Privacy policy
Last updated 5 November 2026
Roughwork is a set of short, hand-drawn lessons for IB Diploma students, bought by schools. We collect as little as we can, we never sell data, and we show no ads.
Who is responsible
When a school uses Roughwork, the school decides who gets access and why; we process students' data on the school's behalf and only to run Roughwork for it. For coordinators' and teachers' own accounts, and for billing, Roughwork is responsible. Write to hello@roughwork.me with any question or request.
What we collect
- From Google sign-in: your name, email address and a Google account identifier. We never see your Google password.
- When you join a school: your school, your role (student, teacher or coordinator), the name you choose to show, and for students the year group, subjects and levels you pick, plus a house we assign.
- While you learn: which lessons you open and finish, your answers to the check questions (right or wrong), when you did it, and the points worked out from that. Your first guess in a lesson is never stored.
- When a school buys seats: the number of seats, the amount and the order status. Card, UPI and bank details go to our payment provider, Dodo Payments, and never reach us.
We don't collect location, contacts, photos, or anything from your device beyond what the website needs to run.
How we use it
- To sign you in and keep you signed in.
- To show students their progress, points and (if the school turns them on) house and year-group leagues.
- To show the school's teachers and coordinator who is learning, which topics are hard, and which students may need a nudge.
- To take payment for seats, send invoices and keep the records the law requires.
- To keep Roughwork secure and fix problems.
We don't use student data for advertising, sell it, or build profiles for anyone outside the school.
Who can see what
- A student sees their own work. In the leagues, classmates appear only as points and a house, and names only if the school turns names on.
- Teachers and the coordinator at the student's school see each student's activity and results. Nobody at another school can.
- Service providers who run parts of Roughwork for us, under contract and only for that purpose: Supabase (database and sign-in, stored in Mumbai, India), Vercel (hosting), Google (sign-in) and Dodo Payments (payments).
- Authorities, only where the law requires it.
Children
Most Roughwork students are under 18. They use it only through their school, which is responsible for getting any consent a parent or guardian must give. A parent or guardian can ask the school, or us, to see or delete their child's data.
How long we keep it
We keep a school's data while the school uses Roughwork. If a school stops, or asks us to, we delete its students' and staff's data within 90 days, except payment records we must keep for tax and accounting.
Your choices and rights
You can ask to see, correct or delete your data, or withdraw consent, by writing to hello@roughwork.me (students can also ask their school). We'll reply within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India or your local data protection authority.
Cookies and storage
We use only what's needed: a sign-in cookie, and your browser's storage for settings like the chalkboard theme, sound and low-power mode. No advertising or tracking cookies, and no analytics that follow you to other sites.
Security
Data is encrypted in transit and at rest. Access is limited by role inside the database itself, so one school can never read another's data.
Changes
If we change this policy in a way that matters, we'll tell schools by email before it takes effect, and update the date above.
See also: Privacy policy · Terms of service · Questions: hello@roughwork.me