Privacy notice

SideKrew School (school.sidekrew.com) is a homework planner for students in Grades 7 to 12. It is run as a private pilot by SPAI AI INC (“SideKrew”, “we”), a company in Toronto, Ontario.

This notice covers SideKrew School only. SideKrew’s sports product at sidekrew.com is a separate service with its own privacy policy: sidekrew.com/privacy.

In this notice, “parent” means a parent or guardian linked to a student through the pilot roster.

Questions or requests: privacy@sidekrew.com. Mail: 500 King St West, Suite 300, Toronto, Ontario M5V 1L9, Canada.

• Students in Grades 7 to 12 whose school has signed a pilot agreement with us and put them on its pilot roster.
• Their parents, as listed by the school.
• Parents we invite directly to forward Google Classroom’s guardian summary emails to us, when their child’s school isn’t in the pilot.
• School staff who act as the school’s pilot contact or safety contact.

The pilot is invite-only. Nobody can sign up on their own.

The school’s roster

The student’s school email, first name and grade, and a 16+ or 18+ mark if the school sets one. Each parent’s email, language and the student they’re paired with. For each class, whether the teacher said yes to AI help and to “check my answer”.

Google Classroom, read only

Once a parent says yes and the student connects: the student’s classes; their assignments and due dates; whether each one is turned in; and teachers’ announcements and class materials (titles, descriptions and links). We read only what the student’s own account can see. See How we use Google data.

Google sign-in

The name, email address and Google account ID of the person signing in.

The student

What they add or choose in the app: plans and times, done marks, busy evenings, notes, items they add, reminder settings, how the AI helper explains and how they answer it, practice answers, and help chats if AI help is on.

Parents who forward summaries

The Google Classroom guardian summary emails they forward to us, and their own email address. Anything else that arrives is discarded unread.

Consent records

Each parent’s yes or no for each part of the service, with the date and the exact text they saw, and the student’s “Got it” on the start page.

Running the service

Sign-in records, the device’s push subscription for reminders, error logs with no homework or chat content, and an audit log of who did what. Pilot measures (for example, that a weekly card was answered) are counted under a coded ID, never a name or email.

• Grades. Google’s permission screen mentions grades; we don’t store or show them.
• Files in Google Drive, or the files attached to assignments.
• Gmail, other than summaries a parent chooses to forward.
• Date of birth.
• Home address or location.
• Contacts, photos or anything else on the device.

• To show the student one list of their work, help them plan their evenings, and send the reminders they chose.
• To find upcoming tests and offer practice.
• To give hint-first AI help, only where it’s allowed (see AI help).
• To send parents a weekly summary, and rare same-day notes about work Classroom shows as not turned in.
• To keep students safe (see Safety) and the service secure.
• To measure the pilot, in counts and totals that name no student.

We never sell it, never use it for ads, and never let anyone use it to train AI models. SideKrew School has no ads, no analytics tools from other companies and no tracking pixels, and email open and click tracking is off.

The student

Everything in their own account.

Parents

Each item’s title, class, due date and Classroom status; the student’s own done marks; upcoming tests; and how many help sessions the student used. Titles go through our classmate-name filter first (see Classmates’ names).

Parents never see

AI help chats, practice answers or scores, notes, planned times or places, or how often something was put off.

From Grade 11 or 16+

Parents see counts and test dates by default. The student can choose to share titles. (16+ comes from the school’s roster.)

What my parent sees

A screen in the student’s app shows them exactly what their parents see.

Other parents

Each parent sees their own settings, never another parent’s.

The school and teachers

There’s no teacher or school login in the pilot, and they don’t see a student’s SideKrew School content. We tell the school’s pilot contact when the school’s Google settings block a student, so they can fix it, and we send the school pilot results as totals that name no student. For safety, see Safety.

People at SideKrew

Only in three cases: (a) a safety flag is raised; (b) the student taps Report this chat; or (c) to fix a problem the student or a parent reported, only if the student says we can look. No random checks. Every view is written to our audit log.

We never report a student’s help requests to a school or a parent as cheating.

AI help is on only in classes whose teacher said yes in writing, and only if a parent said yes to AI help (or the school’s roster marks the student 18 or older). The AI helper, test checks and practice questions run on Claude, made by Anthropic, a company in the United States.

• What goes to Anthropic: the parts the student asks about. The assignment’s title and instructions go through our classmate-name filter first. The student’s own messages go as the student typed them: the filter does not run on them. Never the student’s name or email.
• Where: in the United States. We set every request to be processed there.
• Anthropic doesn’t use what we send to train its models.
• How long: Anthropic keeps requests for up to 30 days, unless it has confirmed zero data retention for us in writing. It hasn’t yet, so expect up to 30 days. Even with zero data retention, a request its safety systems flag may be kept for up to 2 years, and its safety scores for up to 7 years.
• Anthropic reports child sexual abuse material, and cases where a minor may be at imminent risk of sexual abuse or exploitation, to the authorities.
• We set a daily limit on AI use for each student; when it’s reached, AI practice stops until the next day.

Some things never go to the AI: forwarded summary emails, and any message our safety screen treats as high risk.

Every help session is labelled “AI helper · not a person” and ends with a note the student can copy to credit the help.

Our database and app servers keep student data at rest in Montréal, Canada. Some processing happens outside Canada, and we name all of it here.

Supabase

Our database. Data at rest in Montréal (ca-central-1). Supabase is a US company.

Vercel

Our app servers, in Montréal (yul1). Vercel’s network may decrypt a request at its nearest edge location, which can be in the United States, before passing it to Montréal. If Montréal is down, the app is down; requests aren’t sent elsewhere. Vercel is a US company.

Anthropic

The AI helper, test checks and practice questions. United States.

Resend

Sends parent email and content-free safety alerts to our safety team, and receives forwarded summaries. United States. It keeps copies (see How long we keep it).

Push services

Apple, Google, Mozilla and Microsoft carry encrypted reminders to the student’s phone or computer.

We don’t use a text-message (SMS) provider in the pilot. Supabase and Vercel are US companies, and US courts and authorities can reach data processed in the United States.

We won’t add any other processor without updating our rules and giving pilot families 30 days’ notice.

AI help is open only while a person on our safety team is on call, during the hours your school set, Toronto time. Help is closed on days the school marks.

Outside those hours, the AI helper says when it opens and shows crisis lines. The list of work, reminders and practice keep working at every hour.

Every place a student can type is checked for signs that someone isn’t safe. If a message looks high risk, the AI doesn’t see it. The student sees crisis lines right away, and a person on our safety team reads it.

Each person who reads a flag decides for themselves whether the law requires them to report it, and records that decision. Under Ontario law, we may have to tell a children’s aid society, the school’s safety contact or, in an emergency, the police.

We never contact a parent or anyone in the household about what a student told us. Any follow-up goes to the safety contact the school named in its pilot agreement.

A student can also tap Report this chat. A person on our safety team reads a reported chat within 2 school days.

Teacher posts sometimes name classmates. Before anything goes to the AI, and before any title reaches a parent, a filter replaces other people’s names with “[a classmate]”. It leaves the teacher’s name.

It has limits: it can miss an uncommon name, and it sometimes hides a word that isn’t a name. It makes sharing a classmate’s name less likely; it doesn’t prevent it every time.

We keep teachers’ announcements and class materials for 30 days at most.

• Disconnecting Classroom deletes synced Classroom content from our live database within 24 hours.
• Deleting an account deletes the student’s content from our live database within 24 hours.
• Copies then age out of our encrypted database backups within 7 days.
• AI help chats are deleted after 30 days.
• Resend lists 30-day data retention on its plans and hasn’t documented a separate period, or a way to delete, for mail it receives. We’ve asked. Until it answers in writing, forwarded summaries and parent emails may stay with Resend for up to 30 days.
• Anthropic keeps requests for up to 30 days, unless it has confirmed zero data retention for us in writing. Even then, a request its safety systems flag may be kept for up to 2 years, and its safety scores for up to 7 years.
• Forwarded summaries: we remove Google’s settings links when they arrive, and delete our raw copy within 72 hours.
• If Gmail sends a forwarding confirmation, we keep its link, its code and the address that asked, encrypted, for 24 hours.
• If mail arrives from an address we don’t know, the parent’s setup page shows it partly hidden for 7 days, then we delete it.
• Practice questions and answers are cleared 30 days after the practice session was made.
• Records of Google sign-in attempts, with no content, are deleted after 7 days.

After deletion we keep only consent records and an audit log with no homework or chat content (for the pilot plus 2 years), and safety flags with an excerpt of up to 500 characters (for 1 year, or longer if a report was made to a children’s aid society and our lawyer advises it).

Our use of Google data follows Google’s rules for apps. In the words Google asks us to use:

SideKrew School's use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

What we read from Google, and why, is in How we use Google data.

• SideKrew School is for Grades 7 to 12 only.
• For every student under 18, a parent says yes first, separately for each of three things: reading Classroom, AI help, and reminders to the student. Nothing is read from Classroom until a parent says yes.
• If any linked parent says no, that part is off.
• A student counts as 18 or older only if the school’s roster says so. Nobody becomes an adult in the app by ticking a box.
• When the school lets the app in, Google asks the school to take responsibility for parental consent. The pilot consent form, returned to the school, covers it.
• Before connecting Classroom, the student reads a start page that says what we read and who sees it, and taps “Got it”.

• Change any yes or no at any time in Settings.
• Disconnect Classroom, or delete your account, in Settings.
• Ask to see the information we hold about you or your child, or ask us to correct it, at privacy@sidekrew.com. We answer within 30 days.
• Students can see exactly what their parents see on the “What my parent sees” screen.

Tell us first at privacy@sidekrew.com, and we’ll work to fix it. You can also complain to the Office of the Privacy Commissioner of Canada, which oversees how private companies like ours handle personal information under PIPEDA: priv.gc.ca.

We give pilot families 30 days’ notice before adding any new processor, and we tell you by email before any other important change. The date at the top shows which version this is.