How Lift Off Protects Your Data

What Is Lift Off?

Lift Off helps teachers provide reading materials at the right level for every student. Teachers upload assignments, and Lift Off adjusts the reading level and language. Students access their version by entering a class code—no account or sign-up required.

What We Collect

From Teachers

• Name and email—to create and manage your account
• Password—stored in scrambled (hashed) form so even we can't read it
• Google or Microsoft sign-in data—if you choose SSO, we receive your name and email and store authentication tokens securely
• Payment info—processed by Stripe; we never see or store your credit card number
• IP address and activity logs—for account security only; automatically deleted after 90 days

About Students

Students never create accounts and never enter information themselves. Teachers provide:

• First name—so students can find their assignments
• Reading level—so we adjust text appropriately
• Preferred language—so we can translate when needed
• Text-to-speech preference—so students can listen if needed
• A student session cookie—contains only an internal student identifier and class identifier (no names); expires after 4 hours; not used for tracking across sessions or devices
• A class code cookie—stores only the class code so students can re-enter their class without retyping it; expires after 14 days; contains no student-identifying information

That's it. No email addresses, phone numbers, physical addresses, photos, dates of birth, or demographic information.

Student reading levels, preferred languages, and other data provided by teachers are treated as education records under FERPA and receive all protections described in this policy. Student cookies contain only internal identifiers—no names or personal information.

Educational Content

• Assignment files (PDFs, images) uploaded by teachers
• AI-adjusted versions of assignment text, saved so we don't reprocess the same content

How We Use AI

When a teacher uploads an assignment:

1. If the document is a scanned image or PDF, we use Google Cloud Vision to read the text. Images are processed in memory and not stored.
2. We send the assignment text to OpenAI to adjust reading level and/or translate it.
3. We save the adjusted version so it doesn't need reprocessing.

Services We Use

We use a small number of services to operate Lift Off. Here is what each one does and what data it receives:

We do not use any advertising, behavioral tracking, or profiling services. No data is shared with ad networks or data brokers.

Data Retention & Deletion

• Teacher accounts are kept until the teacher deletes their account.
• Student data is deleted immediately when a teacher removes a student or deletes a class. All associated records are permanently removed in the same operation.
• Assignments and AI-generated content are deleted immediately when the teacher deletes the assignment, including all uploaded files and cached content.
• Account deletion permanently removes all associated classes, students, assignments, and OAuth tokens.
• Security logs (including IP addresses) are automatically deleted after 90 days.
• Backups—deleted data may persist in automated infrastructure backups for up to 7 days.

Schools and authorized users may request deletion of student data at any time by contacting support@lift-off.me.

Children's Privacy & COPPA

Lift Off is designed for use in schools with students of all ages, including children under 13.

• Students never create accounts and never enter personal information themselves. All student data is entered by teachers acting on behalf of their school.
• Schools and districts provide consent for the collection and use of student data on behalf of students under 13, in accordance with COPPA's school-authorization exception.
• Teachers using Lift Off represent that they are authorized by their school or district to provide student data. Teachers are encouraged to confirm this authorization with their school administration.
• We do not use student data for any commercial purpose.

If you believe a child has provided us with personal information directly, please contact support@lift-off.me and we will delete it promptly.

FERPA Compliance

• We use student data solely to provide differentiated educational content—nothing else.
• We act as a "school official" with a legitimate educational interest, as established through the school's or district's agreement with Lift Off.
• No student names or personal information are sent to AI providers—only assignment text.
• Schools retain ownership and control of all student education records.
• Schools and parents may request access to, correction of, or deletion of student data at any time.

State & International Compliance

We comply with applicable student privacy laws including COPPA, FERPA, California's SOPIPA and AB 1584, New York Education Law § 2-d, and Illinois SOPPA. For state-specific Data Processing Agreements or addenda, contact support@lift-off.me.

For international users (GDPR): Lift Off acts as a data processor on behalf of schools. You may access, correct, delete, restrict, or export your data by emailing us. We respond within 30 days. See the full privacy policy for complete GDPR terms.

Security

• Passwords are hashed and salted—even we can't read them
• Data is encrypted in transit (TLS) and at rest at the infrastructure level
• Access to personal data is limited to authorized personnel with a legitimate need
• Files are protected with access controls so only authorized users can view them
• Credit card numbers are never stored—all payment processing is handled by Stripe
• We regularly review our security practices

In the event of a data breach, we will notify affected schools and users as required by applicable law.

Cookies

We use only the cookies necessary to make Lift Off work. All cookies are set with httpOnly, secure, and SameSite=Lax flags.

• Teacher session cookie—keeps you signed in (expires after 14 days of inactivity or on logout)
• Student session cookie—contains only an internal student identifier and class identifier (no names or personal information); expires after 4 hours; not used for tracking across sessions or devices
• Class code cookie—stores only the class code so students can re-enter without retyping it; expires after 14 days; contains no student-identifying information

No third-party cookies. No tracking. No analytics.

If Ownership Changes or We Shut Down

Transfer of ownership: If ownership of Lift Off is transferred to another person or entity, the new owner will be bound by the same privacy terms. If student data handling would materially change, schools will be notified at least 90 days in advance and given the opportunity to request deletion.

Shutdown: We will provide at least 90 days' written notice. Schools may request export or deletion of all data during that period. All remaining data will be permanently deleted after the notice period.

Changes to This Policy

If we make significant changes, we'll notify teachers by email. Material changes to the handling of student data require affirmative consent from the school before taking effect. The updated policy will be posted with a new effective date.

Data Export & Portability

Schools and authorized users may request export of their data (including student rosters, assignments, and generated content) by contacting support@lift-off.me. We fulfill export requests within 30 days in a machine-readable format (e.g., CSV or JSON).

Contact

Questions about privacy, data requests, or Data Processing Agreements:

Lift Off
Operated by Andrew Atkins and Morgan Atkins
3814 Arnold Ave, Apt 1, San Diego, CA 92104
support@lift-off.me