RaidBox — Student Data Notice

Effective date: 10 November 2026

This notice is for teachers, school administrators and parents. It explains, in plain language, what RaidBox keeps about students, who can see it, where it goes, how long it is kept and how to delete it. RaidBox is a free classroom quiz game published by ConeM Labs ("we", "us"). It runs at raidbox.conemlabs.com and as apps for iOS and Android. Contact: support@conemlabs.com.

It describes what the service does today, including the parts we still want to improve. Our full Privacy Policy also covers teacher accounts.

In short

• Students never create an account and never give us an email address, phone number, password, birth date, location or photo.
• We keep the name or nickname a student plays under, their answers (including anything they type), their scores, and, for students in a teacher's class, their homework, practice and game progress.
• Anyone who has a class's join code can see the list of student names in that class. Please use first names and a last initial, and share the code only with the class.
• Everything is stored with Cloudflare. Written answers and quiz text are sent to Cloudflare's AI service for marking, translation and safety checks; Cloudflare does not use them to train AI models.
• No ads, no analytics, no tracking, and we never sell or share student data for marketing.
• Data is kept until it is deleted. There is no automatic deletion yet. Teachers can delete students, classes and homework in the app; some records need an email to support@conemlabs.com (section 6).

1. What RaidBox stores about students

Names

• Live games: the nickname a student types when joining with a game PIN (checked against a list of offensive words), or a random one if the teacher chose random names. The teacher can also attach a class to a game; then students play under the name the teacher typed into the class list.
• Classes: each student's name exactly as the teacher typed it. RaidBox does not ask for surnames, and we recommend first name + last initial (for example "Maya R.").
• Open homework links and races: the name the student types. In a race, the name box is filled in with the student's class name unless they change it.

Optional PIN or picture code

A teacher can give each student in a class a 4-digit PIN or a code of 3 pictures, so classmates can't sign in as each other. The code is stored as it is (not scrambled) so the teacher can look it up and print it on sign-in cards. It is not a password to anything outside RaidBox.

Answers and scores

• Each answer a student gives, whether it was right, the points and how long it took.
• Text a student types: written ("open") answers, typed answers and word-cloud entries. In homework, every answer, including typed text, is kept with the attempt.
• Final scores and ranks. After a live game, a game report (nicknames or class names, scores, how each question went, and written answers) is saved for the teacher who hosted it, together with a game record file holding each player's results.
• For students in a class: a result for each live game and homework (score, number right, which questions they got right or wrong). These feed the teacher's class dashboard and the parent link.

Practice, coins and races

• Practice cards (students in a class): which questions of which quiz they have practised, whether they got them right, and when each is due again. Questions they miss in live games and homework are added too.
• Profile (students in a class): coins, experience points, the characters they bought with coins, and simple counts (games played, wins, homework done, best streak). For players who are not in a class, these stay on the device.
• Races: the name, character, score and timings of each run.

The sign-in token on the student's device

When a student joins a class on a device, RaidBox saves a sign-in token on that device so they don't have to pick their name every time. It is kept in the app's storage (in the browser's local storage on the website; on Android it may be included in the device's backup) and is valid for up to 400 days. It stops working sooner if the teacher uses "Sign out their devices" or removes the student, and it is erased by "Leave class on this device", by uninstalling the app, or by clearing the browser's site data. Live-game tokens last 6 hours.

What we don't collect

No student email addresses, phone numbers, passwords, birth dates, home addresses, contacts, location, photos, voice recordings, advertising IDs or device fingerprints. The camera is used only to scan a game's QR code, on the device. "Read aloud" uses the device's own speech.

2. Who can see it

• The teacher who owns the class or hosted the game sees everything above for their own classes, games and homework, including written answers and each student's PIN or picture code.
• Classmates during a live game see nicknames (or class names), characters and scores on the projector and on their own screens, including the leaderboard. At the end of a question, the projector can show the answers the class gave: the spread of choices, word-cloud entries and the most common typed answers, as students typed them. Only nicknames are checked for offensive words at the moment, not answers.
• Anyone who has the class join code can see the class name, the teacher's display name and the full list of student names, because students pick their own name from that list. If the class uses the default "Pick name" sign-in (no PIN or pictures), anyone with the code can also pick any name and act as that student: see the student's homework and scores, do homework as them, and join the class's live game under their name. A PIN or picture code prevents this. The teacher can make a new code at any time.
• Anyone with a parent link sees one student's page: their name, class name, the teacher's display name, games played, homework done, accuracy and its trend, the questions and topics they find hardest, and their homework list with scores. Parent links are created by the teacher for one student and can be turned off at any time.
• Anyone with a race link sees that race's leaderboard: the names, characters and scores of everyone who raced it.
• Anyone with an open homework link can play it by typing a name; only the teacher sees the names and answers.
• Us: we look at stored data only to run and fix the service, keep it safe, or answer a request from the teacher, school or a parent.

3. Where student data goes

• Cloudflare, Inc. hosts the whole service: the game server, the database, file storage and the AI models. Our database is located in North America; Cloudflare's network serves requests from data centres around the world. Cloudflare keeps request logs for a short time.
• Cloudflare Workers AI (AI models that Cloudflare runs inside our account) receives:
  • a student's written answer, with the question and the teacher's model answer, to mark it, in live games, homework, practice and races;
  • a quiz's questions and answer options, when a student or teacher asks for a translation (the student's own answers are not translated);
  • in live games, the question and the most common wrong answer (which can be something students typed), to suggest a one-line explanation to the teacher;
  • the quiz's own text and images when a teacher shares a quiz, for an automatic safety check.
  Cloudflare states that it does not use this content to train AI models and does not keep it after answering: Workers AI data usage. We store translations of quiz text and the teacher explanations so the same request isn't repeated. If the AI is unavailable or the service's daily AI limit is reached, written answers are marked by matching key words instead.
• Google ML Kit: on Android, the QR-code scanner uses Google's ML Kit barcode scanning, which runs on the device; Google may receive limited information about how the library performs, under Google's terms. Camera images are not sent to us.
• The RaidBox website loads its display engine, and fonts for some languages, from Google's servers (gstatic.com), so Google sees the device's IP address when those files load. Nothing else is sent.
• Offline games over the classroom Wi-Fi run on the teacher's device; nothing is sent to us during the game, and the result is uploaded to the teacher's account later.
• No advertising, analytics or tracking tools are in RaidBox, and we never sell, rent or share student data for marketing or advertising.

4. How long it is kept

• Until it is deleted. There is no automatic deletion schedule yet; we will update this notice when there is one.
• A live game's working copy is wiped when the game closes. The game report and game record file stay in the teacher's account.
• The sign-in token on a student's device: up to 400 days (section 1).
• Stored translations and AI explanations (which contain quiz text, and an explanation may quote a common wrong answer) are kept with no expiry at the moment.

5. Recommendations for teachers

• Type students' names as first name + last initial (or a class nickname), never full names, ID numbers or other details.
• Turn on a PIN or picture code for each class, and share the class code only with the class. If the code leaks (for example a photo of the projector), make a new one in the class settings.
• When you attach a class to a live game, turn on "Roster only" so guests can't join; for open games, consider the "Random" nickname option.
• Don't put students' personal information in quiz questions, and share parent links only with that student's family.
• At the end of the school year, delete classes you no longer need, and email us if you also want old game reports removed.

6. Deleting student data

What a teacher can delete in the app

• Remove a student (class → student → Remove from class): deletes the student from the class list, their PIN or picture code, their parent link, their results in that class and all their homework attempts. Their device sign-in stops working.
• Delete a class: deletes the class, its student list with PINs and picture codes, the homework set for that class with all its attempts, and the class results. Parent links and device sign-ins for that class stop working.
• Delete homework: deletes the homework, every attempt at it (including open-link attempts) and its results.
• Also: turn off a parent link, "Sign out their devices" for a student, make a new class code, or switch the class to PIN or pictures.

What those actions don't remove yet

Removing a student or deleting a class does not yet remove: game reports and game record files (which keep the names, scores and written answers from that game), the student's practice cards and profile (coins, characters, counts), their race entries, and stored translations and AI explanations. Teachers can't delete these in the app yet. We delete them on request.

How to ask us

Email support@conemlabs.com. Requests can come from the teacher, the school, or a student's parent or guardian. Tell us the teacher's name or class code and the student's name as it appears in the class (or the nickname and the date of the game). If you are the teacher, write from the email address of your RaidBox account. We may need to check that the request is genuine, and we reply within 30 days. Parents can also ask their child's teacher, who can remove the student straight away.

7. Schools and consent

RaidBox is meant to be used under the direction of a teacher. A teacher or school that uses RaidBox with students under 13 (or under the age of digital consent where they live) is responsible for obtaining any consent required from parents or guardians, or for giving it on the parents' behalf where the law allows a school to do so for educational use. We use student information only to provide the service to that teacher and school, never for advertising or any other commercial purpose.

8. Changes and contact

If we change this notice, we will post the new version at https://conemlabs.com/raidbox/student-data with a new effective date.

ConeM Labs Inc. — 729 Emerson Ave, Oshawa, ON L1H 3L2, Canada — support@conemlabs.com — https://conemlabs.com