Privacy Policy

Last updated: August 25, 2026

SurveyorSim is a browser-based land surveying simulator with an optional classroom tier for instructors and their students. This policy describes exactly what we collect, why, and what we will never do with it. It is written to be read, not skimmed — it is short because we collect very little.

The short version

• Students never give us an email address, a date of birth, or any contact information. An instructor may optionally add a student's email address so we can send that student their own sign-in code — it is never required, never shown to other students, and it is deleted with the roster row.
• A student is a display name chosen by their instructor — nicknames are fine and encouraged — plus an 8-character sign-in code their instructor issues them, and a PIN of their own choosing that we store only as a cryptographic hash. The code and the PIN together are how they sign in; the code is the half their instructor can look up and re-issue, the PIN is the half nobody but the student knows.
• We show no ads, use no analytics or tracking, and never sell, rent, or share data with anyone for any commercial purpose.
• Instructors can delete a student, a class, or their entire account at any time, and deletion is immediate and permanent.

What we collect

We never ask a student for an email address, a date of birth, a photo, a location, or any contact information, and there is no field anywhere in the product where a student can enter them. The one optional exception is instructor-supplied: a teacher may add a student's email address to the roster so the service can send that student their own sign-in code. It is optional per student, used for nothing else, never shown to classmates, and deleted with the roster row. Classes work end to end with no addresses at all — the codes can simply be printed and handed out. Instructors are invited to use nicknames or aliases on rosters — the service never needs legal names.

What we never do

• No advertising, and no data use for advertising of any kind.
• No sale, rental, or trade of any personal information — ever, including in bankruptcy or acquisition, except as a continuation of this same policy by a successor bound by it.
• No profiling, no building of student profiles for any purpose other than showing coursework to the student and their instructor.
• No redisclosure of school-provided information to third parties, except the service providers below acting on our instructions.
• No third-party analytics, tracking pixels, or advertising cookies. Sign-in state is kept in your browser's local storage and sent only to our own API.

For schools: the school-official basis (FERPA)

Where a class roster comes from an educational institution's records, SurveyorSim operates as a school official with a legitimate educational interest under 34 CFR §99.31(a)(1):

• We use education records solely to provide the service to that class — no other purpose.
• The institution (through its instructor) retains direct control: instructors can view, export, correct, and permanently delete every piece of their class's data from inside the product, without asking us.
• We do not redisclose education records.
• On request of the instructor or institution, or on account termination, we delete the data — see Retention below.
• If we ever have reason to believe student data was acquired by an unauthorized party, we will notify the affected institution without unreasonable delay.

For Texas schools: the Student Privacy Act

Where a Texas school district uses SurveyorSim for a school purpose, we act as an operator under Texas Education Code, chapter 32, subchapter D (HB 2087, in force since 1 September 2017). We hold to it as policy whether or not a particular district asks:

• No targeted advertising (§ 32.152(a)(1)). There is no advertising in this product at all, so there is nothing here to target.
• No student profiles (§ 32.152(a)(2)) beyond the school purpose the work was done for — showing a student's coursework to that student and their instructor, and nothing else.
• No sale or rental of covered information (§ 32.152(a)(3)), including in an acquisition: a successor is bound by this same policy.
• Reasonable security (§ 32.155(a)) — TLS in transit, argon2 hashes for every password and every student PIN, and accounts that lock after repeated failed sign-ins. A student's 8-character sign-in code is deliberately stored in readable form so their instructor can reprint or re-send it; it is only ever half of a sign-in, and resetting a student's PIN also replaces the code, which revokes any slip already handed out.
• Deletion on request (§ 32.156). The statute allows 60 days. An instructor can delete a student, a class, or the entire account from inside the product, and that deletion is immediate and permanent; a district that would rather ask us directly gets it done within 30 days.

We collect almost none of the covered information a district usually worries most about: no date of birth, no demographics, no attendance, conduct, health or transcript records, and no parent or guardian contact details. There is no field anywhere in the product that asks for them. The single exception is an OPTIONAL student email address, which only an instructor can enter, which exists solely so the service can send that student their sign-in code, and which a class never has to use at all.

If your district requires a signed data privacy agreement before a tool may touch student records — the Texas Student Data Privacy Agreement (TX-NDPA), or your own — write to us and we will work through it with you.

Age

SurveyorSim is built for college and career-technical surveying programs. It is intended for users 13 and older, or younger students only where a school has authorized use under its own authority consistent with COPPA guidance. We do not knowingly collect personal information from children under 13 outside that school authorization, and we collect no birth dates from anyone.

Service providers

These are every third party your browser or our server contacts. The first two hold account data on our instructions; the rest are network services that see an IP address and nothing about who you are.

• Render (US region) hosts the application and database.
• Resend delivers instructor account-verification and password-reset emails; a short internal notice to us when a new instructor account is created, carrying that instructor's own email address and nothing else; and — only where an instructor has chosen to add student addresses — the message that gives a student their own sign-in code. That last message carries the student's name and code and nothing else: no grades, no coursework, no other student's data. No student data is ever sent to us in a notification.

Multiplayer crews connect browser-to-browser (WebRTC). Two kinds of helper are involved, and neither is used at all if you play solo:

• Signaling — the introduction step that lets two browsers find each other. Every session — classroom crews and free play alike — uses our own signaling server on api.surveyorsim.com; no third-party broker is contacted. A broker sees the random session code and your network address; coursework does not travel through it.
• Relay — used only when a network blocks direct connections (school Wi-Fi, a phone on cellular). We mint short-lived credentials for Cloudflare's TURN service — for classroom sessions and for free play — and your session traffic is forwarded through it. That traffic is encrypted end to end between the two browsers (DTLS), so a relay passes it along without being able to read it. When no relay is configured, the only thing contacted is Cloudflare's public STUN service, which tells your browser its own public address and carries no session traffic at all.

The optional real-world site picker involves two different kinds of request, and the distinction matters for what anyone can see:

• From your browser — OpenStreetMap supplies the map imagery you scroll (tile.openstreetmap.org) and the place search you type into (nominatim.openstreetmap.org). These see your IP address the way any website you visit does.
• From our server, not your browser — the terrain and map features for the site you pick are fetched by us from our own middleware service at scene.surveyorsim.com, which reads public map and elevation data. Your browser never contacts it, so that service sees our server's address rather than yours.

No account, roster, or coursework data is sent to any of them — only the coordinates of the place being loaded.

Where we operate

SurveyorSim is built, hosted, and offered in the United States. The application and its database run in a US region; the product is in English, defaults to US survey feet, and is aimed at US college and career-technical surveying programs. We do not direct it at, advertise it in, or seek users from the European Economic Area, the United Kingdom, or Switzerland — and we monitor no one's behaviour anywhere, because there is no advertising, no analytics, and no tracking in this product at all.

If your institution is in the EEA, the UK, or Switzerland and wants to use SurveyorSim with students, write to us first at rickasmith@gmail.com, so the right agreement is in place before any student data exists.

Retention and deletion

• Data is kept while the owning account or class exists, and no longer than needed to provide the service.
• Removing a student from a roster immediately and permanently deletes their sign-in — including their code and any email address on file — along with their coursework, field book, and grades.
• Deleting a class immediately and permanently deletes its roster and every student's work in it.
• Deleting an instructor account immediately and permanently deletes everything that account owns.
• Residual copies in the host's encrypted database backups age out on a rotation measured in days, not months.

Security

All traffic is encrypted in transit (TLS). Passwords and student PINs are stored only as argon2 hashes and cannot be recovered — only reset. A student's 8-character sign-in code is the one deliberate exception: it is stored readably, because an instructor has to be able to look it up and hand it over again when a student loses the slip it was printed on. That is safe by design rather than by accident — the code alone opens nothing, since signing in also needs the PIN, and resetting a PIN issues a new code, which stops the old one working. Accounts lock after repeated failed sign-ins. The single most effective protection is structural: we minimize what exists to breach — no legal-name requirement, no payment card data (there are no paid checkout flows in the product today), and student email addresses only where an instructor deliberately added one.

Changes and contact

If this policy changes in a way that affects student data, we will post the change here with a new date, and material changes will be announced to instructors on sign-in. Questions, deletion requests, or institutional agreements: rickasmith@gmail.com.