For District Partners - Classroom Token Hub

Overview

Thank you for your interest in Classroom Token Hub (CTH).

Classroom Token Hub is a teacher-developed classroom management system with a simulated economic model. It is designed to minimize data collection and keep each classroom’s data separate.

As a platform designed, hosted, and maintained by a full-time classroom teacher, we look forward to working with district partners to bring CTH to teachers and students.

This document provides an overview of the system’s design and data-protection measures for district review. Please contact us with questions about the current implementation.

For more details, please visit our official GitHub repository or see the full Privacy & Data Handling policy.

For questions about our security and privacy implementation, please contact us at security@classroomtokenhub.com.

1. Data Collection, Processing, and Storage

Classroom Token Hub strives to collect only the minimum data necessary to operate effectively while maintaining a strong teacher and student user experience. Sensitive user-provided information is never stored as plaintext. Where storage in readable form is required for functionality (such as display labels like student names), the data is treated as sensitive, encrypted, and remains strictly scoped to the class.

When a teacher creates a class, they will provide:

Teacher display name (for the app interface)
Class name or period identifier

When a teacher adds students to a class, they will provide:

Student first name: used for teacher roster display and student account claiming
Student last initial: used for teacher roster display and student account claiming
Optional notes: Encrypted and stored for teacher internal records only

Our server processes the information using the following approach:

Student names used for claiming: normalized and hashed using HMAC-SHA256 with a per-record salt and application secret. Used only for secure student account claiming and removed after successful account creation.
Student names used for display: encrypted individually with whitespace and special characters preserved. Used only for the teacher’s roster within that class and never transmitted to students or third parties.
Student notes: encrypted and stored for the teacher’s internal records. They are not displayed to students or other teachers.

2. Class-Level Data Isolation

Each class operates independently and has its own unique identifier. Students use a public join code to enter a class, while the application uses the class identifier to keep records scoped correctly.

No cross-class visibility or aggregation
Teachers can only access classes they create
Identical names across classes are treated as unrelated
The system does not maintain global student identity across classes
All financial, attendance, and activity data is strictly class-scoped

3. Student Account Claiming Process

When a student claims their account:

The student enters their first name and last initial, as provided by the teacher.
The system securely matches that information to the class roster.
If there is a unique match, the student creates a PIN and passphrase.
If there is more than one matching name, the student receives a random code to distinguish their account.
After the account is successfully claimed, the temporary claiming information is deleted.

4. What Data Is NOT Collected

Date of birth
Student ID numbers
Email addresses (for students)
Phone numbers
Physical addresses
Parent/guardian information
Government IDs or identifiers
Behavioral or disciplinary records
Grades or academic performance data

5. Data Lifecycle & Deletion

Class deletion removes all associated data (student records, transactions, activity logs)
Teacher deletion removes all classes and student data owned by that teacher
Individual student account deletion removes that student's data and history from the class
180-day inactivity on a class triggers automatic deletion
No archival or soft-delete exists; deleted data cannot be recovered

6. Authentication and Security

Teacher Authentication: Email and password, with required TOTP two-factor authentication (a time-based one-time password).
Student Authentication: PIN (4-6 digits, bcrypt hashed) and passphrase (for high-stakes actions only).
Account Recovery: Teachers can generate recovery codes for students. Recovery uses only join code and recovery code—no PII required. Passphrases are always required for high-stakes financial transactions.
Encryption in Transit: All data uses HTTPS/TLS encryption
Encryption at Rest: Student names and notes are encrypted by the application using Fernet-based encryption.
Session Management: HTTP-only cookies with automatic timeout after inactivity
CSRF Protection: All forms include CSRF tokens

7. Administrative Access Model

CTH does not provide a general "super admin" interface to browse or query student data across classes or teachers.

Teachers access only their own classes
System maintenance uses database-level access only (never application-level browsing)
Student names and sensitive fields are encrypted; infrastructure access does not decrypt them
No cross-class inspection or bulk export tools exist
Users are represented by pseudonymous identifiers in logs and reports

8. Application vs. Infrastructure Access

Application-level tools do not expose identifiable data. Infrastructure access is restricted to system maintenance only and does not have decryption keys for sensitive fields.

9. Single Sign-On (SSO) and Identity Federation

Classroom Token Hub intentionally does not federate identity through external identity providers (SAML, OpenID Connect, or district SSO). This design choice is made to maintain strict class-level isolation and minimize the collection of personally identifiable information. Because the goal of this application is for teachers to be able to manage their own classroom economy, we intentionally do not integrate external identity providers to truly achieve our ideal model of "we don't know you, we don't need to know you, we don't want to know you."

Districts that require SSO integration may choose to self-host and modify CTH to support their identity provider. The codebase is open-source under PolyForm Noncommercial 1.0.0 and available on GitHub. Please note that the Classroom Token Hub project is not responsible for forked projects, and any attempt to push changes upstream that do not conform with the project documentation will be rejected.

10. Compliance and Standards

FERPA (Family Educational Rights and Privacy Act)

Classroom Token Hub is designed to support school-administered educational records in a class-scoped environment. Teachers control access to their class data, and the system does not share student information with external parties.

COPPA (Children's Online Privacy Protection Act)

Classroom Token Hub is intended for use by teachers acting on behalf of their classes under the school consent model. Parental consent is managed through school and district policies, not directly by CTH.

State Privacy Laws (CCPA, FERPA-adjacent state laws)

CTH is designed to minimize data collection and retention, supporting compliance with state-level privacy requirements. No data is sold, shared with third parties, or used for purposes beyond classroom operation.

Accessibility (WCAG)

The application follows accessibility principles and aims to meet WCAG 2.1 Level AA wherever practical.

11. Financial Data and Economic Activity

Transaction history is stored class-scoped and tied to student seats (not names)
Account balances are calculated from transaction history
Financial records are protected according to the application’s encryption controls
Simulated currency has no real monetary value
No integration with real payment systems or banks

12. What CTH Does Not Do

No advertising or data selling
No third-party analytics or tracking
No behavioral profiling or data mining
No cross-class tracking or aggregation
No integration with external identity systems (SSO) by default
No long-term data retention beyond active class lifecycle
No integration with government or district ID systems

Contact Information

For district partnership or compliance inquiries, please reach out to support@classroomtokenhub.com. For security review questions, please contact security@classroomtokenhub.com.