Privacy Policy

GoASL ("we," "our," or "us") is an ASL teaching and learning platform for educational institutions. It supports simultaneous and consecutive ASL interpretation practice: students record video of themselves performing interpretation, and teachers (and optionally peers) provide video or text feedback and grades. This Privacy Policy applies to all users of GoASL (students and teachers) and to institutions that use the platform. It describes what information we collect, how we use it, how we comply with FERPA, and how we protect your data.

By using GoASL you agree to this Privacy Policy. If you do not agree, do not use the service.

Account information: When you sign up we collect your email address, first and last name, role (student or teacher), and institution code. This is stored in your profile.

Education data: We store classes you create or join, assignments, your video submissions, grades and feedback (from teachers or peers), and peer review participation (e.g., which submissions you are assigned to review). For peer review we may store a display name so reviewers see who they are reviewing.

Technical data: We use session and authentication data to operate the service. Our infrastructure may log requests for security and operations (e.g., IP, timestamps).

We use your information to provide the platform: to display your classes and assignments, to store and play back your submissions, to allow teachers to grade and give feedback, and to enable peer review when your instructor turns it on. We use account and technical data for authentication, security, and support.

Education records: Under the Family Educational Rights and Privacy Act (FERPA), "education records" are records that are directly related to a student and maintained by an educational agency or institution. On GoASL, education records include your submissions (video), grades, feedback (text and video), class membership, and linkage to your identity (e.g., name, email in profile).

Our role: We act as a service provider to your institution. FERPA obligations to protect and provide access to education records rest with your educational institution. We process and store data on the institution's behalf to operate the platform.

Access: Only authorized users can see education records. Teachers can see only data for their own classes and assignments. Students can see their own submissions and feedback. When peer review is enabled, student reviewers see only the submissions they are assigned to review and the reviewee's display name—not other students' data.

Disclosure: We do not sell education records or use them for advertising. Disclosure to other students happens only in peer review as part of the educational service (e.g., so a classmate can provide feedback on your submission when your instructor has enabled that feature).

Safeguards: We use access controls, encryption, and database-level security (Row Level Security) so that only authorized users can read or change data. See the Security section below.

Rights: Under FERPA, eligible students (and parents, where applicable) have rights to access and request amendment of education records. You should direct access or amendment requests to your institution. We support institutions in fulfilling those requests as their service provider.

We use industry-standard measures to protect your data. Data is encrypted in transit (e.g., HTTPS) and at rest in our hosting infrastructure. Our database uses Row Level Security (RLS) so that each user can access only the rows they are allowed to see (e.g., their own submissions, their class data).

All changes to data (create, update, delete) are made through secure server-side actions—never by direct writes from the browser. We do not expose internal error details or system information to users. File and storage paths are validated to prevent path traversal or misuse.

Video and other media are stored in secure, access-controlled storage. Only the student, their teachers, and (when peer review is on) assigned peer reviewers can access submission videos.

We retain your data for as long as your account and institution relationship exist and as needed to operate the service. Teachers can delete their classes and assignments (and associated submissions and feedback). Students can leave classes. When content is deleted, we remove it from our systems; some data may remain in backups for a limited period.

For how long your institution retains education records or requires us to retain them, contact your institution. We support institutions in meeting their retention and deletion obligations.

We use third-party infrastructure to run GoASL (e.g., hosting, database, authentication, storage, and email). These providers process data only to operate the service. We do not sell your data to third parties or allow them to use it for their own purposes (e.g., advertising).

Our data processors include: (1) Supabase (Supabase, Inc.) — database, user authentication, and secure file and video storage; (2) Resend (Resend, Inc.) — transactional email delivery (e.g., signup confirmation, password reset, trial or institutional onboarding emails); (3) Vercel (Vercel, Inc.) — when we use Vercel to host the application, it provides hosting and may process request data (e.g., IP address, request metadata) to deliver and operate the service. We may use additional hosting or infrastructure providers. Data is stored in secure, access-controlled environments. We may update the list of subprocessors from time to time; material changes will be reflected in this policy or communicated as required.

For FERPA-related access or amendment of education records, contact your institution. You can update your profile (e.g., name) in your account settings. For other privacy requests or questions, contact us using the information below.

We may update this Privacy Policy from time to time. The "Last updated" date at the top will be revised when we make changes. Continued use of GoASL after changes means you accept the updated policy. For material changes we may provide additional notice (e.g., in-app or by email) where appropriate.

For questions about this Privacy Policy or our privacy practices, contact us at the support address provided by your institution or at the contact information listed on the GoASL website.