No student names. No trackers.

• A generated codename. Students never type their own name.
• Progress in each course: quests, practice and skills.
• A scrambled copy (a hash) of the five ticket words, so the same words open the save on another device.
• The class the student asked to join, and whether the teacher accepted them.
• Whether later acts are unlocked for that save.
• How many sign-ins had a misspelled ticket word, and whether easier reading (a little more space in the text) is on. The misspelled words never leave the browser. The teacher of the class can see this and turn it off or on.
• A parent email, only if a parent pass carried one. It is used for lost-ticket mail and nothing else.

The browser also keeps a copy of the save in its local storage, so play keeps working when the server cannot be reached.

• An email, a display name, and a scrambled password (or the Google account id, with Google sign-in).
• Classes, their codes, and the pass count.

Teachers get a welcome note and, at most once an hour, a note when students are close to Act 2.

• The IP address of each ticket sign-in attempt, to stop guessing. It is deleted after 24 hours.
• Check results with no account attached: which step, pass or fail, and the kind of error. They help fix broken steps and are deleted after 30 days. No code, ticket words or codenames are kept with them.

• Student names, emails, photos or school accounts.
• Tracking cookies, advertising ids, or analytics from other companies.
• Requests to font services. Fonts are served by Pramondo, so no student IP address goes to Google Fonts.

Questions from schools are answered on the schools page.