Privacy policy

The short version

• Students never create accounts and are never asked for an email, student ID, or any other identifier. They type a first name of their choosing and their answers — that’s all.
• Everything in a session — questions, names, answers, AI results — is automatically and permanently deleted once it is 7 days old.
• We use no cookies and run no analytics or advertising scripts.

What teachers provide

Creating a session stores your questions, any answer choices, and the optional expected answers you type. Sessions are not tied to an account; the only handle on a session is its URL, so treat the teacher link like a password.

To prevent abuse of a login-free service, the server that creates sessions computes a one-way salted hash of your IP address and browser user-agent string and keeps only that hash for rate limiting. The raw IP address and user-agent are never stored or logged, and the hash cannot be reversed into them.

What students provide

Students joining with a session code submit a display name and their answers (capped at 300 characters each). The name is whatever the student types — we recommend first names only — and it is scoped to that single session: names are never linked across sessions, joined to other data, or used for anything except showing the teacher who answered.

Nothing about a student’s device, location, or identity is collected when they submit.

AI grading

When a teacher closes a session and runs grading, the question text and the answer texts — never student names — are sent to a large language model via OpenRouter to produce verdicts, answer groups, and a class summary. The results are stored with the session and deleted with it. Please remind students not to include personal information in their answers.

Where data lives and when it dies

Session data is stored on Convex, the database platform that runs our backend. A job that runs every hour permanently deletes every session that has reached 7 days old — its questions, names, answers, AI verdicts, groups, and the shared results link. Deletion is automatic and unconditional; there is no archive and no recovery. Because the job runs hourly rather than continuously, a session may persist for up to an hour past the 7-day mark before it is erased.

Storage in your browser

We use no cookies. Two small pieces of data live only in your own browser and are never sent to us:

• On a teacher’s device, a list of recently created sessions (in localStorage) so you can find a session again if you close the tab.
• On a student’s device, a flag (in sessionStorage) remembering that they already submitted, so refreshing doesn’t resubmit.

Both can be cleared at any time through your browser settings.

Children's privacy

Exit Tickets is a tool for teachers, used by students in class under a teacher’s direction. It is designed to work without collecting personal information from students: no accounts, no contact details, no persistent identifiers, and a 7-day hard delete. Teachers should instruct students to enter first names only and to keep personal information out of their answers.

What we never do

• Sell, rent, or share session data with anyone.
• Use student answers to train AI models.
• Build profiles of teachers or students.
• Show ads or embed third-party trackers.

Changes and contact

If we change this policy, we’ll update this page and the date at the top. Questions? Email support@habident.com. See also our terms of service.