Third-Party Services
Last Updated: March 8, 2026
We use a small number of trusted services to run Classroom Heroes. Each one is listed below with exactly what data they receive and why. None of these services receive student data for their own commercial purposes.
Summary
| Service | What They Do For Us | What Data They Get | Do They Store It? |
|---|---|---|---|
| Supabase | Database and teacher login | All student and teacher data | Yes |
| Vercel | Website hosting | IP addresses, request logs | Yes (server logs) |
| Sentry | Error monitoring | Error reports (no personal data) | Yes (error reports only) |
| Upstash | Rate limiting | Anonymous counters only | Yes (temporary counters) |
| Vimeo | Video delivery | Video view events | Minimal (dnt=1 set) |
| YouTube | Video delivery | Video view events | Yes (standard YouTube) |
| Google Fonts | Icon typography | IP address (font request) | No |
Supabase
Category: Database and Teacher Authentication
Supabase is our primary database. It stores all student data (first names, learning progress, quiz scores, game scores, badges, and avatar choices) and all teacher accounts. Teacher authentication (email and password login) is also handled by Supabase.
Supabase hosts a PostgreSQL database with row-level security policies that restrict access so teachers can only see data for their own classes.
Security commitment: SOC 2 Type II certified.
Privacy policy: supabase.com/privacy
Vercel
Category: Application Hosting
Vercel hosts the Classroom Heroes website. When anyone visits the site, Vercel receives their IP address and request timestamps as part of standard server logs. These logs are managed by Vercel and are not used by Classroom Heroes for tracking purposes.
What they store: Server logs with managed retention.
Security commitment: SOC 2 Type II certified.
Privacy policy: vercel.com/legal/privacy-policy
Sentry
Category: Error Monitoring
Sentry helps us find and fix errors in the application. When something goes wrong, Sentry receives an error report with a stack trace and breadcrumbs (a log of recent actions that led to the error).
We strip all personal information before sending error reports to Sentry. No email addresses, usernames, or IP addresses are included. Sentry receives error reports only, not student data.
What they store: Error reports with no personal data.
Privacy policy: sentry.io/privacy
Upstash
Category: Rate Limiting
Upstash provides the rate limiting service that prevents abuse. It tracks how many times someone tries to log in or submit a form within a time window. If someone tries too many times too quickly, they are temporarily blocked.
Upstash receives anonymous request counters only. No personal data (names, emails, or student information) is sent to Upstash.
What they store: Temporary counters that expire automatically.
Privacy policy: upstash.com/trust/privacy
Vimeo
Category: Video Delivery
Vimeo hosts and delivers episode videos that students watch as part of the curriculum. When a student watches a video, Vimeo receives video view events.
We set the Do Not Track flag (dnt=1) on all Vimeo embeds. This tells Vimeo to minimize tracking and not use cookies for advertising purposes.
What they store: Minimal data due to dnt=1 flag.
Privacy policy: vimeo.com/privacy
YouTube
Category: Video Delivery
Some episode videos are hosted on YouTube. When a student watches a YouTube-hosted video, YouTube receives video view events and may apply standard YouTube tracking.
What they store: Video viewing data under standard YouTube practices.
Privacy policy: policies.google.com/privacy
Google Fonts
Category: Icon Typography
We load icon fonts from Google Fonts to display interface icons. When the page loads, the browser makes a standard web request to Google's CDN (content delivery network) to download the font files. This request includes the user's IP address, which is standard for any web request.
Google Fonts is a CDN delivery service only. No data is stored by Google Fonts beyond what is needed to serve the font files.
What they store: Nothing. CDN delivery only.
Privacy policy: policies.google.com/privacy
No Advertising or Marketing Services
Classroom Heroes does not use any of the following:
- Ad networks or advertising platforms
- Analytics trackers (no Google Analytics, no Mixpanel, no Amplitude)
- Marketing platforms or email marketing services
- Social media pixels or tracking scripts (no Facebook Pixel, no Twitter tags)
- Data brokers or data enrichment services
- AI training data providers
The seven services listed above are the only third-party services that Classroom Heroes uses. If we add a new service in the future, we will update this page and our privacy policy before using it.