Skip to main content
← Back to home

Privacy Policy

Effective Date: March 1, 2026 · Last Updated: March 11, 2026

1. Introduction

Crucible Cases LLC ("Company," "we," or "us") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Crucible Cases platform ("Service").

2. Information We Collect

We collect the following categories of information:

2.1 Account Information

  • Full name, email address, and institutional affiliation
  • Account role (student or instructor)
  • Authentication credentials (stored securely by our auth provider)

2.2 Educational Data

  • Conversation transcripts from simulation interactions
  • Course enrollment records
  • AI-generated analytics (engagement scores, sentiment, strategy tags)
  • Simulation completion records and turn counts

2.3 Technical Data

  • IP address and browser information (for security and rate limiting)
  • Usage timestamps and session data

3. How We Use Your Information

  • To provide and operate the simulation platform
  • To generate educational analytics and feedback for students and instructors
  • To enable instructors to monitor student progress and assign grades
  • To maintain security and prevent abuse (rate limiting, content monitoring)
  • To improve the quality and effectiveness of our simulations
  • To comply with legal obligations, including FERPA requirements

4. FERPA Compliance

We recognize that student data collected through the Service may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. We comply with FERPA in the following ways:

  • We act as a "school official" with a "legitimate educational interest" when processing data on behalf of educational institutions
  • We enter into Data Processing Agreements (DPAs) with institutions that outline data handling obligations
  • Student data is accessible only to authorized instructors for the courses in which the student is enrolled
  • We do not use student education records for advertising or marketing purposes
  • Students may exercise their right to access, export, and request deletion of their data

5. Data Sharing

We do not sell your personal information. We share data only in the following circumstances:

  • With instructors: Student transcripts and analytics are shared with instructors of courses in which the student is enrolled
  • With AI providers: Conversation messages are sent to Anthropic's Claude API for AI response generation. Anthropic does not use this data for training purposes per our agreement
  • With service providers: We use third-party services for hosting (Vercel), database (Supabase), payment processing (Stripe), and rate limiting (Upstash). Each provider processes data only as necessary to provide their service
  • As required by law: We may disclose data in response to valid legal process

6. Data Security

We implement the following security measures:

  • Encryption in transit (TLS/HTTPS) and at rest
  • Row-level security policies in our database
  • Rate limiting to prevent abuse
  • Input sanitization and prompt injection detection
  • Output monitoring to prevent inadvertent data leakage
  • Role-based access controls (student, instructor, admin)
  • Audit logging of administrative actions

7. Your Rights

You have the following rights regarding your data:

  • Access & Export: You can export all of your data at any time through your account settings or the data export API
  • Deletion: You can request deletion of your account and anonymization of your data through the self-service account deletion feature
  • Correction: You can update your profile information at any time through your account settings
  • Portability: Your data export is provided in a standard JSON format that can be used with other systems

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Conversation transcripts and analytics are retained for the duration of the course plus one academic year, unless a longer retention period is required by your institution's policies or applicable law. After account deletion, personally identifiable information is anonymized, but anonymized records may be retained for aggregate analytics purposes.

9. AI & Automated Processing

We use Anthropic's Claude AI to generate conversational responses and analytics. AI-generated analytics (sentiment analysis, strategy detection, engagement scoring) are used for educational feedback purposes only. These analytics are advisory in nature and should not be the sole basis for academic evaluation. Instructors have access to full transcripts to make their own assessments.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.

12. Contact Us

For questions about this Privacy Policy or to exercise your data rights, please contact us at privacy@cruciblecases.com.

Crucible Cases LLC
Attn: Privacy Team