Effective date: August 11, 2026
This policy describes how Birdflop (a 501(c)(3) nonprofit, EIN 93-2401009, based in the United States) handles personal data when you use CS Room. For our terms of use, see the terms of service.
The data controller for CS Room is Birdflop. For privacy questions and to exercise the rights listed in §6, write to [email protected].
We have not appointed a Data Protection Officer or an EU/UK representative. EU and UK users can write to the address above for any matter that would otherwise be handled by a representative.
When you sign in, we receive and store from your identity provider:
If you sign in with an email address and password instead, we store a one-way hash of your password, never the password itself. We cannot read it or recover it for you.
While you use CS Room, we also store:
If you are a teacher applying for access, we also store:
Our web servers automatically log each request: the requester's IP address, browser user-agent string, URL, referring URL, and a timestamp.
Your browser also reports a small number of round-trip-time measurements (one per region on your first visit per session, along with your browser's reported timezone and the page you were on). We use these to decide which region to host your container in.
We process your personal data on the following bases:
CS Room is used by school students, some of whom are under their country's digital-consent age (16 in much of the EU unless a member state has lowered it, 13 in the UK, US, Switzerland, and Kenya).
For students under that age, we rely on consent given through the student's teacher: when a teacher enrolls students on CS Room, they confirm they have the authority and any parental consent required by the school's policies or local law. In the United States this is the school-consent route the Children's Online Privacy Protection Act (COPPA) allows for services used solely for an educational purpose. See §11 for the commitments we make to schools.
Outside of an approved educational context, we do not knowingly collect personal data from children under 13. Tell us at the address in §1 if you become aware of such an account and we will delete it.
The table below lists every cookie and persistent browser-storage entry that CS Room sets or causes to be set.
| Name | Purpose | Duration | When set |
|---|---|---|---|
| session | Keeps you signed in | 30 days | Strictly necessary |
| csroom:analytics-consent | Remembers your analytics consent choice | Persistent (localStorage) | When you click the banner |
| csroom:open-folders | Remembers which folders are expanded in your file tree | Persistent (localStorage) | Strictly necessary (UI state) |
| _ga, _ga_* | Google Analytics — distinguishes visitors and sessions | Up to 2 years | Only after you accept analytics |
| _gcl_* | Google Ads — attributes signups back to the ad that brought you here | Up to 90 days | Only after you accept analytics |
Umami counts aggregate page views without cookies and without retaining identifiers, so it runs without a consent banner.
Visitors outside the United States see a consent banner. Google Analytics and Google Ads tags load only after you click Accept. Visitors in the United States do not see the banner; the tags load by default. You can opt out by emailing us, installing Google's Analytics opt-out browser add-on, or sending a Global Privacy Control signal.
Google Analytics and Google Ads tags are not loaded on authenticated pages. Once you sign in, no data about your activity is sent to Google.
You can change your analytics choice at any time by clearing the csroom:analytics-consent entry from your browser's storage for csroom.org, or by emailing us to do it for you.
When you accept analytics, Google receives your IP address, device and browser type, pages viewed, and approximate location derived from your IP. Google handles this data under its privacy policy.
We do not sell personal data, do not engage in cross-context behavioral advertising, and do not share data with data brokers.
You have the right to:
To exercise any of these rights, email [email protected] from the address associated with your account. We respond within 30 days; complex requests can take up to 90, and we will tell you if that is the case.
We do not yet provide a self-service export or delete button; both actions are available on request by email.
CS Room runs in two regions: the United States (New York) and the European Union (Helsinki, Finland). When you first use the IDE, your browser measures the round-trip time to each region and we pin your account to whichever region is closest. Your User record, files, class data, and subdomain claims then live on that region's servers. The pin is sticky — we do not move you between regions on our own.
By creating an account, you consent to your personal data being transferred to and processed in whichever of these regions serves you. To withdraw consent, ask us to delete your account.
For users in mainland China, this consent is the lawful basis for the cross-border transfer under the Personal Information Protection Law (PIPL). See §14 for the categories transferred, the likely destination region, and how to exercise your PIPL rights.
We share personal data with the following providers:
Umami analytics is self-hosted by Birdflop; no third party processes that data.
We require every provider that handles data on our behalf to protect it on terms no less protective than the ones we owe you, and never to sell it. Where a school has signed a data privacy agreement with us (§11), those providers are bound to the standard that agreement sets.
We do not sell personal data and do not share it for advertising purposes beyond the conversion measurement described in §5.
We keep your account, files, and class records until you ask us to delete them. We do not delete inactive accounts. Once you ask, we remove your data within 30 days.
Where a school controls the account, the school can also direct us to delete or return its student data. We act on that direction within 60 days, or sooner if our agreement with the school says so, and we do the same when an agreement with a school ends. Our retention and deletion practices are available to schools on request.
Server access logs are kept for approximately 30 days.
Google Analytics data is kept for approximately 14 months (Google's default).
We protect your data with HTTPS, per-user container isolation, restricted administrator access, and host-level firewalling between user environments. We will notify regulators and affected users in the event of a personal-data breach.
Access to production systems is limited to a small number of Birdflop administrators, each bound by a confidentiality obligation. We review our administrative, physical, and technical safeguards at least once a year and again after any confirmed breach, and we maintain a written incident response plan. Schools can request a summary of that plan and of our most recent review, subject to reasonable redaction.
This section applies when a school, district, or other local education agency (LEA) provides CS Room to its students. Everything below applies whenever that is true, whether or not we have signed a separate agreement with the school. A signed agreement adds to these commitments and controls if the two ever differ.
Data privacy agreements. Where an LEA signs a data privacy agreement with us, including the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA), that agreement governs our handling of student data and takes precedence over this policy and over our terms of service wherever they differ.
School official status. In providing CS Room to an LEA we act as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)(i)(B)). We perform a function the LEA would otherwise perform itself, we are under the LEA's direct control with respect to student data, and we are subject to the limits on re-disclosure in 34 CFR § 99.33(a).
Ownership. Student data, including the work students create in CS Room, remains the property of and under the control of the LEA. We claim no ownership of it, and copies we hold are subject to the same terms as the original.
Use limits. We use student data only to provide the services the LEA has contracted for, or as the LEA instructs. We do not sell student data. We do not use it for targeted advertising and do not disclose it to anyone for that purpose. We do not use it to build a profile of a student, a family member, or a group for any purpose other than providing the service. As stated in §5, no advertising or analytics tag loads on a signed-in page, so no student activity in CS Room reaches Google.
Deidentified data. We do not attempt to re-identify data we have deidentified. Where we use deidentified data to improve CS Room, we do not name an LEA in anything we publish without that LEA's written approval.
Parent and student requests. If a parent, legal guardian, or eligible student asks us directly to review, correct, export, or delete student data, we refer them to their school, which holds the records and the procedure for handling the request. We respond to an LEA's own request to access, correct, or export student data within 30 days, or sooner where state law gives the LEA a shorter deadline. Nothing here stops a student from downloading or exporting their own work from CS Room directly.
Deletion. We delete or return an LEA's student data on the LEA's written request, and on termination of our agreement with the LEA, within 60 days or on whatever schedule the agreement sets. See §9.
Subprocessors. Every provider we use that can reach student data is bound to protect it on terms no less stringent than the commitments in this section and in any agreement we have signed with the LEA, and is prohibited from selling it. Our current providers are listed in §8.
Where student data is stored. Accounts are pinned to the region with the lowest measured latency, as described in §7. In practice, users in the United States are pinned to our New York region, so a US school's student data is stored in the United States. We will confirm the storage location for a given LEA in writing on request, and we will not move an LEA's data to another country without telling the LEA first.
Breach notice. If we confirm a breach affecting a school's student data, we notify that school within 72 hours of confirmation, unless a law enforcement investigation requires us to wait. The notice tells the school what happened, when, which categories of data were involved, and who was affected, to the extent we know it. Where we have signed an agreement with the LEA, notice goes to the representatives named in it. The safeguards behind this are described in §10.
To request a data privacy agreement, or to ask about an existing one, write to [email protected].
CS Room does not make decisions about you through solely automated means. Grading features assist teachers but do not replace their judgement.
California residents have the right to know what personal information we collect, to request deletion or correction, and to opt out of any sale or sharing. We do not sell or share your personal information. To exercise these rights, email us at the address in §1. We will not retaliate against you for doing so.
If you use CS Room while in mainland China, the Personal Information Protection Law (PIPL) applies to our processing of your personal information.
Lawful basis. We rely on (a) the necessity of processing to provide CS Room to you (PIPL Art. 13(1)(2) — performance of a contract) and (b) your separate consent for the cross-border transfer described below.
Cross-border transfer. CS Room is hosted in the United States (New York) and the European Union (Helsinki, Finland); each account is pinned to one region based on network latency (§7). Users connecting from mainland China are typically pinned to Helsinki because the round-trip time is shorter than to New York. To use the service we transfer the categories listed in §2 — account identifiers, name, email, profile picture if your identity provider supplies one, files you upload or create, class membership and grades, subdomain names, request logs, and the round-trip-time measurements your browser reports — to whichever region serves you and to the sub-processors listed in §8. By creating an account you give your separate consent to this transfer; you can withdraw it at any time by asking us to delete your account.
Sensitive personal information. We do not collect biometric data, financial-account information, health or medical data, precise geolocation, or religious beliefs that would qualify as PIPL "sensitive personal information."
Your rights. You have the rights set out in §6 (access, correction, deletion, a machine-readable copy, restriction of processing, objection, and withdrawal of consent). You also have the PIPL right to obtain an explanation of our processing rules. To exercise any of these rights, email [email protected] from the address associated with your account. We respond within 30 days.
Complaints. You can lodge a complaint with the Cyberspace Administration of China (cac.gov.cn) or with your provincial cybersecurity and informatization department. You can also write to us first.
We may update this policy from time to time. The effective date at the top reflects the most recent revision. For material changes — such as a new category of data, a new sub-processor, or a change in the lawful basis for processing — we will give reasonable advance notice, for example by email to account holders or via a notice in the application.
Privacy questions and rights requests: [email protected]. For all other questions about CS Room, write to [email protected].
Birdflop is a registered 501(c)(3) nonprofit organization. EIN: 93-2401009.