Effective date: October 25, 2026

This notice explains how McCoy collects, uses, shares, and deletes information about students who use McCoy through their school. It applies to every student in a school deployment, including students under 13, whose information is protected by the Children's Online Privacy Protection Act (COPPA). Our Privacy Policy covers everyone else. Where the two differ for students, this notice controls.

Who we are

McCoy Universe Inc. operates the McCoy learning platform and is the only operator that collects or maintains students' personal information through it.

• Address: 1048 Irvine Ave. 451, Newport Beach, CA 92660, United States

• Email: support@mccoy.org

• Phone: +1 (201) 308-3082

How schools consent for parents

Students use McCoy only through a school that has a written agreement with us. The school creates student accounts, chooses the courses, and sees its students' progress.

When a school directs its students' education and uses McCoy only for that purpose, COPPA allows the school to consent on parents' behalf. We rely on that consent before collecting any information from students under 13. Each school agrees to tell parents about McCoy and these practices.

We use student information only for the school's educational purposes, never for any commercial purpose of our own.

Information we collect and why

• Student email, name, and login identifiers. Provided by the school when it creates the account. Used for sign-in and account access.

• Courses and class or cohort assignments. Provided by the school. Used to give students their courses and teachers the right views.

• Answers, attempts, scores, progress, and completion. Created by the student while learning. Used for teaching, scoring, and progress reports for the school and families.

• IP address, device and browser type, and session activity. Collected automatically from the student's device. Used to run, fix, and secure the service.

We do not collect birthdates, home addresses, phone numbers, photos, audio, location, or health information from students. Students cannot post anything publicly. We collect only what students need to take part in their courses.

Who receives student information

The student's school. Authorized school staff see their own students' progress and work. Teachers see only the students assigned to them.

Our service providers. These companies run parts of McCoy for us, under written contracts that require them to protect the information and use it only to provide their service:

• Google Cloud: hosting, database, storage, and backups. Receives all of the information above.

• Google Firebase Authentication: sign-in. Receives email and login identifiers.

• Mailgun: sign-in and account emails. Receives email address.

• Sentry: error monitoring. Receives a scrambled account ID, never names or emails.

We share student information with no one else, except where the law requires it. If a court or government demands it, we tell the school first unless the law forbids us.

What we never do

• We never sell or rent student information.

• We never show students ads or use their information for advertising.

• We never build profiles of students for any purpose other than their learning.

• We never send student information to AI model providers, and never use it to train AI models.

Persistent identifiers. McCoy uses account IDs, session IDs, and necessary browser storage to keep students signed in, save their progress, keep the service secure, and diagnose errors. We use these identifiers only to run McCoy. We never use them to contact a student, track them across other sites, advertise to them, or build a profile.

How long we keep information

We keep student information only as long as the school uses McCoy for that student's learning. We never keep it indefinitely.

• Account, course, and learning records (for teaching and progress reports): deleted within 60 days after the school tells us the student has left, or sooner on request, and within 30 days after the school's agreement ends.

• Export files made for a request (to give the school or a parent a copy): deleted 7 days after they are made.

• Application and request logs (to run and secure the service): deleted after 30 days.

• Backups (to recover from outages): deleted information leaves backups within 30 days.

• Error reports (to fix errors): deleted after 30 days.

When we delete information, it is removed from our active systems. It is never restored from a backup into use.

Parent rights

A parent or guardian can ask at any time to:

• review the personal information we hold about their child;

• delete it; or

• stop any further collection or use of it.

To make a request, email support@mccoy.org with the school's name and your child's name, or contact your child's school. To protect your child, we confirm with the school that you are the parent or guardian before acting. We respond within 10 business days of confirming.

If you ask us to stop collecting information or to delete it, your child can no longer use McCoy through that account. Copies the school or a parent has already downloaded are theirs to manage.

Security

We keep a written information security program. Student information is encrypted in transit and at rest, and only McCoy staff who need it to run or support the service can access it. If student information is ever accessed without authorization, we notify the school within 72 hours and help it notify families.

Changes to this notice

We will tell schools before we make a material change to how we collect, use, or share student information. Where COPPA requires it, we get new consent before the change takes effect. The effective date above shows when this notice last changed.