Data & security
Effective October 20, 2026 · Version 2026-10-20
This page is CodeBreeder LLC’s written data retention policy and information security program for Study Desk, as described in our Privacy Policy.
Data retention policy
We keep personal information only as long as it is needed to run Study Desk, then delete it. A scheduled job runs every day to remove expired data.
| Data | Where | Kept for | Then |
|---|---|---|---|
| Parent email and consent record | Our database (Cloudflare D1) | While the account is in use | Deleted right away when the parent deletes the account, or automatically 2 years after the last sign-in |
| Sign-in codes (hashed) and hashed network address | Our database | 10 minutes to use | Deleted by the daily job |
| Sessions (hashed) | Our database | Up to 180 days | Deleted on sign-out, account deletion, or expiry |
| Daily study helper counts | Our database | 35 days | Deleted by the daily job |
| Homework photos and text sent to the study helper | Passed through, not stored by us | Only while the request runs | Handled under the AI provider’s own terms |
| Speech audio for card words | Cloudflare cache and the tablet | Up to 1 year | Expires; contains no student details |
| Students, cards, progress, PIN | Only the family’s tablet | Until the parent removes the student, erases the tablet, or deletes the account | Erased from that tablet. We never hold a copy. |
Information security program
Responsibility
Frandy Slueue, for CodeBreeder LLC, is responsible for this program. It is reviewed at least once a year and whenever Study Desk changes how it handles data.
Collect less
- The server never receives students’ names, pictures, grades, schools, cards or progress.
- No passwords: parents sign in with a single-use emailed code.
- No ads, analytics trackers, or third-party scripts in the app.
Protect what we keep
- Sign-in codes and session tokens are stored only as keyed SHA-256 hashes, so a database leak would not let anyone sign in.
- Codes expire after 10 minutes, allow 5 tries, and are limited per email and per network address each hour.
- Session cookies are HttpOnly, Secure and SameSite=Strict, so page scripts and other sites cannot read or send them.
- All traffic uses HTTPS. The API only accepts requests from the Study Desk site itself.
- Secrets (signing key and provider keys) are stored as encrypted Cloudflare secrets, never in the code.
- Only the owner of the Cloudflare account can reach the database, and that account is protected with two-factor sign-in.
Service providers
We use Cloudflare (hosting, database, Workers AI), DeepSeek (study helper for parent text), and Resend (email). Each receives only what its job needs, as listed in the Privacy Policy. We review their security and privacy terms before use and at each yearly review.
Testing and updates
Every change runs automated tests, including checks that no student details are sent to the server. Dependencies are pinned to exact versions and updated on purpose.
If something goes wrong
If we learn of unauthorized access to personal information, we will stop it, find out what happened, tell affected parents by email without unreasonable delay, and notify authorities where the law requires. Report a security problem to frandyslueue@gmail.com.