Scool Privacy Policy

This Privacy Policy explains how Daniel Wagner, an individual doing business as Scool (“Scool,” “we,” “us,” or “our”), based in California, United States, collects, uses, shares, and protects information when you use our website, applications, and related services (the “Service”), including our learning-material generators (crosswords, word searches, quizzes, tracing sheets, and similar tools).

For the purposes of applicable data protection law (including the EU/UK GDPR), we are the data controller of the personal data described in this Policy, unless stated otherwise. This Policy is incorporated into, and should be read alongside, our Terms of Service.

This Policy applies to visitors, registered users, and, where applicable, individuals whose information is included in content that a user (such as a teacher or parent) enters into the Service.

Account information. Name, email address, password (hashed), language preference, and, for school/organization accounts, your organization’s name.

Content you provide. Words, topics, images, or other input you enter into a generator, the Materials you create, and any content you share via a link.

Payment information. For paid plans, billing name, address, and payment details — collected and processed by our third-party payment processor (e.g., Stripe); we receive only limited data such as the last 4 digits of a card and transaction status, not full card numbers.

Usage and device data. Pages viewed, features used, generator settings, approximate location (from IP address), device type, browser, operating system, and log data (IP address, timestamps, error logs), collected automatically.

Cookies and similar technologies. See Section 5.

Information from others. If you sign in via a third-party provider (e.g., Google), we receive the profile information that provider shares with us, per your settings with them.

We use the information we collect to:

1. Provide, operate, and maintain the Service, including generating and delivering your Materials.
2. Process payments, manage subscriptions, and send billing-related communications.
3. Create and secure your account, and provide customer support.
4. Send service-related communications (e.g., confirmations, security alerts, policy updates) and, where you have opted in, marketing communications and promo-code offers, which you can opt out of at any time.
5. Monitor, analyze, and improve the Service, including usage trends and new features.
6. Detect, investigate, and prevent fraud, abuse, and security incidents, and enforce our Terms of Service.
7. Comply with legal obligations and respond to lawful requests from authorities.

If you are in the European Economic Area or the UK, we rely on the following legal bases:

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We use cookies and similar technologies (local storage, pixels) to:

• Keep you signed in and remember your preferences (essential, cannot be disabled without breaking core functionality).
• Measure usage and improve the Service (analytics: Google Analytics, with Google signals and ad personalization turned off).
• Support payments and fraud prevention (functional).
• Where you consent, measure and personalize advertising or promotional offers (marketing, off by default).

If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask for your consent via a cookie banner before any non-essential cookie is set. Elsewhere, analytics is on by default and you can turn it off; we treat a Global Privacy Control signal from your browser as that choice. Functional and marketing cookies stay off everywhere unless you turn them on. We never load analytics on shared Materials pages (see Section 7). You can change your choice at any time on our Cookie Policy page. You can also block cookies in your browser settings, though this may affect functionality.

We do not sell your personal data. We share information only in these circumstances:

• Service providers / processors who perform services on our behalf (hosting, cloud storage, analytics, email delivery, customer support tools) under contracts requiring them to protect your data and use it only for the purposes we specify.
• Payment processors (e.g., Stripe) to process your payments.
• Shared content. If you create a public share link, the Materials at that link are accessible to anyone who has it; this is not “sharing” by us but a feature you control.
• Legal and safety reasons. To comply with a legal obligation, enforce our Terms, or protect the rights, property, or safety of Scool, our users, or the public, including responding to lawful government requests.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will notify you of any change in ownership or use of your personal data.
• With your consent. For any other purpose, with your consent.

The Service is directed at adults — teachers, parents, guardians, and school staff — who create learning Materials for use with children. We do not knowingly allow children under 13 (or the applicable age in your country) to create their own account or knowingly collect personal data directly from a child through account registration.

When an account holder enters a student’s name, initials, or other content into a generator or a shared Material, that information is provided and controlled by the account holder, who is responsible for ensuring they have the right to do so (e.g., as a parent, or under their school’s authority and any applicable consent from parents, such as under COPPA’s school-official exception in the US or equivalent frameworks elsewhere). We act as a processor of that content on the account holder’s behalf and do not use it to build advertising profiles of children or to market directly to children.

Shared Materials pages, which students may open to complete an activity, load no analytics or advertising scripts and set no non-essential cookies.

If we learn that a child has provided us with personal data directly in a way that violates applicable law (e.g., registered an account without the required consent), we will take steps to delete that information. Parents or guardians who believe their child has provided us personal data may contact us at privacy@moncat.app to request its removal.

Schools or organizations using the Service under a student-data agreement should refer to that agreement, which controls over this section where the two conflict.

We retain personal data for as long as your account is active and as needed to provide the Service. If you delete your account, we delete or anonymize your personal data within [e.g., 90 days], except where we must keep it longer to comply with legal, tax, accounting, or dispute-resolution obligations, or to enforce our agreements. Materials behind a public share link may remain accessible via that link until you delete them or your account, even if created some time ago.

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and hashed passwords. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If we become aware of a data breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), subject to legal exceptions.
• Restrict or object to certain processing, including processing based on legitimate interests or for marketing.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority (in the EEA/UK) or, for California residents, exercise rights under the CCPA/CPRA, including the right to know, delete, and opt out of “sale” or “sharing” of personal information — we do not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, contact us at privacy@moncat.app. We may need to verify your identity before acting on a request, and will respond within the time required by applicable law.

We may store and process information in countries other than your own, including the United States, which may have different data protection laws than your country. Where required, we use appropriate safeguards for such transfers, such as the EU Standard Contractual Clauses or an equivalent adequacy mechanism.

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, provide additional notice (such as email or an in-app notice) before the changes take effect. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

Daniel Wagner, doing business as Scool
Email: privacy@moncat.app

We have not appointed a Data Protection Officer or an EU/UK representative. If we do, their contact details will be listed here.