RaidBox — Privacy Policy

Effective date: 9 November 2026

RaidBox ("the service") is a free classroom quiz and arcade game for teachers and their students. It is published by ConeM Labs ("we", "us"). It runs as a website at raidbox.conemlabs.com and as apps for iOS and Android. Contact: support@conemlabs.com · https://conemlabs.com

This policy is published at https://conemlabs.com/raidbox/privacy. It describes what the service actually stores today. Teachers, schools and parents can also read the shorter Student Data Notice, which covers students only. Where something is not built yet (for example automatic deletion), we say so.

Summary

• Teachers sign in with Google or Apple. We store the account ID the provider gives us, your email address (if the provider shares it) and a display name.
• Students never create an account. They join a game with a PIN and a nickname, or pick their name from a class list that their teacher typed in. We never ask students for an email address, phone number or password.
• Quizzes, game results, answers (including written answers), class lists and homework are stored on Cloudflare, which hosts the whole service.
• Some text and images are processed by AI models that Cloudflare runs for us (Workers AI): marking written answers, translating questions, writing and checking quizzes, and automatically checking quizzes before they can be shared. Cloudflare does not use this content to train AI models.
• There are no ads, no third-party analytics and no tracking in RaidBox. We don't sell or rent data, and we don't build advertising profiles.
• RaidBox is meant to be used under a teacher's direction. The teacher or school decides to use it with students and provides any consent that students' parents or guardians need to give (see section 9).
• Data is kept until it is deleted. Teachers can delete quizzes, classes, students and homework in the app. There is no automatic deletion schedule yet and no in-app account deletion yet: email support@conemlabs.com and we will delete your account and data.

1. Teacher accounts

To create quizzes, host games, run classes or set homework, a teacher signs in with Sign in with Apple or Google Sign-In. The provider confirms who you are and gives us:

• a stable account ID for your Apple or Google account (we never see your password);
• your email address, if the provider shares it (with Apple you can choose to hide it);
• your name, which we use as your display name. If the provider gives no name, we use the part of your email address before the "@".

Your display name is shown as the author of quizzes you share publicly, to students who open your class with its join code, and on parent progress pages for your class. You cannot change it in the app yet; email us if you want it changed. Your email address is not shown to anyone.

After you sign in, the app keeps a session token on your device (in the device's secure storage on iOS and Android, and in the browser's local storage on the web). It expires after 30 days.

2. Students

A plain-language summary for schools and parents is in the Student Data Notice.

Live games

Students join a game by typing a 6-digit game PIN (or scanning a QR code or opening a join link) and choosing a nickname and a character. Nicknames are checked against a list of offensive words. During and after the game we keep:

• the nickname, character and a random player ID for that game;
• each answer, how long it took, whether it was right, the points and the final rank;
• for written ("open") questions and word clouds, the text the student typed.

Nicknames, scores and some answers appear on the teacher's projector and on other players' screens during the game. When the game ends, a game report with nicknames, scores and answers (including written answers) is saved for the teacher who hosted it, and a game record file with each player's results is stored with it.

Classes

A teacher can create a class and type in the students' names. We recommend first names or nicknames only. A teacher can also give each student a 4-digit PIN or a 3-picture code, which the teacher can see. A class has a short join code. On a student's device, joining a class stores a sign-in token for that student (valid for up to 400 days) in the app's storage or the browser's local storage; there is no password. With a class we keep, for each student: their name as typed by the teacher, their PIN or picture code (if used), and their results in that class's live games and homework (score and which questions they got right or wrong).

Anyone who has a class's join code can see the class name, the teacher's display name and the list of student names, so that students can pick their own name. Teachers should share the code only with their class. A teacher can also create a read-only parent link for a student, which shows that student's progress to whoever has the link, and can turn it off at any time.

Homework, practice and races

• Homework: the student's name (from the class list, or typed by the student for an open homework link), their answers, scores and timings.
• Practice: for class students and signed-in teachers we keep a review deck: which questions of which quiz they practised, whether they got them right, and when each is due again. For everyone else the deck stays on the device.
• Ghost races: the name the player types, their score and timings. Everyone who has the race link can see that race's leaderboard.
• Profiles: for class students and signed-in teachers we keep coins, experience points, characters bought with coins and simple counts (games played, wins, homework done). For other players these stay on the device only.

Offline games

A teacher can host a game over the local Wi-Fi without the internet. That game runs on the teacher's device and nothing is sent to us during it. The result is uploaded to the teacher's account later, when the teacher is back online.

3. Quizzes, images and reports

• Quizzes you create (title, description, tags, questions, answers, explanations, slides) are stored in your account. New quizzes are private: only you can see them.
• Images: pictures you upload are stored in our storage and can be opened by anyone who has their web address. Photo search sends your search words from our server to Openverse and Wikimedia Commons; the picture you pick is copied into our storage together with its credit and licence.
• Sharing: when you make a quiz Public or Unlisted, it is checked automatically first (section 4). The result of that check, and the reason if it fails, is stored with the quiz. Public quizzes appear in the public library and the question bank with your display name; unlisted quizzes can be opened by anyone with the link.
• Reports: anyone can report a shared quiz. We store the reason, the optional note, and either the reporter's account ID (if signed in) or a one-way hash of their IP address (if not). We never store the raw IP address with a report.

4. AI processing

RaidBox uses AI models run by Cloudflare (Workers AI) inside our Cloudflare account. These features send text, and for the safety check also images, to those models:

• Marking written answers: a student's written answer, with the question and the teacher's model answer, in live games, homework and practice. This is on whenever the AI is available; there is no switch to turn it off yet.
• Translation: a quiz's questions and options, when a student or teacher asks for a translation. Translations are stored so that the same text isn't translated twice.
• Teacher tools: the topic or text a teacher gives to generate a quiz, and quiz questions sent to the fact-check, difficulty and review-quiz tools. Generated questions are stored so that the same request isn't repeated.
• Class insights: the wrong answers a class gives in a live game, to suggest a likely misconception to the teacher.
• Safety check before sharing: the title, description, tags, every question, option, answer and explanation, and every image in a quiz that a teacher makes Public or Unlisted, to block inappropriate, adult or bogus content. A verdict for each image is stored so it is checked only once.

Cloudflare's terms for Workers AI say it does not use this content to train AI models and does not keep it after the request is processed. To control cost and abuse, we count how many AI requests each teacher account and each live game makes per day, and the total for the whole service; when the daily total is reached, written answers are marked by matching key words instead.

5. What we don't do

• No advertising, no advertising IDs, no third-party analytics or tracking tools, and no social-media trackers.
• No selling or renting of personal information, and no profiling for any purpose other than running the service (for example, scheduling practice questions).
• No collection of students' email addresses, phone numbers, contacts, location or photos.
• Camera: used only to scan a game's QR code, and only on the device. On Android the scanner uses Google ML Kit barcode scanning, which runs on the device; Google may receive limited information about how the ML Kit library performs, under Google's terms.
• Read aloud uses your device's own text-to-speech.
• Local network: used only to host or join offline games on the same Wi-Fi.

Like any website, our servers see the IP address of each request. We use it to deliver the service and to limit abuse (for example, too many join attempts), and Cloudflare keeps request logs for a short time. The RaidBox website loads its display engine, and fonts for some languages when they are needed, from Google's servers (gstatic.com), so Google sees your IP address when those files load; nothing else is sent.

6. Who processes data for us

• Cloudflare, Inc. hosts everything: the website and apps' server (Workers and Durable Objects), the database (D1), file storage (R2) and the AI models (Workers AI). Our database is located in North America; Cloudflare's network serves requests from data centres around the world. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.
• Google and Apple handle sign-in for teachers who choose them.
• Openverse and Wikimedia Commons receive photo-search words from our server (never from students).
• Google ML Kit runs the QR scanner on Android devices (section 5).

We may also disclose information if the law requires it.

7. Who can see what

• Players in a game: nicknames, characters and scores, on the projector and on players' screens.
• The teacher: everything about their own quizzes, games, classes and homework, including students' answers.
• Anyone with a class join code: the class name, the teacher's display name and the student names (section 2).
• Anyone with a parent link, homework link or race link: what that link shows (one student's progress; the homework; the race leaderboard).
• Everyone: quizzes a teacher has shared publicly, with the teacher's display name.

8. How long we keep data

We keep data until it is deleted. There is no automatic deletion schedule yet; we will update this policy when there is one.

• Teachers can delete quizzes, classes, individual students and homework in the app. Deleting a class removes its students, its homework and the class results. Deleting a student removes them from the class list and removes their class results and homework attempts.
• Some records are not yet removed by those actions and can't yet be deleted in the app: game reports and game record files, students' practice decks and profiles, ghost races, and stored AI results (translations and generated questions). We delete them on request.
• Account deletion is not available in the app yet. To delete a teacher account and everything in it, email support@conemlabs.com from the email address of that account (or tell us your display name and the email address the account uses) and we will delete it.
• Information kept on a device (settings, guest practice decks and profiles, offline game results not yet uploaded, a class student's sign-in) is removed by uninstalling the app or clearing the browser's site data.

9. Schools, teachers and children

RaidBox is designed for classrooms and is meant to be used under the direction of a teacher. Students don't create accounts and don't give us contact details. A teacher or school that uses RaidBox with students under 13 (or under the age of digital consent where they live) is responsible for obtaining any consent required from parents or guardians, or for giving it on the parents' behalf where the law allows a school to do so for educational use. We use student information only to provide the service to that teacher and school, never for advertising or any commercial purpose.

Teacher accounts are for adults. If you believe a child has created a teacher account, or that a student's information should be removed, contact us and we will delete it. Parents and guardians can ask their child's teacher or school, or contact us directly.

10. Security

All traffic uses HTTPS (TLS). Sign-in and game tokens are signed and expire, and a teacher's session is kept in the device's secure storage on iOS and Android. Access to the database is limited to our server. No system is completely secure, so please use first names or nicknames for students.

11. Your choices and rights

• Teachers can view, change and delete their quizzes, classes, students and homework in the app, and keep any quiz private.
• Requests: depending on where you live, you may have the right to access, correct or delete your information, to object to its processing, or to receive a copy. Email support@conemlabs.com and we will reply within 30 days. Requests about a student's information can come from the student's teacher, school, parent or guardian.
• You can also complain to your local data-protection authority.

12. International transfers

ConeM Labs is based in Canada. Our data is stored by Cloudflare in North America and processed on Cloudflare's network, which may include data centres in other countries. Those countries may have data-protection laws that differ from yours. We rely on Cloudflare's contractual data-protection commitments for these transfers.

13. Changes

If we change this policy, we will post the new version at the same address with a new effective date. If the changes are significant, we will also point them out in the app or in the release notes.

14. Contact

ConeM Labs Inc. — 729 Emerson Ave, Oshawa, ON L1H 3L2, Canada — support@conemlabs.com — https://conemlabs.com