Privacy Policy
Last updated: July 7, 2026
Cobalt Science ("we," "us") is operated by Gravitas Publications, Inc., the publisher of Real Science-4-Kids. Cobalt Science provides open-and-go K–5 science lessons with progress tracking for schools, districts, and homeschool families at cobaltscience.com. This policy explains what we collect, why, and how we protect it — with special care for student data, because every Cobalt student is an elementary-age child.
The short version
- We collect the minimum data needed to teach and to show teachers progress — and nothing else.
- We never collect a student's legal full name, gender, birthdate, address, phone number, photo, or parent contact information. Our database has no columns for them.
- No advertising, no trackers on student pages, no selling or renting data — ever.
- Schools and districts can request deletion of their data at any time; we delete within 60 days.
What we collect from students
This table is exhaustive — if it isn't listed here, we don't collect it from students.
| Data | Why |
|---|---|
| A pseudonymous internal ID | Created by us; meaningless outside Cobalt Science. |
| A display label entered by the teacher (e.g., "Mia R.") | So the teacher can recognize the student. We never require a legal name. |
| Grade level and class membership | To show the right lessons at the right reading level. |
| A password (stored only as a secure hash) | For class-code sign-in. Teachers can reset it. |
| School-issued email (optional; encrypted at rest) | Only if the school chooses email or single sign-on for students. Younger classes typically use class code + password, with no email at all. |
| Sign-on identifiers from the school's provider (e.g., Google or Clever ID) | Only if the school enables single sign-on; these are pseudonymous IDs, not profiles. |
| Learning activity: lesson progress, quiz answers (multiple-choice selections only), time on lesson, whether the video was watched or the worksheet downloaded, and one-tap lesson reactions (👍 / 😕) | This is the product — it powers the teacher, school, and district dashboards. Reactions are reported only in aggregate. Students cannot enter free text. |
Children's privacy (COPPA)
For school and district accounts, we operate under the school-consent model of the Children's Online Privacy Protection Act: the school consents on parents' behalf, and in return we use student data solely to provide the educational service, make no commercial use of it (no ads, no marketing to students, no profiling beyond instruction), and honor retention limits and deletion requests. Under FERPA, we act as a "school official" under the school's direction and do not re-disclose education records.
For homeschool family accounts, the parent or guardian is the account holder and provides direct parental consent when adding their own children, acknowledged during signup.
What we collect from teachers, parents, and administrators
Name, email address, school/district affiliation, and account activity needed to run the service. Purchases are processed by Shopify — payment card details never touch our systems; we receive only the buyer's email and order reference to activate the license.
What we never do
- No advertising anywhere in the product, and no third-party trackers, analytics pixels, or session recording on student pages. Video embeds are set to "do not track."
- No selling, renting, or trading of any user data.
- No behavioral profiling of students beyond the lesson context.
- No student-to-student messaging and no external links on student pages (other than the lesson video).
Service providers (subprocessors)
We use a small set of vendors to run the service: Cloudflare (hosting and data storage), Vimeo (video delivery, do-not-track mode), Resend (sign-in and report emails), DeepL (translation of lesson content only — never student data), and Sentry (error monitoring, scrubbed of personal information). We update this list before adding any new vendor.
Security
All traffic is encrypted in transit (TLS). Student emails, where they exist, are encrypted at rest. Passwords are stored only as secure hashes. Access is scoped server-side: teachers see only their classes, school admins only their school, district admins only their district.
Retention and deletion
We retain data only as long as needed to provide the service. On contract end or at a school's or district's request, we export their data on request and delete it within 60 days. Parents on family accounts can request deletion of their family's data the same way.
Your rights and contact
Schools, districts, and parents may review, correct, export, or delete their data by contacting us at privacy@cobaltscience.com. We are ready to sign student data privacy agreements (including SDPC/NDPA forms with state exhibits) with schools and districts.
Changes to this policy
If we make material changes, we will notify account holders by email and update the date at the top of this page.