Trust centre
Last checked October 14, 2026
How Gradelings keeps families, children and classes safe. Details are in our privacy policy.
Privacy
No ads, no data sales
Never, for anyone.
Minimal child data
First name, grade, avatar and practice only.
No free text, photos or voice
Children can’t share anything about themselves.
Export or delete anytime
From the Parent area, in a few taps.
Parental consent (COPPA)
US children sync only after a parent agrees.
Where data lives
Servers in Montréal, Canada; database in Virginia, US.
Accounts
Hashed passwords
Salted scrypt, never stored readable.
Secure sessions
Random tokens, hashed, in HTTPS-only cookies.
Sign-in rate limits
Repeated wrong passwords are slowed down.
Parent PIN
Keeps children out of the Parent area.
Family isolation
No family can see another’s children or progress.
Classroom limits
Teachers see only their own classes.
Payments
Stripe checkout
We never see or store card numbers.
Signed webhooks
Payment events are verified before we act.
No purchases by children
Coins are earned only by learning.
Infrastructure
HTTPS everywhere
With HSTS, so connections are always encrypted.
Security headers
No framing, no sniffing, camera and mic off.
No third-party scripts in the app
No ads or trackers for kids.
Strict script policy
Each page runs only the scripts it lists.
Scrubbed error reports
Names, emails and cookies removed first.
Uptime monitoring
Checked every 15 minutes, with alerts.
Email and AI
SPF, DKIM and DMARC
Spoofed mail from our domain is quarantined.
AI drafts, human replies
A person sends every reply; kids never talk to AI.
Operations
Locked-down admin access
Named, confirmed accounts only, every change logged.
No child data for staff
The admin panel never shows names or results.
Tested on every change
Thousands of tests plus a dependency audit.
Security review
October 2026; every high and medium issue fixed.
Report a security problem
Email hello@gradelings.com. A person replies within one business day. See also security.txt and our status page.