Introduction
Gradeflows is an educational research project affiliated with Loyola Marymount University that provides automated code analysis and assessment capabilities for GitHub Classroom. This Privacy Policy explains how information is collected, used, disclosed, and safeguarded when you use the platform. Gradeflows operates with university and IRB approval for research activities.
Information Collected
Personal Information
- GitHub Account Information: Username, email address, avatar URL, and GitHub user ID when you authenticate via GitHub OAuth
- Educational Data: Assignment submissions, analysis results, assessment responses, and feedback
- Profile Information: Name, institutional affiliation (for instructors), and enrollment status (for students)
Usage and Session Data
- Assessment Sessions: Response drafts, submission timestamps, session duration, and completion status
- Anti-Cheating Monitoring: During assessments, the platform monitors browser events (focus loss, tab switches), fullscreen compliance, copy/paste activities, and device interactions. Students are notified before assessments begin that their browser activity will be logged for academic integrity purposes.
- Platform Activity: Page views, feature usage, error logs, and performance metrics
Technical Information
- Authentication Tokens: GitHub OAuth tokens (encrypted and securely stored)
- Cookies: Session authentication cookies and user preference settings
- Browser Data: User agent, browser type, and device information
How Information is Used
- Educational Services: Provide automated code analysis, assessment generation, and feedback
- Platform Operation: Authenticate users, sync with GitHub Classroom, and maintain service functionality
- Academic Integrity: Monitor assessment sessions to prevent cheating and ensure fair evaluation
- Communication: Send notifications about analysis results, assignments, and important platform updates
- Research (Optional): Conduct educational research with explicit consent (18+ users only)
- Service Improvement: Analyze usage patterns to enhance platform features and performance
Third-Party Services
The platform integrates with the following third-party services that may collect additional information:
- GitHub: Code repository access, user authentication, and classroom synchronization
- Google Gemini AI: Automated assessment generation and code analysis (processes content anonymously)
- Supabase: Database hosting, authentication services, and file storage
Each service operates under its own privacy policy. Users are encouraged to review their privacy practices.
Educational Data Protection
The platform operates in compliance with the Family Educational Rights and Privacy Act (FERPA) and other applicable educational privacy laws:
- Student educational records are kept confidential and secure
- Access is limited to authorized instructors and students only
- Educational data is not shared with unauthorized third parties
- Students have rights to access and request correction of their records
- Educational institutions handle any necessary parental consents for students under 18
Research Participation
Participation in educational research is optional and requires:
- Age verification (18 years or older)
- Explicit informed consent via IRB-approved consent form
- Right to withdraw at any time without penalty
- Separate consent from platform usage (you can use Gradeflows without participating in research)
Data Security
The platform implements security measures including:
- Encryption of data in transit and at rest
- Secure authentication via GitHub OAuth
- Row-level security policies in the database
- Security updates as needed
- Limited access controls for platform administrators
In the unlikely event of a data incident affecting your information, affected users will be notified through their instructors in accordance with applicable law.
Your Rights and Choices
Access and Control
- Request to view and download your personal data through your instructor
- Request correction of inaccurate information through your instructor
- Request account deletion through your instructor
- Opt out of research participation at any time
- Control cookie preferences through your browser settings
Data Retention
- Educational Data: Retained as needed for educational purposes and according to institutional requirements
- Research Data: Retained according to IRB protocols. When research studies conclude, identifying information is removed or anonymized from the data, as specified in consent forms
- Platform Analytics: Anonymized usage data may be retained for platform improvement
- Account Data: May be deleted upon account closure, subject to educational and legal requirements
Cookies and Tracking
The platform uses cookies for:
- Essential Cookies: Authentication and session management (required for platform operation)
- Preference Cookies: Remember your settings and preferences
You can manage cookie preferences through your browser settings.
Educational Use and Age Requirements
Educational Platform Use
- The platform is available to all students enrolled in participating courses
- Students access the platform through institutional authorization and enrollment
- The platform collects only data necessary for educational purposes in compliance with FERPA
- Educational institutions handle any necessary consents and authorizations for enrolled students
Research Participation (Optional)
- Research participation is limited to students 18 years or older
- Requires explicit informed consent through IRB-approved protocols
- Completely voluntary and not required for educational platform use
- Students under 18 have full access to educational features without research participation
Parental Rights and Student Privacy
- Parents/guardians of students under 18 may contact their educational institution regarding data collection practices
- The platform works within institutional frameworks to ensure appropriate privacy protections
- Educational records are protected under FERPA
Changes to This Policy
This Privacy Policy may be updated from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the platform after such changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy, please contact:
- Your course instructor for educational platform questions
- The IRB contact information provided in your research consent form for research-related inquiries