Privacy Policy

Rectangle, LLC ("Rectangle," "we," "us," or "our") operates the Rectangle learning platform at app.rectangle.education and related websites and services (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have.

Rectangle is built for K‑12 classrooms. Because we work with schools and with students — including children — we hold ourselves to a high standard: we collect only what the Service needs, we never sell personal information, we never use student information for advertising, and we never use student information to train artificial-intelligence models. The sections below say exactly what that means in practice.

1. How Rectangle works with schools

Rectangle is a service provider / "school official" to the schools and districts whose teachers and students use the Service. In plain terms:

• Teachers and schools bring students onto the platform. A student can only get an account through a school-mediated path: a valid class code issued by a teacher (which creates a pending enrollment the teacher must approve) or a roster import performed by a teacher. There is no open, public student sign-up.
• For student information, the school is the party that decides. The school or district manages school-directed notices and authorizations for student use, and we process student information on the school's behalf and under its authorization (see Section 9, Children's Privacy).
• A written framework governs student data. For teacher-directed classroom use, Rectangle's Student Data Terms apply to our handling of student information unless the teacher's school or district has entered into a separate Data Processing Agreement or equivalent student-data-privacy agreement with Rectangle. For school or district accounts, Rectangle enters into a Data Processing Agreement or equivalent agreement with the school or district, and that agreement governs our handling of that school's or district's student data. In all cases, we treat student personal information consistent with the U.S. Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student-privacy laws.

2. Information we collect

2.1 Account and profile information

When an account is created, we collect:

• Required: name, email address, and (for password accounts) a password, which we store only as a secure one-way hash.
• Role: whether the account is a teacher or a student.
• Optional profile details a user chooses to add: school name, grade level, subjects taught, time zone, a short bio, avatar image, and location.

If a user signs in with Google (single sign-on), we receive that user's name, email address, and — for Google Workspace for Education accounts — the associated school domain. We do not receive a Google password.

We do not collect date of birth or age. Because student accounts are school-mediated (Section 1), we rely on the school rather than an age check.

2.2 Information from class rostering

When a teacher imports a class roster from Google Classroom, we receive, for each student in that class, the student's name, email address, and Google Classroom profile identifier. The teacher chooses the grade level in our import wizard; we do not receive it from Google. Students without an email address are skipped, not created.

We do not collect special-education, accommodation, disability, health, or IEP/504 status, and we do not collect demographic categories such as race or ethnicity.

2.3 Student work and classroom activity

To provide the core learning experience, we store the content students and teachers create in the Service:

• Submissions and deliverables — text, links, and uploaded files students submit for their assignments.
• Reflections, checklists, and action items students write.
• Discussion posts and comments within a class or project group.
• Grades, rubric scores, feedback, and standards/mastery records teachers create when reviewing student work.
• Teacher-authored content — projects, milestones, rubrics, and drafts.
• Observation notes a teacher records about a student (visible only to teachers, never shown to the student).

2.4 Technical and usage information

• Authentication and session data — a secure, signed session token stored in a first-party, http-only cookie. This token contains no personal information (only an internal user identifier, role, and permissions).
• Product usage events — a first-party record of certain teacher/admin actions in the product (for example, saving or comparing projects) and search queries, used to operate and improve the Service. These stay on Rectangle's own systems and are not shared with any third-party analytics vendor.
• Server and audit logs — standard operational logs, plus audit records of sensitive actions (such as roster imports and grade exports) used for security and to support the school's record-keeping.

We do not use any third-party analytics, advertising, or session-replay technology in the application. See Section 11 (Cookies and tracking) for details.

2.5 Communications

If you contact us for support, or sign up for our newsletter or product-update emails, we collect the information in those communications (such as your email address and message).

3. How we use information

We use the information above to:

• Provide and operate the Service — create and manage accounts and classes, let students submit work and teachers grade it, and deliver feedback, reporting, and standards coverage.
• Authenticate users and secure the Service — verify sign-ins, prevent abuse and unauthorized access, and maintain the integrity of school records.
• Communicate with you — send transactional messages required to run the Service (for example, class-code magic-link sign-in emails, password resets, co-teacher invitations, and teacher check-ins), and, for those who opt in, periodic newsletters and product updates (see Section 8 for how to opt out).
• Improve the Service — understand how features are used, using our own first-party data, so we can fix problems and build better tools.
• Comply with law — meet our legal obligations and respond to lawful requests.

We do not:

• sell personal information;
• use student personal information for targeted advertising or to build advertising or non-educational profiles;
• use student personal information to train artificial-intelligence models.

4. How information is shared

We share information only as described here.

4.1 With the student's school

Student information is made available to the teachers and school staff affiliated with that student's classes, so they can teach and assess the student's work. Access is strictly scoped: a teacher can see only the classes they own or co-teach, and a student can see another student's work only when the two are members of the same project group.

4.2 With service providers (subprocessors)

We use a small set of vendors to run the Service. They may process personal information only to provide services to us, under contract, and not for their own purposes. Our current subprocessors are:

All stored personal information is located in the United States. We will provide notice to schools and districts of material changes to this subprocessor list as provided in our Student Data Terms or the applicable Data Processing Agreement, so the school can review the change.

4.3 With AI assistants you choose to connect

Rectangle's core features never depend on AI and work fully without it.

Optional teacher AI connectors. Teachers may choose to connect their own account with a supported third-party AI provider, such as Anthropic or OpenAI, to help draft teacher-created project materials. These connectors are optional and are not required to use Rectangle. Rectangle does not send student personal information, student work, grades, feedback, discussions, rosters, observation notes, or student login information to AI providers. Teachers must not include student personal information in prompts or materials they choose to send through an AI connector. Information a teacher sends through an AI connector is handled by the applicable AI provider under that provider's own terms and privacy policy (Anthropic, OpenAI).

For each connection, the teacher grants access through an explicit, permission-by-permission consent screen and can disconnect at any time. The connector's access is limited — in our code, not just by policy — to the teacher's own draft project content and public education standards, and every action taken through the connection is logged for the teacher to review.

4.4 Legal and safety disclosures

We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith it is necessary to protect the rights, safety, or security of users, the public, or Rectangle.

4.5 Business transfers

If Rectangle is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will continue to protect personal information consistent with this Policy and applicable law, and we will provide notice to affected schools and districts as required by our Student Data Terms, any applicable Data Processing Agreement, and law. For information received from Google APIs, we will transfer that information in connection with a merger, acquisition, or sale of assets only with the user's explicit prior consent where required by the Google API Services User Data Policy.

4.6 Google user data and Limited Use

Rectangle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice, we use Google Workspace data — a teacher's Google Classroom courses and rosters, the email addresses of the people in those classes, and (only when a teacher explicitly initiates a grade export) coursework and grades — solely to provide and improve the user-facing roster-import and grade-passback features a teacher chooses to use. We do not use this data for advertising, do not sell or transfer it to third parties for their own purposes, do not allow humans to read it except with the user's consent, for security purposes, or as required by law, and do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Both teachers and students may sign in with a Google Account, but Rectangle does not require it: email-and-password sign-in and teacher-issued class-code sign-in are always available, so a user can access Rectangle without a Google Account. The Google Classroom connections described above (roster import and grade passback) are available only to teachers and school staff; students never connect a Google Classroom account or grant Rectangle access to Google Classroom data.

5. Data storage, security, and location

Location. All personal information is stored and processed in the United States (database on Neon in AWS us-east-2, Ohio; application hosting on Render in Ohio; uploaded files in a private Cloudflare R2 bucket in the United States).

Security measures we use include:

• Encryption in transit using TLS (HTTPS), enforced with HSTS.
• Encryption at rest provided by our database and file-storage infrastructure.
• Additional application-level encryption (AES‑256‑GCM) of third-party OAuth tokens, which are decrypted only at the moment of use and never sent to browsers.
• Passwords stored only as secure one-way hashes (bcrypt); sign-in and password-reset tokens stored only as hashes.
• Strict, affiliation-scoped access controls enforced on our servers, so users can reach only the data their role and class affiliations permit.
• Private file storage — uploaded files are never publicly reachable and are served only through permission-checked routes; uploads are checked to confirm they are the file type they claim to be.
• Cross-site request forgery protection and server-side sanitization of user-generated content to guard against common web attacks.
• Audit logging of sensitive actions and rate limiting to deter abuse.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security; however, we work to protect personal information using measures appropriate to its sensitivity.

If there is a security incident. If we confirm a security incident involving student personal information, we will notify the affected school or district without undue delay, and in any event within 72 hours after confirmation, unless a shorter period is required by applicable law or law enforcement directs otherwise. Our notice will describe what we know about the incident and the steps we are taking.

6. Data retention and deletion

We keep personal information only as long as needed for the purposes described in this Policy, and — for student information — as directed by the school or district that controls the records. If your account becomes inactive, we keep it for a limited period so you can return to your work, as described below. Personal information about children is not retained indefinitely. The table below states how long we keep each category and when it is deleted.

Students removed from a roster. When a student is removed from a class (for example, when a school roster changes), we deactivate the enrollment rather than erase it, so the school keeps the student's historical grades and work as part of its record. A deactivated student can no longer submit new work in that class but can still access their other classes.

Keeping your work for reactivation. If you stop using Rectangle without asking us to delete your account, we keep your account and the content you created for up to 18 months so that, if you return, your work is still there. After that period of inactivity, we delete or anonymize the account.

Deleting your account.

• Teacher accounts can be deleted from account settings. When you delete, because a teacher's activity is woven into other people's records, we promptly remove your personal details and credentials and make the account unusable (anonymizing it), while preserving the grades, feedback, and reviews other students' records depend on (now attributed to a "removed" placeholder). We never destroy another user's academic records as part of an account deletion.
• Student accounts are not deleted through self-service, because the school controls student educational records. Deletion of a student account or its data is handled through the student's school (see Section 8).

To request deletion or anonymization of information, contact us at peter@rectangle.education (for student information, we will coordinate with the school). Some information may be retained where required by law or for legitimate record-keeping, security, or dispute-resolution purposes.

7. AI and automated decision-making

Rectangle's core educational features — including its standards-coverage and recommendation tools — are built to work without any AI service, and do not depend on one. We do not use AI to make automated decisions that produce legal or similarly significant effects about students, and we do not use student information to train AI models. The only AI involvement in the Service is the optional, teacher-initiated authoring connectors described in Section 4.3.

8. Your rights and choices

Your rights depend on your relationship to Rectangle:

• Students. Rights in student educational records are exercised through the school under FERPA, COPPA school authorization, and applicable state student-privacy laws. Parents and eligible students should contact the school, which can then work with us to access, correct, export, or delete records.
• Teachers and school staff (adult users). You can view and update your profile in the Service. Depending on your state of residence, you may also have rights under state consumer-privacy laws to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing, where those laws' thresholds apply. Contact us to exercise these rights.
• Email preferences. Transactional messages are necessary to operate the Service. Newsletter and product-update emails are optional — you can unsubscribe at any time using the link in those emails or by contacting us.

Rectangle is intended for school-directed use, and we do not knowingly collect personal information from children outside the school-authorized model described in this Policy. To exercise any right, email peter@rectangle.education or call (503) 741‑9692; for student records, contact the school first.

9. Children's privacy (COPPA)

Rectangle is designed for classroom use under the direction of a school. We do not permit children to sign up on their own: student accounts are created only through a teacher's class code or a school roster import (Section 1).

For students under 13, Rectangle relies on school authorization for school-directed educational use, and Rectangle remains responsible for its obligations as an operator under the Children's Online Privacy Protection Act (COPPA). We limit our use of children's information to providing the Service to the school; we do not use it for advertising or to build non-educational profiles, and we do not retain it indefinitely (see Section 6). We do not knowingly collect personal information directly from a child except through this school-mediated model.

If you believe a child has provided us information outside this model, or you are a parent with questions about your child's information, contact your child's school or reach us at peter@rectangle.education / (503) 741‑9692, and we will work with the school to address it.

10. Students and schools (FERPA and state law)

For student personal information, Rectangle acts as a service provider / "school official" performing a service the school would otherwise perform itself, under the school's direct control:

• We use student personal information only to provide the Service to the school.
• We do not sell student personal information, use it for targeted advertising, or use it to build non-educational profiles.
• Education records remain under the control of the school, which may access, correct, export, or direct deletion of them.
• For teacher-directed classroom use, Rectangle's Student Data Terms govern our handling of student information. For school or district accounts, a Data Processing Agreement or equivalent agreement with the school or district governs. Under both, we provide breach notification and return or delete student data on the school's request or on termination, as described in those terms.

11. Cookies and tracking

In the Rectangle application (app.rectangle.education), we use only first-party, essential cookies — primarily a secure session cookie that keeps you signed in, plus short-lived cookies used to complete sign-in flows securely. We do not use third-party advertising cookies, social-media pixels, or third-party analytics cookies. We store a small non-personal preference (such as light/dark theme) in your browser's local storage; it never leaves your device. The application's fonts are self-hosted, so using the app does not send requests to third-party font or content-delivery networks, and the application includes no third-party advertising, analytics, or session-replay technology.

On our public marketing and informational website (rectangle.education), we use a small number of third-party services to make the site work: Google Fonts to display our typography, and Cloudflare Turnstile to prevent automated spam on our sign-up forms. These do not track you across other websites or serve you ads. If you submit a form on that website, we collect the name, email, and role you provide so we can contact you about early access and product updates. We use Brevo to receive and manage those sign-ups and to send our newsletters and product-update emails; Brevo processes this information on our behalf and does not use it for its own purposes.

Because we do not track users across websites or services for advertising, there is no cross-site advertising behavior for a browser "Do Not Track" signal to limit.

12. International users

The Service is operated from, and stores all data in, the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Effective date" above and post the new version. If we make a material change, we will provide additional notice as appropriate (and, for changes affecting student data, provide notice to schools as required by our Student Data Terms or the applicable Data Processing Agreement).

14. Contact us