PRIVACY & DATA POLICY

Introduction

As M4TTBIT, I believe that your privacy is as important as the games and tools I build. I created this policy to explain exactly what information my site collects, how it keeps data safe, and how it protects children.

My main rule is simple: Only collect the minimum amount of info needed to make the site, games, and tools function. I do not sell your data, I do not use it for ads, and I do not use your chat messages to train AI models.

Section 1: Children’s Privacy (COPPA)

This section explains how I protect children under the age of 13.

• Neutral Age Gate: Before anyone can sign up for my AI chat, they must enter their birth year. I don't guess or pre-fill this for you.
• Registration without Email: Children can sign up using just a Nickname and a Password. I don't require an email address for kids to use the site.
• Automated Authorization (13+): Users 13 and older are automatically authorized to use the system immediately upon registration.
• Parental Consent: If a user is under 13, a parent or guardian must provide consent before the account is activated. This involves a parent verifying their identity so I know the permission is real.
• PII Scrubbing: I use an automated "scrubber" that removes names, emails, and phone numbers from chat messages before they are processed by my AI tools.

Section 2: School & Student Privacy (FERPA)

For schools and districts using my tools, I follow the Family Educational Rights and Privacy Act (FERPA).

• Direct Control: I acknowledge that schools and districts "own" the student data. I act as a "School Official" under their direct control.
• No Data Mining: I do not use student data to build marketing profiles or for any purpose other than providing educational services.
• NDPA Ready: I am willing to sign the National Data Privacy Agreement (NDPA) and support "Exhibit E" to make it easy for school IT departments to approve my site.

Section 3: Data Security & Rights (Indiana ICDPA)

In compliance with the Indiana Consumer Data Protection Act, I provide the following protections:

• Strong Encryption: I store data using AES-256 encryption (like a digital vault) and send data using secure TLS 1.3 connections.
• 72-Hour Breach Notice: If I ever discover that data has been accessed without permission, I will notify the affected school or user within 72 hours.
• AI Safety: My AI tools (Google Gemini API) are configured for "Enterprise" privacy, meaning your messages are not used to train global AI models.

Section 4: The Data Map (What's Collected)

Section 5: Your Rights

You have the right to see any data I have about you or your child and ask me to delete it. To make a request, or if you have any questions, please email me at: contact@m4ttbit.dev

Section 6: Google API Services & Workspace Data

R4Z integrates with Google APIs to provide advanced assistant features. I am committed to transparency regarding how this data is handled.

• Limited Administrative Access: Google Workspace integration (accessing Gmail, Calendar, Tasks, or Drive) is a restricted Administrative Tool. It is only accessible to the site administrator account for site management and debugging.
• No Access for General Users: Guest users, custom "Dev ID" sign-ups, and general Google-authenticated users cannot access Google Workspace features. R4Z does not access, collect, or store Google Workspace data for any user other than the site administrator.
• Data Usage: When accessed by the administrator, data is used solely to provide AI-assisted responses via the Google Gemini API (configured for Enterprise privacy). I do not use this data to train global AI models or share it with any other third parties.
• Storage & Protection: Authentication tokens are stored in a secure, encrypted Firebase instance.
• Compliance: My use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking Access: You can revoke this application's access at any time through your Google Account Security settings.

Section 7: Institutional Non-Affiliation & Student Data

This website, its interactive applications, games, and developer tools (including the R4Z AI assistant) are the independent personal creations of Matt Arnold. This domain is not affiliated with, authorized by, sponsored by, or integrated into the academic curriculum of Northwest Allen County Schools (NACS) or Carroll High School. No coursework, assignments, or student grades are hosted or managed on this site. In compliance with standard student privacy principles, this site does not collect, track, store, or sell Personally Identifiable Information (PII) or educational records.