Effective date: October 4, 2026
CenterStaged.io (“CenterStaged,” “we,” “us”) makes classroom learning games for teachers and schools. This policy explains what information we collect, why, how long we keep it, and who we share it with. It applies to all CenterStaged games and to the centerstaged.io website.
- Sections 1–12 apply to every game.
- Sections 13–15 explain what each game collects.
Questions or requests: info@centerstaged.io
Policies for All Games
1. Our commitments
- We never sell student or teacher information.
- We never use student information for advertising, targeted advertising, or marketing.
- We never build profiles of students for any purpose other than the classroom activity the teacher assigned.
- We never use student work or information to train artificial intelligence or machine learning models.
- We never contact students.
- Our games contain no ads, analytics, or tracking scripts.
- We collect only what each game needs to work.
2. How we use information
We use information only to:
- Run our games: let teachers sign in, create games, and see their students’ results, and let students join and play.
- Verify licenses.
- Keep our games secure: prevent unauthorized access, code guessing, and abuse.
- Maintain, fix, and improve our games.
- Respond to teacher and school requests.
- Meet legal obligations.
Student information is used only for the educational purpose the teacher and school set.
3. Who can see student information
- Only the teacher who created a game can see student names and results.
- Other students cannot see real names.
- Teachers cannot see other teachers’ classes, students, or results.
- CenterStaged staff access student information only when needed to provide support, fix a problem, keep the service secure, or respond to a school’s request.
4. Service providers we use
Each provider receives only what it needs to do its job and is bound by its own privacy and security terms. Each game’s section (13–15) lists which providers that game uses.
| Provider | What it does | Information it handles | |
|---|---|---|---|
| Hostinger | Hosts our games and the centerstaged.io website | All game traffic; server logs | |
| Supabase | Database and teacher sign-in service | Teacher accounts, student names and results, game data | |
| Teacher sign-in only | Teacher name, email, Google account ID. Students never sign in with Google. | ||
| Gumroad | Sells licenses and processes payments | Teacher purchase and payment information. Our games only check whether a license key is valid. No student information is sent to Gumroad. |
Our game data is stored in the United States.
We do not share student or teacher information with anyone else, except:
- when the school directs us to; or
- when required by law, such as a court order or subpoena. If that happens, we will notify the school first unless the law prohibits it.
5. Teacher sign-in, licenses, and technical information
- Google sign-in: teachers sign in with Google. We receive only your name, email address, and Google account ID (basic “openid, email, profile” access). We never receive or store your Google password, and we cannot see your Gmail, Drive, Classroom, contacts, or calendar.
- Licenses: we store your license key, its status (active, refunded, or cancelled), and the Google account it is linked to. We never receive or store payment card information.
- Session cookie: one necessary cookie keeps a teacher or student signed in to the current session. It expires after 8 hours or at sign-out and is not used for tracking.
- Security counters: to block code-guessing and abuse, we count failed attempts using a scrambled (hashed) version of the network address, not the address itself. These counters are deleted within 15 minutes.
- Server logs: our games’ logs record only the type of request, the feature used, whether it succeeded, and how long it took. They do not record names, emails, or keys. Our hosting provider’s standard server logs may record IP addresses for security and operations and keep them for a limited time.
6. How long we keep information
- Student information is deleted on the schedule listed in each game’s section, or sooner if the teacher deletes it.
- Teacher accounts, content, and license records are kept until the teacher deletes the account or asks us to delete it.
- Session cookies last 8 hours or until sign-out.
- Security counters are kept 15 minutes or less.
- Database backups kept by our providers are removed on the provider’s backup schedule. Deleted information is not restored to active use.
7. Access, correction, export, and deletion
- Teachers can download all of their data, including their students’ names and results, using “Export my data.” They can permanently delete their account and all related data using “Delete my account.”
- Schools can ask us to provide, correct, or delete any of their teachers’ or students’ information. We will complete the request within 10 days and confirm in writing.
- Parents and students can review, correct, or delete a student’s information through the student’s teacher or school. If a parent contacts us directly, we will refer the request to the school and help the school respond.
Send requests to info@centerstaged.io.
8. Schools, students, and children’s privacy
Our games are designed for use in elementary and secondary schools at the direction of a teacher.
- FERPA: when a school uses our games, we act as a “school official” under the school’s direct control. We use student information only to provide our games to that school and do not disclose it further.
- COPPA: students do not create accounts. For students under 13, we rely on the school’s authorization to collect the limited information described in this policy for classroom use only, as COPPA permits. Schools may ask us to review or delete a student’s information at any time.
- Virginia and other state laws: we follow the requirements for school service providers in Code of Virginia § 22.1-289.01 and similar student-privacy laws in other states. Schools and divisions may request a signed Student Data Privacy Agreement by emailing info@centerstaged.io. If a signed agreement conflicts with this policy, the agreement controls.
The school or division owns and controls its students’ information. Students and families own the work students create.
9. How we protect information
- All connections use HTTPS encryption (TLS 1.2 or higher).
- Stored data is encrypted by our database provider.
- Teachers sign in with Google, so we store no teacher passwords.
- Database access rules block public access.
- Every request is checked on our server, so teachers and students reach only their own information.
- Game codes are random, expire, and are protected against guessing.
- Administrative accounts use strong passwords and two-step verification.
- We keep a written information security program, review it at least once a year, test for vulnerabilities, and fix problems promptly.
10. If a data breach happens
If we learn that student or teacher information was accessed or disclosed without authorization, we will:
- Act immediately to stop further access.
- Notify affected schools and teachers as soon as we confirm the incident, including when it happened, what information was involved, and what we are doing about it.
- Work with schools on any notice to families.
We will not contact students or parents directly unless the school asks us to.
11. The centerstaged.io website
This section covers only the main centerstaged.io website, not the games.
- The website uses Google Analytics to understand how visitors use it. Google Analytics uses cookies and receives information about your visit. Learn more at How Google uses information from sites that use its services.
- If you use a contact or sign-up form, we receive the information you enter and use it only to respond to you or send what you requested.
- Our games do not use Google Analytics.
12. Changes to this policy and contact
If we make a material change to how we collect, use, or share information, we will:
- post a prominent notice on this page before the change takes effect; and
- email license holders.
We will not use previously collected student information in a materially different way without the required consent. The effective date at the top shows when this policy last changed.
If CenterStaged is ever sold or merged, any successor must follow this policy and our security program before it can access student information.
CenterStaged.io
Email: info@centerstaged.io
Game-Specific Information
13. WordMint
What teachers provide
- Google sign-in and a WordMint license, as described in Section 5.
- Classroom names, vocabulary words, definitions, sentences, word parts, section assignments, word lists, and game settings.
- An activity log of when a teacher creates, starts, ends, or deletes a game.
What students provide
- First name and last initial(s) (one to three letters), so teachers can see each student’s results and grade their work.
- The game code the student used to join.
- Assessment answers, which words were known or practiced, activity completion, scores, and the date and time of each activity.
WordMint does not ask students for their full last name, email address, phone number, birthdate, home address, photos, audio, video, or location. It never turns on a device’s camera, microphone, or location.
WordMint saves the light/dark theme choice and teachers’ vocabulary-section preferences in the user’s own browser.
How long it is kept
| Information | How long we keep it |
|---|---|
| Student names, answers, progress, and scores | Deleted automatically 30 days after the game ends or its code expires, or sooner if the teacher deletes it |
| Game codes | Stop working on the expiration date and time the teacher sets (up to 30 days) or when the teacher ends the game |
| Teacher activity log | 30 days |
Services WordMint uses
- Hostinger
- Supabase
- Google (teacher sign-in only)
- Gumroad (licenses)
WordMint’s pronunciation feature uses the browser’s built-in text-to-speech to read vocabulary words aloud. Some browsers use their maker’s online voice service for this, and only the vocabulary word is sent. No student information is included.
14. Jeopardyish
What teachers provide
- Google sign-in and a Jeopardyish license, as described in Section 5. From Google, Jeopardyish receives the teacher’s name, email address, profile picture link, and Google account ID.
- Question packs: the round, category, point value, question, and answer for each question.
- An activity log of when a teacher signs in or out, links or removes a license, adds or deletes questions, or exports their data.
What students provide
Nothing. Students never sign in and never type in a name or any other personal information. Team scores and wagers exist only on the open game screen and are gone when the page closes. Jeopardyish never turns on a device’s camera, microphone, or location.
How licenses are protected
The license key is stored encrypted. Each license is tied to one Google account using a one-way code made from that account’s ID, so a license cannot be moved to a different account. When a teacher deletes their account or switches keys, the encrypted key is deleted. Only the one-way codes and the word “inactive” are kept, with no name or email.
How long it is kept
| Information | How long we keep it |
|---|---|
| Teacher name, email, Google account ID, and sign-in record | Until the teacher deletes their account |
| Question packs | Until the teacher deletes them or deletes their account |
| Linked license | While the license is linked |
| Inactive license codes (no name or email) | Kept to prevent a license from moving to another account |
| Teacher activity log | 30 days |
| Sign-in event log (can include an IP address) | 30 days |
| Sign-in session | Expires after 8 hours; deleted within 6 hours after that |
| Data copied from the earlier version of Jeopardyish (old license codes, buyer email, activation date, and questions) | Moved to the owner’s account when they link their key, or deleted automatically 90 days after it was copied |
| Server logs (request type, page, and result only) | Hostinger’s log retention period |
Cookies
- __Host-jx_session: keeps a teacher signed in. Lasts up to 8 hours.
- __Host-jx_pkce: protects one Google sign-in. Lasts up to 10 minutes and is removed after sign-in.
Both are required for sign-in. Jeopardyish uses no advertising or tracking cookies and saves nothing else in the browser.
Deleting your account
Teachers can export their data or delete their account from the Jeopardyish dashboard. Deleting removes the teacher’s sign-in record, questions, activity log, sessions, and teacher record, and marks the license inactive.
Services Jeopardyish uses
- Hostinger
- Supabase
- Google (teacher sign-in only)
- Gumroad (licenses). The license key and product ID are sent to Gumroad when a teacher links a key and at each sign-in. If Gumroad can’t be reached, a license checked within the past 7 days still works.
15. StoryDrop
What teachers provide
- Google sign-in and a StoryDrop license, as described in Section 5. From Google, StoryDrop receives the teacher’s name, email address, profile picture link, and Google account ID.
- Game sessions: session name, genre, vocabulary list, number of groups and players, and when the game codes expire.
- Saved sessions, starter sentences, and custom topics.
- An activity log of when a teacher signs in or out, links or removes a license, creates, closes, or locks a session, removes a student, or exports their data.
What students provide
- First name or nickname (20 characters at most).
- The group code the student used to join.
- The story sentences they write, which vocabulary word each one uses, their votes, and their scores.
StoryDrop does not ask students for an email address, account, password, full name, birthdate, photos, audio, video, or location, and it does not store IP addresses. It never turns on a device’s camera, microphone, or location. Student writing is never sent to any AI service.
How licenses are protected
The license key is stored encrypted. Each license is tied to one Google account using a one-way code made from that account’s ID, so a license cannot be moved to a different account. When a teacher deletes their account or switches keys, the encrypted key is deleted. Only the one-way codes and the word “inactive” are kept, with no name or email.
How long it is kept
| Information | How long we keep it |
|---|---|
| Student names, sentences, votes, scores, and results reports | Deleted automatically 30 days after the session ends or its codes expire, whichever comes first, or sooner if the teacher closes the session, removes the student, or deletes the report |
| Game codes | Stop working on the expiration date and time the teacher sets (2 days by default, up to 30 days), or when the teacher closes or locks the session |
| Teacher name, email, Google account ID, and sign-in record | Until the teacher deletes their account |
| Saved sessions, starter sentences, and custom topics | Until the teacher deletes them or deletes their account |
| Linked license | While the license is linked |
| Inactive license codes (no name or email) | Kept to prevent a license from moving to another account |
| Teacher activity log | 30 days |
| Sign-in event log (can include an IP address) | 30 days |
| Teacher sign-in session | Expires after 8 hours; deleted within 6 hours after that |
| Data copied from the earlier version of StoryDrop (old license codes, buyer email, activation date, saved sessions, and starter sentences; no student data) | Moved to the owner’s account when they link their key, or deleted automatically 90 days after it was copied |
| Server logs (request type, page, and result only) | Hostinger’s log retention period |
Cookies and browser storage
- __Host-sd_session: keeps a teacher signed in. Lasts up to 8 hours.
- __Host-sd_pkce: protects one Google sign-in. Lasts up to 10 minutes and is removed after sign-in.
- __Host-sd_player: lets a student play in their own group and rejoin from the same browser. Lasts until the game codes expire.
All three are required for the game to work. StoryDrop also saves display preferences (light or dark theme, language, writing timer, and last screen) in the browser. These are never sent to us. StoryDrop uses no advertising or tracking cookies.
Deleting your account
Teachers can export their data or delete their account from StoryDrop’s Account page. Deleting removes the teacher’s sign-in record, game sessions with their students, stories, and reports, saved sessions, starter sentences, activity log, and teacher record, and marks the license inactive.
Services StoryDrop uses
- Hostinger
- Supabase
- Google (teacher sign-in only)
- Gumroad (licenses). The license key and product ID are sent to Gumroad when a teacher links a key and at each sign-in. If Gumroad can’t be reached, a license checked within the past 7 days still works.