Privacy Policy

What we collect, and what we don't

GoodCents runs a classroom economy. It needs to know who a student is and what they've earned. It does not need to know anything else, so it doesn't collect anything else.

Last updated 2 October 2026

1. What we collect

How students sign in

By default a student signs in with a username the school assigns, made from their name (for example Andrew_Jahan), and a password the student chooses at first sign-in. No student email address is collected or used; the account behind the username carries only that username and the student's name. Where a district permits it, a school may instead let students use Sign in with Google (below).

From signing in with Google (staff, and students only where the district allows it)

GoodCents uses Sign in with Google and receives only the basic profile scopes: email address, name, and profile picture. We do not request access to Gmail, Drive, Calendar, Classroom or any other Google service, and we cannot read them.

Entered by school staff

A teacher or administrator sets up the roster. That record holds a student's first and last name and optionally a seat or class label. When the roster is imported from the school's attendance report, only the names are kept: the student number and grade level in that report are not stored. Weekly attendance is matched to students by name.

For staff, GoodCents holds the same Google profile, their role at the school, the permissions the administrator has given them, and an optional preferred name (such as "Mr. Jahan") shown on receipts.

Created by using the app

All amounts are classroom points. No real money moves through GoodCents, and we never ask for or store payment details. We do not collect grades, discipline records, health information or anything about a student's family.

From the device

If push notifications are enabled, we store a push token — an anonymous identifier the operating system issues so a notification can reach that device — and which platform it is (iOS or Android). Turning notifications off removes it.

If the app crashes, a crash report is sent so we can fix the fault: the error, where in the code it happened, the device model and app version, and which school and role the person had. No names, no email addresses and no account identifiers — we do not send who it was, and web addresses have their details stripped before they are sent.

2. Why we collect it

Each item above exists because a feature would not work without it. Names identify who earned what. The transaction record is the ledger the whole economy is built on. Attendance counts determine pay. Written reasons are what a teacher grades. Push tokens deliver the payday notification. That is the whole list — we do not collect data speculatively in case it is useful later.

3. What we don't do

• No advertising. There are no ads in GoodCents and no ad networks in it.
• No analytics or tracking SDKs. The app contains no analytics, attribution, or behavioural-tracking libraries of any kind. We do not build profiles of students and we do not track anyone across other apps or websites.
• No selling, renting or trading data. Not to anyone, for any purpose, ever.
• No targeted advertising to students, and no use of student data to train advertising, recommendation or artificial-intelligence systems.
• No location tracking. The app never requests location.
• No contacts or microphone access. The camera is used only to scan a store ticket's QR code at the desk, on the device and not recorded. The photo library is used only when an administrator chooses a school logo.

4. Who can see it

GoodCents is separated by school: nobody at one school can see another school's data. Within a school:

• Students see their own balance, history, savings, loans, investments and the feedback on their own reasons. They can see classmates' names, so they can choose who to give a gift or lend to — but not other students' email addresses, balances or histories. A student's credit score is shown to a classmate only if that student turns on sharing. Requests to borrow from classmates are shown without the borrower's name.
• A student given the store-desk job sees the school's waiting store tickets — the item and the student it belongs to — while running the desk.
• Teachers and administrators see the students in their school, including individual balances, transaction history and written reasons, because that is the job the app does. What each staff member can see and do is controlled by permissions the administrator sets.
• We — the developer — can access the database for support, backup and debugging. We look only when there is a reason to, such as investigating a fault reported by the school.

5. Services we rely on

GoodCents uses a small number of service providers. They process data on our instructions and are not permitted to use it for their own purposes. The database, its backups and crash reports are all stored in the United States.

The app also fetches market prices from Yahoo Finance, CoinGecko and Twelve Data, and public news headlines from Google News, to power the classroom exchange and its research note. Information flows in only — no student data is ever sent to those services. The research note is stored with the headlines it cited so that students can check it. It is written by a machine and can be wrong; it is not advice.

If we add a service that receives student data, we will update this list and tell the schools using GoodCents before it is used.

6. Schools, FERPA and student records

The school owns its data. When a school uses GoodCents, the school decides what goes in and controls it. We act as a service provider to the school, handling that information on the school's behalf and under its direction — the role a "school official" performs under the Family Educational Rights and Privacy Act (FERPA). We do not use student information for any purpose other than providing GoodCents to that school, and we do not disclose it except to the providers listed above, to the school itself, or where the law requires it.

Attendance figures are education records. They enter GoodCents only because staff enter or import them, and they are used solely to calculate classroom pay.

We will sign a district's student data privacy agreement, including the California Student Data Privacy Agreement used by many California districts. Where an agreement with a school says something different from this policy, the agreement wins.

Parents and guardians with questions about their child's records should contact the school first — the school holds the records and can act on them directly, including reviewing and correcting them. We help the school do that whenever it asks.

7. California students

GoodCents is built in California for California schools, and handles student information the way California law requires of an education service, including the Student Online Personal Information Protection Act (SOPIPA) and Education Code section 49073.1:

• Student records remain the property and under the control of the school.
• Students may keep content they create (such as their written reasons) and the school can provide it on request.
• We do not use student information for targeted advertising, to build a profile for any purpose other than the school's, or sell it — and we would not transfer it to a buyer of GoodCents unless the buyer is bound by these same commitments.
• Parents and guardians can review and correct their child's information through the school.
• We notify the school if student data is ever accessed without authorisation (section 12).
• When a school stops using GoodCents, its student records are deleted (section 9).

8. Children's privacy

GoodCents is provided to schools for classroom use, and students access it through an account their school issues. We do not knowingly collect personal information directly from a child for our own purposes, we do not show children advertising, and we do not build profiles of them.

Where a school enrols students under 13, the school is responsible for providing the parental notice and consent that the Children's Online Privacy Protection Act (COPPA) permits it to give on parents' behalf for an educational service. We support that by collecting only what the app needs and by deleting data on request.

9. How long we keep it

• While enrolled. A student's record is kept while they are in a school using GoodCents, because their history is the point of the app.
• When a student leaves. Staff can remove a student, which settles their balances and closes their participation.
• When a student deletes their own account (in the app, under Me → Close account) their sign-in, username, notification token and any email are deleted and their name is replaced with "Former student". The anonymised transactions remain, because a shared ledger cannot have entries erased from its middle without corrupting every balance around it.
• When a school stops using GoodCents. On the school's written request we offer it a copy of its data first, then delete the school's data from the live system within 30 days, and confirm in writing when it is done.
• Backups. The database is backed up nightly. Each backup is encrypted and kept for 90 days, then discarded. A deletion is reflected in live data immediately; it ages out of backups within that window.
• Price history for the exchange is pruned automatically and holds no personal data.

10. Your choices

• See your data. Your balance, full transaction history, paystubs, loans, investments and written reasons are all visible in the app.
• Correct it. Ask your teacher or administrator — they can adjust or void transactions.
• Delete it. Me → Close account, in the app. Staff can also remove a student. Schools may request deletion of their whole school's data by writing to us.
• Turn off notifications. In the app under Me, or in your device settings.

Depending on where you live you may have additional rights over your personal information. Write to us and we will honour them.

11. Security

• Encryption. Data is encrypted in transit and at rest. Nightly backups are encrypted again with a key that only we hold before they are stored.
• Access enforced by the server. Who can see what is enforced in the database itself with row-level security, so a student's device can only ever retrieve that student's own records and the school-wide information they are entitled to — the rules are applied by the server, not by the app.
• An audited ledger. Money-changing operations run as checked database functions rather than direct writes, and the ledger is insert-only: entries can be reversed by a correcting entry, but not quietly edited or deleted. Every entry records who made it.
• Least access. Staff sign in through the school's Google accounts. Student passwords are stored only as salted hashes by our sign-in provider, never readable by anyone, and a teacher can only issue a new temporary one, never see the old. Only the developer can administer the systems that hold student data, and every one of those accounts — the database, code, app publishing, website and crash reporting — is protected by two-factor authentication.
• Tested from the outside. We probe our own access rules the way an attacker would — not signed in, signed in as a stranger, as a student, as a teacher — and fix what we find before anyone can use it. The last full review was 7 October 2026.

No system is perfect. If you find a security problem, please tell us — see below.

12. If something goes wrong

If we learn that student data has been accessed or disclosed without authorisation, we will notify the affected schools within 72 hours of confirming it, telling them what happened, what information was involved, and what we are doing about it — and we will work with each school on any notice it needs to give families.

13. Changes

If this policy changes materially we will update the date at the top and, where the change affects how student data is handled, notify the schools using GoodCents before it takes effect. We will not use data already collected in a materially different way without the school's agreement.

14. Contact

Questions, requests, a data privacy agreement, or a security report: [email protected].

GoodCents is built and operated by Andrew Jahan.