Privacy Notice

01Who operates the service

Pactling Academy at pactlingacademy.com is operated by Adam Wachter, based in Taiwan. In this notice, “we” means that operator. For privacy questions and requests, contact support@pactlingacademy.com.

This notice covers the current invitation-only pilot for ESL teachers in Taiwan, their teacher-managed student participants, and visitors to this website. Teachers hold educator accounts. Students do not register as customers or control educator accounts.

02Information we use

Information comes from teachers, student activity, and the technical operation of the service:

• Teacher pilot requests: name, email address, educator role, country or region, optional school and teaching details, request and review dates, approval status, and email delivery records. We use these to review requests and arrange pilot access. A short-lived protected identifier derived from the submitting network address helps limit spam. You can ask support to remove your request.
• Teacher accounts: name, email address, email verification status, protected password records, and sign-in/session records.
• School workspaces: school name, campus, location, time zone, optional website, the managing adult’s role, staff memberships, invitation email addresses and delivery status, teaching assignments, and a limited audit history of school and classroom management actions.
• Classroom records: class names and grade labels, student names or nicknames, teacher-created login IDs, protected password records, class and team membership, lessons, quests, questions, and activity completion.
• Participation and game progress: rewards, XP, levels, Pactlings, battle and encounter progress, inventories, Trainer appearance, Sanctuary layouts, Reward Tree choices, classroom power requests and decisions, and Campfire activity and reactions.
• Content you provide: lesson text and any supported uploads, such as team emblems. A roster text-file import sends the names you choose to save.
• Support: the teacher’s name and email, the report and any optional expected-result or browser/device information supplied, replies, and delivery/resolution records.
• Technical and security information: IP addresses, browser/user-agent information, request and error information, authentication cookies, session identifiers, and sign-in attempt records. Hosting providers also process network information to deliver and protect the site.
• Pilot operations: a teacher's most recent authenticated activity time, updated at most hourly, helps us count active teachers. Account-email delivery records contain the recipient, email type, delivery status and dates. These records do not contain email bodies or authentication links, and this delivery connection does not track message opens or clicks.

Student email addresses, birth dates, home addresses, government IDs, payment information, and photographs are not required. Use a first name or classroom nickname where possible. Please do not enter health records, sensitive family information, or other unnecessary personal details in lessons, images, or support reports.

03Why it is needed

We use this information to create and secure accounts, deliver teacher-directed lessons and game features, save progress, show classroom activity, send account emails, answer support requests, troubleshoot problems, and prevent misuse. Authorized operator access is limited to running and supporting the service and handling necessary legal obligations.

We do not sell or rent personal data, run advertising, or use student records to build advertising profiles. Teachers may optionally connect their own OpenAI API account. Only the lesson text, files, instructions, and quest context they choose for a generation request are sent to OpenAI. Classroom rosters and student records are not automatically included. Use source material without student personal details.

Teachers choose whether to create a classroom and what permitted information to provide. Without an email and the required account fields, we cannot create or verify an educator account. Without a student record and working login, we cannot provide that student’s saved experience. Optional uploads and optional support details can be omitted.

04Who can see classroom information

The responsible teacher can manage their classes, students, progress, and requests. A signed-in student receives their own progress and their class’s active quests. Classmates can see names or nicknames, Trainer/Pactling displays, selected achievements such as captures and completed adventures, and reactions shared through the class Campfire. These are class features, not public social profiles.

Personal classrooms are separate from other teachers. In a school workspace, its owner and admins can manage school records, and assigned lead teachers and co-teachers can manage their classes. Joining a school does not automatically move personal classes or share personal AI credentials. School members can access deliberately shared lesson templates. Support reports are available to the reporting teacher and the operator. Information may also be disclosed when required by applicable law or when necessary to address a security incident or protect someone’s rights.

05Providers and processing locations

We use the following services to operate the pilot:

• Cloudflare: website hosting, database and file storage, network security, and routing support email. It processes application records, files, and network information needed for these services. Cloudflare privacy information.
• Resend: sending verification, password-reset, school-invitation and support-notification emails. It processes recipients, message content, and delivery information. Resend privacy information.
• Google Gmail: the operator’s support mailbox during the pilot. Messages to support, emailed reports, and replies are handled there. We do not send the classroom database to Gmail. Google privacy information.
• OpenAI (optional): when a teacher chooses Generate, OpenAI processes the selected lesson material and prompt to return a draft. We request that generated responses are not stored for later retrieval, but OpenAI may retain data under its own API policies. See OpenAI API data controls.
• Google Drive (operator backups): a dedicated operator account stores additional encrypted recovery copies. The backup service checks that account and its available storage, creates and verifies backup files, and removes expired copies. Its Google permission is limited to files used with this service; it does not connect teachers’ or students’ Google accounts. Connection credentials are protected, and the private recovery key is stored separately from Google Drive. See Google privacy information.

We store connected teachers’ and schools’ API keys encrypted, separately from classroom records. Disconnect removes the stored key from the active database; historical backups may retain encrypted copies under backup retention. Revoke the key in OpenAI to stop its use there. Uploaded AI source files are processed for the request and are not saved in Pactling Academy storage. Generated content is kept in your classroom only when you add it and save the lesson.

A school owner may connect a school-funded API project and authorize staff to use it in school classes. Staff cannot view the school key. Owners can review request counts, outcomes, and provider-reported token usage by staff member. These usage records are retained for 90 days; they do not contain lesson prompts, source files, or generated answers. Personal classroom AI usage is separate and is not shown to the school.

The operator works in Taiwan. These providers operate internationally, including in the United States, and may store or process information outside Taiwan in locations used by their services and subprocessors. The pilot does not promise Taiwan-only storage. Information is handled electronically through the website, storage systems, and email.

06Students, families, and teachers

Teachers create student access and choose the activities. Before adding real student information, teachers should share this notice with students and families in an understandable way and obtain the school permission and parent or guardian authorization required for their setting. A teacher invitation by itself is not parental authorization.

Students and families can ask their teacher about classroom participation or contact us directly about personal data. We may work with the teacher to identify the correct record and verify who may make a request. The teacher’s role does not remove the operator’s own privacy responsibilities.

07Cookies and security

Essential cookies keep teachers and students signed in. A separate preference cookie remembers whether the teacher sidebar is open for up to seven days. The current session lifetime is up to seven days and teacher sessions may renew with use. Signing out or a password reset can end access earlier. Blocking these cookies prevents normal sign-in. We have not added advertising cookies or third-party marketing analytics to the pilot.

Student passwords are hashed for sign-in. We also keep encrypted copies of newly created or updated student passwords so authorized teachers and school administrators can reprint login cards for students they manage. Older passwords can be prepared for reprinting by verifying the current password or explicitly resetting it. These copies are deleted with the student account; encrypted backups follow the retention periods below. Downloaded cards contain readable login details and should be kept private.

We use HTTPS, password hashing, access checks, and sign-in limits. These measures reduce risk but cannot guarantee that every incident will be prevented. Keep login cards and passwords private, sign out of shared devices, and tell us promptly if you suspect unauthorized access. Never email a password to support.

08Keeping and deleting information

Account and classroom records are kept while needed for the participating teacher’s use of the pilot, until deletion is requested, or as needed to meet a legal obligation or resolve an active dispute. Inactive accounts are not currently deleted automatically. We assess continuing retention when the pilot or an account ends.

Remove from class keeps the student’s account and earned progress. Delete student in the main Students area removes their active login and saved progress. Historical teacher activity messages, support correspondence, uploaded files, and provider recovery copies may still contain information; contact us for a broader deletion request.

Support reports and related emails are currently retained for case handling and pilot follow-up; marking a report resolved does not erase it. Expired authentication links no longer work, but expiry is not a guarantee that every associated database record has been erased. Recovery copies and provider records follow the providers’ retention arrangements and may remain after active records are removed.

The site's email-delivery records are removed after 30 days by an hourly cleanup. The most recent teacher activity time stays with the teacher account and is removed when that account is deleted. Provider records and encrypted backups have their own retention periods.

Teachers can delete their account in Account settings after confirming their password. This removes their active account, personal classrooms, personal student records and progress, site support reports, saved AI credentials, sessions, and private uploads. Failed upload removals are retried automatically. Encrypted application backups are retained for 30 days; a minimal, pseudonymous deletion record is kept for 35 days to prevent recovery from restoring deleted accounts. Previously sent support emails and provider records may remain. Contact us for other deletion or retention requests. We will explain any information that must be retained, the reason, and the applicable period when responding to a request.

School-owned classes, student records, uploads, shared lessons, and school audit history remain with the school when a staff member leaves or deletes their personal account. Their school access is removed. The owner must transfer ownership before deleting their account. Contact the school manager or support for a school record correction or deletion request.

09Your choices and data requests

You may request access to or a copy of your personal data, correction or supplementation, an end to its collection, processing or use, or deletion, subject to applicable law. These rights are not waived by using the service. Contact support@pactlingacademy.com with “Privacy request” in the subject and enough information to locate the account. Parents or guardians may contact us for a student.

We may ask for proportionate identity or authority verification before disclosing or changing records. Do not send identity documents unless we arrange a necessary, suitable method. We will respond within the applicable legal time limits, explaining any lawful refusal or extension. Removing necessary account or progress information can prevent continued use of the related feature.

10Changes to this notice

We will keep the effective date on this page current. Material changes to how personal information is used will be brought to participating teachers’ attention before taking effect, and we will seek any additional authorization required. Review this notice again before expanding to new countries, school-wide use, or optional integrations.

The service rules are in our Terms of Use.