Privacy Policy

Last updated: 2026-10-19

The Ethics Lab ("The Ethics Lab," "we," "us") operates an educational platform for high-school students (grades 9–12), teachers, and schools. We are a nonprofit organization. This policy explains what we collect, why, how long we keep it, and your choices. Our service is intended for users 13 and older and is not directed to children under 13. We handle student data in line with the Family Educational Rights and Privacy Act (FERPA) and applicable state student-privacy laws.

Who this policy is for

Students (13+) who use the platform through their school or independently.
Parents and guardians of those students.
Teachers, school staff, and school administrators.
People on our waitlist or mailing list.
People who send us a request through a form on our site (for example, a teacher asking about running an AI Day).

Our role: controller vs. school official

How we handle your data depends on how you signed up:

Independent users (you sign up on your own, not through a school): we act as the data controller, and this Privacy Policy and our Terms govern.
District-managed users (a school or district provisions the account): we act as a processor and "school official" under FERPA, handling student data only on the school's instructions under a signed Data Privacy Agreement, which — together with our School & District Terms — controls for that data.

The short version

We collect what we need to run the service and to make it better for students.
We never sell personal information, and we never use it for advertising or to build advertising profiles.
We do not retain data indefinitely — see Data retention below.
Our AI tutor, Inky, is a coming-soon feature and is currently disabled for students. When we offer it, the AI providers that power it are contractually barred from training on identifiable student data (see The AI tutor).
Schools that use The Ethics Lab do so under a written agreement; for those students, the school directs how student records are handled and authorizes the educational use of the service.

Information we collect

Account information. Name (optional), email address, password (stored hashed by our authentication provider), role (student / teacher / admin), and — for district-managed users — the school or organization you belong to. Independent signups may tell us how they heard about us (optional) and, if they choose, their ZIP code — used only to match them with nearby partner businesses for reward coupons. ZIP code is optional, is never required to use the service, and can be removed anytime from your profile.

Student learning data. Lesson responses, assignment and quiz submissions, answers and work created during live classroom sessions, competition and activity entries, and progress and mastery records — the work students do across the platform. If and when the AI tutor is enabled for you, this also includes the messages you send to the tutor, any documents you upload to it, and safety flags raised during a session.

Requests you send us. If you fill out a form on our site, such as the AI Day teacher form, we collect what you enter (your name, email, school, and message) so we can reply. We use it only to answer you and help you plan, and we don't add you to a mailing list unless you ask.

Technical data. Our providers (authentication, hosting, email) automatically log information such as IP address and device/browser type for security and delivery. We use Vercel Web Analytics to count page visits. It sets no cookies and gives us only aggregate numbers (pages viewed, referring site, country, device type). On our public pages, and on the sign-up page, we also use Google Analytics to see which pages people find useful and which sign-up buttons work. It uses first-party cookies and records things like pages viewed, how you arrived (including from our free Google Ad Grants search listings), and whether you signed up for the newsletter or an account, never your name or email. We have turned off Google signals and ad personalization, so this data is not used to show you ads or to build an advertising profile. Google Analytics is switched off inside the signed-in learning app, so nothing about your lessons, progress, or dashboard is sent to it.

We do not knowingly collect: government identifiers, financial account numbers, precise geolocation, or biometric data.

The Discord community

Our Discord server is optional and separate from the learning platform. It is for users 13 and older, which is also Discord's own minimum age.

Joining the server does not create an The Ethics Lab account. Registering for the server collects only what is listed here. To use the lessons you sign up for a learning account separately, which asks for the same details every student gives (see Information we collect). If you use the same email, the two connect automatically.

What we collect when you register for the server: your email, your Discord user ID and username, your grade, your state, and, only if you give them, your first name and ZIP code. We use grade, state and ZIP only to report to funders which areas we reach, never shown publicly. Registering by email also signs you up for our weekly newsletter, which you can leave at any time.

"Continue with Discord." If you register or log in with Discord, Discord tells us your user ID, username, display name and profile picture (the "identify" permission). When you register this way we also ask for the "guilds.join" permission, which lets our bot add you to the server. The login token Discord gives us is used once for those two things and is never stored. We never see your Discord password or your messages elsewhere on Discord.

What we record about your time in the server:

When you joined or left the server, and which roles you have and when they changed. Roles are how parts of the server open up (for example, Verified unlocks the channels). Our bot checks this every 15 minutes.
Your reactions to the weekly question, which count as votes.
At a debate we host: which minutes you were in the voice room and not deafened, which attendance checks you answered, and how many messages of 20 characters or more you sent in that room's chat. We count messages; we do not copy or keep what they say. We do not record audio. From these we calculate your service hours.

Who can see it. You can see your own record on your hours dashboard. Debate results post in the server's hours-log channel with your Discord username, where other members can see them. Your personal hours link works for anyone you give it to, so a school can check your record; it shows your Discord username and hours, never your email. Ethics Labs staff can see the member list and activity log to run the server and confirm hours. The full name you type on the printable verification sheet stays in your browser and is never sent to us.

Discord itself. Messages you post in the server are stored by Discord under Discord's own Privacy Policy, and server moderators can read them like any member can.

Keeping and deleting it. We keep this record while you are a member so your hours can still be verified later. Email privacy@ethicslabs.ai and we will delete your registration, activity log and hours. After that we can no longer confirm your hours to a school.

How we use information

To provide lessons, assignments, grading, live sessions, and competitions.
To operate and improve the platform.
To keep students safe (when enabled, the tutor flags concerning content to the student's teacher).
To send transactional email (account verification, password reset, assignment and session notifications).
To send optional newsletters to people who have an account or joined our waitlist — you can unsubscribe at any time (see Your choices).
To secure the service and comply with law.

We never sell personal information and we never use it for targeted advertising.

The AI tutor (Inky) and third-party AI providers

Inky is a coming-soon feature that is currently turned off for students. When we make it available, it will send a student's messages (and any study material they choose to upload) to a third-party large-language-model provider solely to generate a tutoring reply. Those providers act as our processors under contract, are contractually barred from training on or otherwise reusing student data, and return only the tutor's response. Our model provider is Florida Atlantic University's high-performance computing service, a university-operated endpoint; we may also use OpenAI or Anthropic. We will not use identifiable student personal information to train any AI model; any use of learning data to improve Inky would be limited to de-identified or aggregated data, and we will update this policy before enabling the feature. The tutor is an AI, not a human, and is labeled as such in the product.

We share personal information only:

With the student's school (for district-managed users), which controls student education records.
With service providers (processors) who run parts of the service under contract, each bound to use the data only to provide the service to us.
When required by law, or to protect the safety of a student or others.

We do not sell data and we do not share it with advertisers or data brokers.

Our current service providers (subprocessors): Supabase (hosting, database, authentication; runs on AWS), Resend (transactional and newsletter email), Vercel (application hosting and cookie-free visit counts), Google (optional "Sign in with Google", and Google Analytics on our public pages), YouTube (embedded lesson videos), Discord (our optional community server and "Continue with Discord"), and Florida Atlantic University (AI inference for the tutor and for the research that goes into our public newsletter; the newsletter research sends no student data). The remaining AI providers for the coming-soon tutor — Anthropic and OpenAI — are not yet active and will be enabled only when Inky launches, barred by contract from training on our data. A maintained list is available in our Trust Center. We update this list as providers change.

Students 13+ and children's privacy

The Ethics Lab is intended for high-school students and other users 13 and older, and is not directed to children under 13. Independent self-signup requires a date of birth and blocks anyone under 13 before any account or personal information is created. For district-managed use, the school authorizes the educational collection and use of student personal information under FERPA and, where applicable, provides consent on parents' behalf for that educational purpose only. We use student personal information to provide the educational service — never for advertising and never sold.

Parents/guardians may review their child's personal information, ask us to delete it, and refuse further collection by contacting privacy@ethicslabs.ai (for district-managed students, we coordinate the request with the school).

Data retention and deletion

We do not keep personal information longer than reasonably necessary for the educational purpose it was collected for, and we do not retain it indefinitely. Our current schedule (proposed windows; see our Trust Center for the maintained schedule):

Active accounts: retained while the account is active; independent accounts inactive for 12 months may be deleted or anonymized.
AI tutor transcripts, uploaded documents, and safety flags (once the tutor is enabled): retained for a limited window, then deleted.
Learning records (assignments, grades): for district-managed users, retained per the school's instructions in our agreement, then deleted or returned; for independent users, per the schedule above.
On account or roster removal: we delete or return the associated personal information within a reasonable period.

Schools may request deletion or return of their students' records at any time.

Your choices

Email preferences. Every newsletter includes an unsubscribe link, and you can manage your email preferences in your account profile. Some transactional emails (password resets, verification) are required to operate your account and are not optional.
Access and deletion. You may request a copy of, or deletion of, your personal information by contacting privacy@ethicslabs.ai. For district-managed students, we route the request through the school.

Data security

We use industry-standard measures including encryption in transit, encryption at rest (inherited from our infrastructure providers), access controls, and row-level security in our database. No system is perfectly secure, but we work to protect your information and to notify affected users and schools of a breach without unreasonable delay and within the timeframes required by law and our district agreements.

Schools, FERPA, and state student-privacy laws

For district-managed students, The Ethics Lab acts as a "school official" with a legitimate educational interest under FERPA, under the direct control of the school with respect to student education records, and uses those records only to provide the service. We do not re-disclose student records except as the school directs or as law permits, and we delete or return them on request. We sign district data-privacy agreements — we use the SDPC National Data Privacy Agreement (NDPA) with the applicable state exhibit — and align our security practices with the standards those laws require.

Changes to this policy

If we make material changes we will update the date above, bump our policy version, and — for significant changes affecting students — notify schools and account holders.

Contact us

Privacy questions: privacy@ethicslabs.ai The Ethics Lab 280 NW Natura Ave, Deerfield Beach, FL 33441