Privacy Policy — Word Assessor

Word Assessor is a reading-assessment tool for teachers, published by Claw Works LLC (“Claw Works”), which is the controller of the personal information described here. This policy explains what the app collects, why, and how to get it deleted. It applies to the Word Assessor mobile app and to wordassessor.clawworks.com.

The short version

Word Assessor stores the teaching data you enter — your student list, your word lists, and assessment results — so it is there when you come back. It contains no advertising, no analytics, no tracking, and no third-party SDKs that collect data. Nothing is sold, and nothing is shared with anyone for marketing.

What we collect

Everything below is collected for one purpose only: to make the app work for you — to sign you in, and to store and show back the teaching records you enter. None of it is used for advertising, marketing, profiling, or analytics.

Account information. If you create an account, we store your email address and an encrypted password. Why: to create your account, sign you in, sync your data between your devices, and send you password-reset email. If you use the app as a guest, no email is collected — only an anonymous account identifier.

Teaching data you enter. This is the substance of the app:

Group names
Student names, as you type them
Units, word lists, and the individual words in them
Assessment records: which words a student read or spelled, whether each was known, and when

Why: to store your groups, word lists, and assessment history so they are there when you come back, and to generate your reports. This data is never used for any other purpose.

We do not collect audio. The app never records, uploads, or stores a student’s voice. An assessment is you marking each word as known or not known — the microphone is never used, and the app requests no microphone permission.

Technical data. A session token is stored on your device to keep you signed in, along with your display preferences. The app itself collects no device identifiers, advertising identifiers, location, contacts, photos, or usage analytics. Our hosting provider records IP address and browser or app user-agent in its security logs for sign-in requests, as any authentication service does. Why: to keep you signed in, remember your display preferences, and detect and prevent abuse of the sign-in system. Those logs are used to operate and secure the service and for nothing else, and they are retained for no more than 90 days.

About student names

Word Assessor is used by teachers, and the student names in it are entered by the teacher, not by the students themselves. We treat those names as sensitive:

They are visible only to the account that created them, enforced at the database level.
They are never used for advertising, profiling, or any purpose besides showing you your own assessment records.
They are never sold or shared with third parties.
Deleting your account deletes them, permanently.

You are free to use initials, first names only, or any other identifier you prefer. The app does not require full names, and if your school has a policy on identifying student data, follow it — you decide what to type in.

If you are a school or district administrator and need a data-processing agreement, contact us at the address below.

How the data is stored

Data is stored in a Postgres database hosted by Supabase, on servers in the United States. Supabase is our sole infrastructure provider and the only third party that receives any of this data.

If you are in Canada or Australia, your data is stored and processed in the United States. We want you to know that plainly before you sign up. While it is there it is subject to US law, which means US courts, law enforcement, and government authorities may in some circumstances be able to compel access to it. We hold Supabase to the standard set out in this policy by written agreement, but no contract can override a lawful order in the country where data is held. If your school or employer requires that student information stay inside your own country, this app is not the right tool for that requirement, and you should not enter student information into it.

Supabase processes data solely on our behalf, on our documented instructions, and does not use it for its own purposes. Supabase is contractually bound to protect this data to the same standard set out in this policy, under a written data-processing agreement that requires confidentiality, appropriate security measures, and deletion or return of the data when our agreement ends. We do not share personal information with any other third party — no analytics provider, no advertising network, no data broker.

Traffic between the app and the database is encrypted in transit with TLS, and data is encrypted at rest. Access is restricted by row-level security so that each account can reach only its own rows; that boundary is enforced by the database itself, not by app code. Access to production systems is limited to personnel who need it and protected by multi-factor authentication.

Reports you export

The app can turn a report into a PDF and hand it to your device’s share sheet, so you can save it, print it, or send it on. Those PDFs contain student names, and once you share one it goes wherever you send it — that destination is outside our control and is not covered by this policy. Nothing is exported unless you ask for it.

What we do not do

No advertising, and no advertising identifiers
No analytics or crash-reporting SDKs
No tracking across other apps or websites
No sale or sharing of personal information
No use of your data to train machine-learning models

Deleting your data

In the app: Settings → About → Delete Account. This permanently erases your account and every group, student, word list, and assessment result attached to it. There is no undo and no recovery period.

Guest sessions: guest data is temporary, but it is deleted when you sign out. Signing out of a guest session erases the guest account and everything in it. If you simply delete the app without signing out, the guest account is left behind on our server — so sign out first, or email us and we will remove it.

By web: if you have already uninstalled the app, request deletion at https://wordassessor.clawworks.com/delete-account.

Deleted data is removed from the live database immediately. Encrypted infrastructure backups kept by our hosting provider expire on their normal rolling schedule, within 30 days; deleted data is never restored from them. We may retain minimal records where the law requires it. Everything else goes.

How long we keep data

Your account and teaching data — kept while your account is open, and erased as soon as you delete it. We do not impose a fixed lifetime on it; you decide when it goes.
Inactive accounts — if an account is not signed into for 24 months, we will email the account address and then delete the account and its data if there is no response within 30 days.
Guest accounts — deleted when you sign out. A guest account abandoned without signing out is deleted after 90 days of inactivity.
Backups — expire within 30 days, as described above.
Sign-in security logs — 90 days.

Your rights

Whoever and wherever you are, you can:

See your data — all of it is visible in the app, under your own account.
Correct it — edit any group, student, word list, or result directly in the app.
Delete it — delete individual records in the app, or your whole account at Settings → About → Delete Account.
Export it — the app generates PDF reports; email us if you need your data in another format and we will provide it.
Ask us a question or complain — email the address at the bottom of this page. We respond within 30 days.

We will never charge you for exercising these rights, and we will never degrade the app or refuse you service because you did.

For California residents: in the twelve months before the date of this policy we have not sold or shared personal information, and we have no plans to. We do not use or disclose sensitive personal information for any purpose other than providing the app. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. You may exercise your rights to know, delete, and correct through the app or by emailing us, and we will not discriminate against you for doing so.

For people in Canada: we handle personal information in line with PIPEDA and applicable provincial privacy law, including Quebec’s Law 25. You may ask us what personal information we hold about you, why we hold it, and to whom it has been disclosed, and you may ask us to correct it. Our privacy contact below is the person accountable for our compliance, and is where complaints go first — we answer within 30 days. If our answer does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial commissioner where one has jurisdiction. Note the cross-border section above: your data is stored in the United States.

For people in Australia: we handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988. You may request access to the personal information we hold about you and ask us to correct it; we respond within 30 days and do not charge for access. Under APP 8 we disclose that your personal information is stored by our provider in the United States. Complaints go to our privacy contact below first; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Children’s privacy

Word Assessor is designed for and directed to teachers, not to children. Children are not users of the app: they do not create accounts, do not sign in, and never interact with it directly. We do not knowingly allow any child to create an account, and if we learn that one has, we will delete it.

Teachers do, however, enter student names — and some of those students are under 13. We treat that information as children’s personal information, and we handle it this way:

We collect it only on the teacher’s and the school’s authority. Where a teacher enters information about a child, we rely on the school’s authorization to act on behalf of parents, and only for the school-authorized educational purpose of assessing and recording that child’s vocabulary progress. The teacher is responsible for confirming that their school or district permits the use of the app with student information. In the United States this is the basis recognised under COPPA for school-authorized collection from children under 13; in Canada and Australia we apply the same standard, treating a child’s information as sensitive and relying on the school’s authority together with parental consent where the school’s own rules or local law require it.
We use it for nothing else. It is never used for advertising, behavioural advertising, profiling, audience-building, or any commercial purpose, and it is never sold or shared.
We collect no more than is needed. The app does not require full names — a teacher is free to enter first names, initials, or a label of their own choosing — and we ask no other information about any child. There is no audio, no photo, no location, no contact detail, and no persistent identifier tied to any child.
We keep it no longer than needed. Student information is retained only while the teacher’s account is open, and is deleted with it, on the schedule in How long we keep data above. It is never retained for a secondary purpose.
We never condition a child’s participation on disclosing more than is reasonably necessary.

Parents and schools: a parent or school official may ask us to review, correct, or delete the information a teacher has entered about a particular child, and may refuse to permit its further collection. Email us at the address below and we will act within 30 days. Because the records sit inside a teacher’s account, we may direct you to the teacher or school in the first instance, and we will help them carry the request out.

The app is not submitted to Apple’s Kids Category or Google Play’s Designed for Families programme, because it is a professional tool for adults rather than an app for children to use.

Schools

United States. The records a teacher enters may be education records under FERPA. In that setting we act as a school official with a legitimate educational interest, performing a record-keeping function the school would otherwise perform itself. We use the data only to provide the app, we do not redisclose it, and we remain under the direct control of the school with respect to it.

Canada and Australia. Student records are governed by provincial, territorial, or state legislation rather than by a single national education-records statute, and many school authorities require that student information be held in-country or under an approved agreement before staff may use a tool at all. We take the same position everywhere: we process student information only on the school’s instructions, for the educational purpose the school has authorized, and we do not redisclose it. Read the cross-border section above before deciding whether this app fits your authority’s rules.

If your school or district requires a signed data-processing, student-data-privacy, or school-official agreement before staff may use the app, email us and we will provide and sign one.

Changes to this policy

If this policy changes materially, we will update the date at the top and note the change in the app’s release notes.

Contact

Questions, requests, complaints, or data-protection matters — including requests from parents and schools — go to our privacy contact:

Claw Works LLC
3275 S. Jordan Ln
Washington, UT 84780
wordassessor@clawworks.com

We answer within 30 days.