Privacy Policy for VelociGrader

Last Updated: July 15, 2025

Welcome to VelociGrader! This Privacy Policy explains how VelociPan ("we," "us," or "our") collects, uses, and discloses information when you use VelociGrader. The VelociGrader "Service" consists of our Chrome Extension and our secure backend services running on Google Cloud Platform, acting as a service provider to your educational institution.

Our core privacy principle is simple: We do not persistently store or sell your students' personal information or their work on our servers. All processing of student data occurs transiently within our backend service during a grading job. The only personal information we retain is related to your VelociGrader license and the secure, encrypted credentials needed to operate the Service on your behalf.

At a Glance: What We Do and Don't Do

We DO:

✅ Access your Google Classroom courses, assignments, and student submissions with your permission, using secure credentials.

✅ Send student work to Google's Gemini AI for grading from our secure backend service.

✅ Securely store your **encrypted** Gemini API key and Google refresh token in our database so our service can function. We cannot view your unencrypted keys.

✅ Store your email address and subscription status in our secure database to manage your license.

✅ Create a log of grading results as a Google Sheet in your own Google Drive.

✅ Process student data ephemerally (in memory on our server) to facilitate grading.

We DO NOT:

❌ Store or save any student names, emails, or submission content on our servers after a grading job is complete.

❌ See or store your unencrypted Gemini API key or Google credentials. They are always encrypted at rest.

❌ Share your student data with any third parties, other than sending it to Google's AI for evaluation.

❌ Claim ownership of any data from your Google Classroom or Google Drive.

❌ Use student data or submission content to train our own AI models.

1. Information We Collect

To provide the Service, we need to access or collect certain information. We categorize this information as follows:

a) Information You Provide Directly

• Google Account: To use the Service, you must authenticate with your Google Account via the Chrome Extension. When you first authorize the application through our web portal, we securely store an encrypted refresh token that allows our backend service to access Google APIs on your behalf. We use your Google email address as a unique identifier for your VelociGrader license.

• Gemini API Key: The Service requires you to provide your own API key for Google's Gemini AI. When you enter this key, it is immediately transmitted to our backend, encrypted using strong `aes-256-gcm` encryption, and stored in our secure database. It is only ever decrypted in memory on our server when needed to make an API call to Google's Gemini AI on your behalf.

b) Information We Access from Your Google Services (With Your Permission)

When you authorize VelociGrader, you grant our backend service permission to access the following data from your Google Account. This data is processed ephemerally and is not permanently stored on our servers.

• Google Classroom Data:

  • Your list of courses, course names, and course states.

  • Your assignments, including titles, instructions, max points, and attached materials.

  • Your assignment rubrics, including criteria and point values.

  • Your student rosters for selected courses, including student names and email addresses, to identify submissions and owners.

  • Student submissions, to retrieve the work that needs to be graded.

• Google Drive Data:

  • The content of student-submitted files (e.g., Google Docs, Slides, PDFs, images) attached to an assignment. This is necessary to provide the content to the AI for evaluation.

  • Permission to create, edit, and manage Google Sheets files in your Drive for the purpose of creating grading logs.

c) Information We Store About You (For Licensing)

To manage your subscription and operate the Service, we store a limited amount of information in our secure, developer-controlled Firestore database hosted on Google Cloud.

• User & License Information:

  • Your Google Email Address (as your User ID).

  • Your Google User ID (`sub`), used as the primary key for your data.

  • Your subscription status (e.g., "active", "trialing", "canceled").

  • Your plan details and the start and end dates of your subscription period.

  • Identifiers related to your transaction from our payment processor (e.g., Customer ID, Subscription ID).

• User Credentials (Encrypted):

  • Encrypted Gemini API Key: Your Gemini API key, encrypted at rest.

  • Encrypted Google Refresh Token: The token that allows our backend to securely access Google services on your behalf, encrypted at rest.

d) Information Processed by Third Parties

• Google's Gemini AI: When you initiate grading, our backend service sends the relevant student work content, assignment instructions, and rubric details to the Google Gemini API for processing. This is done using your API key. Please note that Google's use of data submitted to the Gemini API is governed by their API Additional Terms of Service and Privacy Policy. We recommend reviewing Google's policies for their specific data usage practices.

• Polar: We use Polar as our third-party payment and subscription management service. When you subscribe, we provide your email address to the processor to initiate checkout. Your payment details are provided directly to them and are not seen by us. We receive information back (like subscription status) via secure webhooks to update your license in our database.

2. How We Use Your Information

We use the information we collect and access for the following purposes:

• To Provide and Maintain the Service: To authenticate you, fetch your Classroom data, perform AI-powered grading on our backend, and post grades back to your Classroom.

• To Manage Your License: To verify your subscription status and provide access to the Service.

• To Communicate With You: To respond to your support requests or send important notices about the Service.

• For User-Controlled Logging: To create and populate a Google Sheet in your Google Drive with grading results.

• For Service Improvement: To analyze aggregate, de-identified usage patterns to improve the functionality and performance of the Service itself (excluding any student data or PII).

3. How We Share and Disclose Information

We do not sell, rent, or trade your personal information or student data for any purpose, including for targeted advertising or commercial profiling. We only share information in the following limited circumstances:

• With Google's AI Services: As described above, student work is sent from our backend to Google's Gemini API for grading, using your API key.

• With Our Payment Processor(s): We share your email to facilitate subscription purchases and management.

• For Legal Reasons: We may disclose information if required to do so by law or in response to valid requests by public authorities.

4. Data Storage, Security, and Retention

• Security: We use Google Cloud Firestore to store your license information and encrypted credentials, which benefits from Google's robust security infrastructure. Your Gemini API key and Google Refresh Token are encrypted at rest using industry-standard `aes-256-gcm` encryption before being stored in our database. They are only ever decrypted in memory within our secure backend environment when required to perform an action on your behalf.

• Data Retention: We retain your license and encrypted credential information in our Firestore database for as long as your subscription is active and for a reasonable period afterward for administrative and compliance purposes. You may request the deletion of your license and credential data by contacting us. Data stored in your own Google Drive (such as grading logs) is subject to your own management and deletion policies.

5. Your Data Rights and Choices

You have control over your information and can make the following choices:

• Revoke Access: You can revoke VelociGrader's access to your Google Account at any time through your Google Account security settings page. This will invalidate the refresh token stored on our server, and the Service will immediately stop functioning.

• Manage API Key: You can overwrite your saved Gemini API key at any time from the application's interface. You can also contact support to request the deletion of your encrypted key.

• Manage Log Files: You can delete any Google Sheets log files created by the Service directly from your Google Drive.

• Request Data Deletion: You can request the deletion of your license and all associated encrypted credentials from our database by contacting us at: Contact .

6. Children's Privacy (FERPA & COPPA)

VelociGrader is intended for use by teachers and other authorized educational personnel. It is not intended for direct use by children under the age of 13 outside of this educational context.

VelociPan operates as a "school official" (as defined by FERPA) or "service provider" to educational institutions, acting under the direct control and direction of the school/district. Our access to student information via Google Classroom is solely for the purpose of assisting the teacher in their grading workflow and is strictly limited to supporting authorized educational purposes.

We do not knowingly collect any personal information directly from children. In compliance with the Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and other applicable student privacy laws, we rely on the educational institution to obtain any necessary parental consents.

We commit to not using student personal information for any commercial purposes, including targeted advertising or building profiles for non-educational uses.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

8. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

VelociGrader

Contact