Privacy Policy

Decademy ("Decademy," "we," "us," or "our") operates the website and related services at https://decademy.app (the "Service"). Decademy is an independent educational practice platform for high school business competition prep. We are not affiliated with, endorsed by, or sponsored by DECA Inc. or any DECA chartered association.

Questions about this policy or your data can be sent through our Contact form. Please use the topic that best matches your request (for example, account or privacy).

This policy covers information we collect when you visit the site, create an account, sign in with Google or email and password, take practice tests, use flashcards, complete AI roleplays, join or manage classrooms, appear on the leaderboard, visit events tools, or contact us.

It does not cover third-party websites we link to, such as Instagram, LinkedIn, or DECA's own sites. Those services have their own policies.

Account and identity. If you create an account we collect your email address, a display name you provide or that we derive from your email or Google profile, a username, and optionally a profile photo URL from Google. We store an authentication identifier from our auth provider so we can keep you signed in.

Authentication data. Sign-in is handled by Supabase Auth. If you use Google, Google shares the account information you authorize (typically name, email, and profile photo). If you use email and password, we store a hashed password and send confirmation or reset emails to the address you provide. We do not see your Google password.

Practice and progress data. When you are signed in we may store cluster-exam and practice results, questions attempted, correct answers, events practiced, daily and monthly stats, streaks, last activity date, bookmarks, daily goals, and similar learning metrics so your dashboard and history work across devices.

Roleplay and media data. If you use AI roleplays we may collect the scenario you practice, your typed responses, audio or video you choose to record through your microphone or camera, transcripts of those recordings, AI-generated scores and feedback, and related session metadata. Camera and microphone access is optional and only used after you grant browser permission for that session.

Classroom data. If you create or join a classroom we collect classroom name and settings, school name if entered, join codes and invite tokens, membership role and status, roster display names, assignment prompts and files, student submissions (including pasted text or uploaded PDFs), scores, feedback, calendar or event notes, and analytics visible to classroom admins.

Written events and uploads. Some tools let you paste or upload written entries or assignment files for review or AI feedback. Those files and the text inside them are stored so you and, where applicable, your teacher can review them.

Contact and support. If you use the contact form we receive the name, email, topic, and message you submit so we can reply.

Device and usage data. We automatically collect technical information such as browser type, general device information, pages viewed, referring URL, and approximate usage timestamps. We use cookies, local storage, and similar technologies for sign-in sessions, theme preference, in-progress drafts, and feature announcements you have already seen.

Analytics. We use Google Analytics and Umami to understand how the Service is used in aggregate (for example, which pages are visited). These tools may set cookies or use a website identifier.

• Provide, operate, and improve practice tests, flashcards, roleplays, classrooms, leaderboards, and related features.
• Create and secure your account, keep you signed in, and send confirmation or password-reset emails.
• Score, transcribe, and give feedback on roleplays and written work using automated systems, including third-party AI models.
• Let teachers and advisors run classrooms, see roster and assignment activity, and review student work they are authorized to access.
• Show optional public leaderboard rankings if you opt in.
• Respond to support requests and investigate abuse, security issues, or violations of our Terms.
• Understand product usage and fix bugs.
• Comply with law and enforce our policies.

We do not sell your personal information, and we do not use student education records to advertise to students.

If you are in the European Economic Area or United Kingdom, we process personal data where it is necessary to perform the contract when you use the Service, where we have a legitimate interest in operating and securing the Service, where we have your consent (for example, optional analytics cookies or optional media recording), or where we must comply with a legal obligation. You may withdraw consent at any time without affecting processing that already occurred.

We share information only as needed to run the Service:

• Service providers that host and process data on our behalf, including Supabase (authentication, database, and file storage), Vercel (hosting), OpenAI and Google Gemini (AI generation, scoring, and transcription), Google (sign-in and Google Analytics), Umami (privacy-oriented analytics), and FormSubmit (contact-form delivery).
• Classroom members and admins, when you join a classroom: teachers and other authorized members can see names, roles, assignment work, and scores associated with that classroom.
• The public leaderboard, only if you opt in, using your username and performance stats.
• Authorities or other parties if required by law, or if we believe disclosure is necessary to protect users, the Service, or the public.
• A successor if Decademy is involved in a merger, acquisition, or transfer of assets, subject to this policy or notice of changes.

Third-party processors have their own terms. AI providers may process the text, audio, or files you submit in order to return a result. Do not upload highly sensitive personal information (Social Security numbers, medical records, payment card numbers) into roleplays, assignments, or contact messages.

Decademy is a consumer and classroom practice tool. We are not a school and we are not your school's official student information system. If a teacher, advisor, or school uses classrooms, they are responsible for having authority to invite students, share roster names, and collect assignment work under applicable education-privacy rules (including FERPA in the United States, where it applies).

Students should only join classrooms they recognize. Teachers should not upload extra student data that is not needed for practice (for example, official student IDs, grades from other systems, or home addresses).

The Service is intended for high school students and their advisors. You must be at least 13 years old to use Decademy in the United States and other non-EU regions, and at least 16 years old if you are in the European Union, unless a parent, guardian, or school has validly consented where the law requires it.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us through the Contact form and we will delete the account and associated data.

We use the following categories of storage on your device:

• Essential: sign-in session tokens, security flags, and settings required for the Service to function.
• Preferences: theme (dark/light) and similar display choices.
• Functional: in-progress test questions, drafts, daily goals, and “already seen” notices so the product does not reset every visit.
• Analytics: Google Analytics and Umami, which help us understand traffic. You can block analytics cookies in your browser; some features may still work.

You can clear cookies and local storage in your browser. Signing out ends your authenticated session on that device.

We keep account, progress, classroom, and roleplay data for as long as your account is active and as needed to provide the Service. Contact-form messages are kept long enough to respond. Analytics data is kept in aggregate according to those providers' settings. If you delete your account or request deletion, we will delete or de-identify personal data unless we must retain a limited copy for security, dispute resolution, or legal compliance.

We use industry-standard measures including encrypted transport (HTTPS), access-controlled databases, and hashed passwords for email accounts. No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for using a school-appropriate email you control.

We are based in the United States. If you use the Service from another country, your information may be processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws than your home country.

• Access and update profile information from your account pages where those controls exist.
• Opt in or out of the public leaderboard.
• Choose not to record audio or video during roleplays.
• Leave a classroom or ask a classroom admin to remove you.
• Request a copy, correction, or deletion of personal data by contacting us.
• If you are in the EEA, UK, or a similar jurisdiction, you may also have the right to object to or restrict certain processing, and to lodge a complaint with your local supervisory authority.

California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and to opt out of “sale” or “sharing” for cross-context advertising. We do not sell personal information. To exercise a request, use the Contact form. We will not discriminate against you for exercising these rights.

Some browsers send a Do Not Track signal. The Service does not currently respond to DNT signals in a uniform way. You can limit analytics through browser settings or extensions.

We may update this policy as the Service changes. The effective date at the top will change when we do. If a change is material, we will provide additional notice on the site when practical. Continued use after the updated policy is posted means you accept the revised policy.

Privacy requests, including access and deletion, should be submitted through decademy.app/contact. You may also review our Terms of Service.