resend is the planned transactional-email provider, but production sending is not enabled yet. If either provider is activated, this policy should continue to describe the live integration accurately.
Student information
Use only the information needed to identify students in your classroom. We recommend using a first name, initials, or a classroom identifier instead of a full legal name. Please follow your school’s privacy and student data policies. Students do not need personal PsySims accounts for classroom participation. Student Portal credentials and classroom records are used for educator-directed class participation and remain separate from ordinary Teacher account sign-in.
Analytics and technical data
PsySims uses first-party page-view analytics backed by Supabase and a same-origin anonymous visitor ID stored in the browser. That visitor ID is analytics-only and is not an account identity or authorization credential. Vercel may separately process infrastructure request metrics and logs needed to host and operate the application. PsySims does not currently use advertising or cross-site behavioral tracking as part of this analytics flow.
User-requested account deletion
When a Teacher requests account deletion, normal Teacher access is paused immediately and the account enters a 30-day recovery period. The request may be canceled during that period. After the deadline, the daily lifecycle processor permanently deletes the account and account-owned classroom data, except for records that must be retained under a separate legal, accounting, fraud-prevention, security, or Class Code non-reuse policy.
Inactive Free accounts
A non-staff Free Teacher account that has not signed in for 24 months may be queued for an inactivity warning. Deletion may occur only after a real warning email has been successfully sent and a further 30-day notice period has elapsed without another successful sign-in. Until production warning email is enabled and successfully sent, inactivity-based deletion does not begin its deletion countdown.
Retention after deletion
Completed account deletions may create an anonymous operational audit event that does not retain the deleted user’s email, name, user ID, classes, students, lesson history, or subscription history; those anonymous events are retained for 90 days. Retired Class Code values may be retained permanently solely to prevent code reuse. Other records may be retained only where a separate legal, tax, accounting, fraud-prevention, security, or integrity obligation requires it.
Your choices and privacy requests
You may update available profile information through your account and may use the account-deletion flow when eligible. Depending on applicable law, you may also have rights relating to access, correction, deletion, restriction, or portability of personal information. Requests or privacy questions can be sent through the PsySims Contact page.
Security
PsySims uses application authorization rules, Supabase RLS/RPC controls, server-only secrets, staff MFA requirements where configured, and private-file authorization boundaries to protect the service. No online service can promise absolute security, and users should protect their own sign-in methods and Student Portal credentials.
Policy changes
This policy may be updated as PsySims features, providers, or legal obligations change. Material updates should be reflected here with a revised Last updated date.