Privacy Policy

Last Updated: August 12, 2026

This notice was corrected on August 12, 2026 to remove statements that did not match how the Platform actually works — specifically about guest-mode anonymity, AI-provider data retention, and the legal basis for the Connecticut rights listed below. Some items are marked as under review with legal counsel; those are genuinely unresolved and We would rather say so than state something We cannot evidence.

Brass City Gamers Tournament, Inc. ("BCG," "We," "Us," or "Our"), a 501(c)(3) nonprofit organization (EIN: 47-5008696), operates the AlloyCity AI Tutor platform ("AlloyCity," "the Platform," or "the Service"). We are committed to protecting the privacy of all users, with special attention to the children and students who use our Platform. This Privacy Policy explains how We collect, use, store, and protect personal information when You use AlloyCity.

Please read this Privacy Policy carefully. By accessing or using AlloyCity, You agree to the terms of this Policy. We will alert You to any changes by updating the "Last Updated" date above. We encourage You to review this Policy periodically.

About AlloyCity

AlloyCity is an adaptive AI-powered tutoring platform designed for K-12 students. The Platform provides personalized reading and math instruction using artificial intelligence, speech technology, and research-based teaching methods. AlloyCity may be used by students independently, through supervised programs operated by BCG, or in partnership with schools and educational organizations.

Information We Collect

Account Information: When You sign in to AlloyCity using Google OAuth, We receive Your name, email address, and Google profile picture. We use this information to create and maintain Your account.

Student Learning Data: As You use the Platform, We collect and store information related to Your learning activity, including:

Chat messages exchanged with the AI tutor
Quiz questions, answers, and scores
Reading level assessments and progress data
Words practiced and vocabulary history
Session frequency and duration
Language and grade band preferences

Voice Data: If You use the text-to-speech or speech features, audio is processed in real time by Azure Speech Services to convert text to spoken audio or to recognize speech input. We do not store audio recordings of Your voice.

Technical Data: Our servers automatically collect standard technical information when You access the Platform, including Your IP address, browser type, device type, and access times. This data is used to maintain the security and performance of the Platform.

Guest Access (No Account)

AlloyCity offers a guest mode so You can try the Platform without creating an account or signing in. Guest access is designed to collect as little information as possible:

We do not ask for Your name, email address, or profile. Guest mode does not request or store direct identifiers, and We do not know who You are by name.
We do still process some information about You. To make the tutor work We process: a randomly generated session identifier stored in a cookie, the grade band (age category) You select, Your IP address, Your learning activity (chat, audio and quiz use), and the text You type into the tutor. Some of this — in particular a persistent session identifier and an IP address — is treated as personal information under children's privacy law even though it does not include Your name. We do not claim guest mode is anonymous.
Session length. The guest session cookie is set to expire after 24 hours. Guest records are written with a 24-hour time-to-live so the database can purge them automatically.
Usage limits. Guest activity (chat, audio, and quizzes) is rate-limited to protect the service and manage costs. These limits are enforced using the session identifier and IP address.
Children and guest mode — under review. Guest mode does not currently create a parental-consent hold. Because guest mode does process the information listed above, We are reviewing with legal counsel whether under-13 guest access requires verifiable parental consent, and We will restrict or change guest mode if that review says so. If You create an account, the Children's Privacy protections in that section apply.

If You later sign in with an account, the account terms described elsewhere in this Policy apply from that point forward.

How We Use AI Services

AlloyCity uses artificial intelligence to provide personalized tutoring. It is important that You understand how Your data interacts with these services.

Azure OpenAI Service: Your chat messages and quiz interactions may be sent to Microsoft's Azure OpenAI Service to generate tutoring responses. Under Microsoft's published data-use terms for Azure OpenAI, input submitted through the API is not used to train or improve Microsoft's models.

Anthropic Claude: Anthropic's Claude may be used for student tutoring responses as well as for the teacher-facing chat. Under Anthropic's published commercial terms, input submitted through the API is not used to train their models. The teacher-facing chat sends a limited summary of student learning data (first name, grade and reading level, recent quiz scores, practiced words, and difficulty indicators) so a teacher can ask questions about their class.

What We do not yet claim. We previously stated that provider data was "not retained beyond what is necessary to provide the service." We are removing that claim until We can evidence it, because We have not yet completed and verified a zero-data-retention configuration and data-processing agreement with every AI provider on every request path. Assume input may be retained by the provider for a limited period under their standard terms (for example for abuse monitoring) unless and until We state otherwise here. Establishing and verifying those agreements is open work tracked internally.

Fallback between providers. If one AI provider is unavailable, a request may be retried against another. That means a single tutoring request can reach more than one provider.

Azure Speech Services: Text-to-speech and speech recognition features are powered by Microsoft Azure Speech Services. Audio data is processed in real time for the purpose of generating or recognizing speech. Audio data is not stored or used for model training.

How We Store Your Data

Student records, learning progress, and account information are stored in Azure Cosmos DB, a cloud database hosted on Microsoft Azure's infrastructure in the United States. Access to the database is secured using Azure Managed Identity - there are no shared passwords or API keys that could be compromised.

All data transmitted between Your device and AlloyCity is encrypted using HTTPS (TLS). The Platform enforces HTTPS-only connections.

User sessions are authenticated using signed, secure cookies. Session tokens are cryptographically signed to prevent tampering or forgery.

Who Has Access to Your Data

Access to student data is restricted to:

BCG administrators - authorized staff who manage the Platform and support students
AI service providers - Microsoft (Azure OpenAI, Azure Speech Services) and Anthropic (Claude), solely for real-time processing as described above
School partners - if AlloyCity is used as part of a school program, designated school administrators or teachers may have access to their students' learning data as governed by a Data Processing Agreement between BCG and the school

We do not sell, rent, or trade Your personal information or student data to any third party. We do not use student data for advertising, marketing, or any commercial purpose unrelated to the educational services provided by AlloyCity.

Children's Privacy (COPPA Compliance)

AlloyCity is designed for use by children, including children under the age of 13. We take our obligations under the Children's Online Privacy Protection Act (COPPA) seriously.

Parental Consent: For users under the age of 13, We require verifiable parental consent before the child can access interactive features of the Platform (such as AI tutoring chat and quizzes). A parent or legal guardian must provide consent through our designated consent process before their child's account is fully activated.

School Consent: When AlloyCity is used as part of a school-authorized educational program, the school may act as the parent's agent and provide consent on behalf of parents for the collection of student information, as permitted under COPPA. In such cases, the school is responsible for obtaining any necessary parental permissions under its own policies.

What We Collect From Children: We collect only the minimum information necessary to provide the educational service - name and email address (from Google sign-in), and learning activity data as described above. We do not collect photos, videos, or audio recordings from children. We do not require children to provide more information than is reasonably necessary to use the Platform.

Parental Rights: Parents and legal guardians have the right to:

Review the personal information We have collected from their child
Request that We delete their child's personal information
Refuse to allow further collection of their child's information
Request that We stop using their child's information

To exercise any of these rights, please contact Us at info@brasscitygamers.com. We will respond to verified parental requests within 30 days.

Student Education Records (FERPA)

When AlloyCity is used in partnership with a school or school district, student learning data may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA). In such cases:

BCG acts as a "school official" with a legitimate educational interest, as defined under a Data Processing Agreement (DPA) with the school or district
Student education records are used solely for the educational purposes specified in the DPA
BCG does not disclose education records to third parties except as required to operate the Platform (i.e., AI service providers as described above) or as required by law
Parents and eligible students retain all rights under FERPA, including the right to inspect and review education records and to request corrections

Schools or districts interested in using AlloyCity should contact BCG at info@brasscitygamers.com to establish a Data Processing Agreement.

Connecticut Student Data Privacy

BCG complies with the Connecticut Student Data Privacy Act (Connecticut General Statutes 10-234aa through 10-234dd) when AlloyCity is used by students enrolled in Connecticut public schools. Under this law:

Student data is used exclusively for the educational purposes authorized by the school or district
We do not use student data for targeted advertising or to build profiles for non-educational commercial purposes
We implement and maintain reasonable security procedures to protect student data from unauthorized access, destruction, use, modification, or disclosure
We will promptly notify the school or district in the event of a data breach involving student information
Upon termination of any contract with a school or district, We will delete or return all student data within a reasonable timeframe as specified in the applicable agreement

Connecticut Privacy Rights

How these rights arise. Brass City Gamers Tournament, Inc. is a Connecticut nonprofit, and the Connecticut Data Privacy Act generally exempts nonprofit organizations. We previously presented the rights below as statutory entitlements under that Act, which was not accurate as applied to Us. We grant them to You voluntarily as a matter of policy, and We will honor them whether or not the statute compels Us to. Separately, where AlloyCity is used through a school or district, that district's contract and Connecticut's student-data-privacy law impose their own obligations on Us. The precise statutory analysis is under review with counsel and this section will be updated with their conclusion.

The rights We grant You:

Right to confirm whether We are processing Your personal data
Right to request correction of inaccurate personal information
Right to request deletion of Your personal information
Right to obtain a portable copy of Your personal data
Right to opt out of the sale of personal data, targeted advertising, or profiling
Right not to be discriminated against for exercising Your privacy rights

To exercise these rights, contact Us at info@brasscitygamers.com. We will respond within 45 days. If You are not satisfied with Our response, You may file a complaint with the Connecticut Attorney General's office.

Cookies and Tracking

AlloyCity uses only essential cookies required for the Platform to function. Specifically:

Session cookie: A signed, secure cookie that maintains Your login session. This cookie is essential for authentication and cannot be disabled while using the Platform.

AlloyCity does not use advertising cookies, analytics tracking cookies, social media cookies, or any third-party tracking technologies. We do not serve advertisements. We do not track users across other websites.

Data Retention and Deletion

What We keep, why, and for how long.

Student learning data (grade and reading level, quiz scores, words practiced, difficulty indicators, message counts) — kept while the account is active because the tutor uses it to adapt to the learner. Deleted on request as described below.
Guest records — written with a 24-hour time-to-live so the database purges them automatically.
Child-safety records. If the tutor detects a possible crisis disclosure (such as self-harm or abuse), it records that an incident occurred so a responsible adult can review and act. These records are treated differently from ordinary learning data and are not deleted on request while a review is open, because deleting them could remove the only record of a child-safety concern. The retention period and the exact contents of these records are being determined with legal counsel; this section will state a specific period once that is settled.
Audit records of who accessed student data — kept as a security and accountability control.

Deletion. You may request deletion of Your account and associated data at any time by contacting Us at info@brasscitygamers.com. Upon a verified request We will delete Your data within 30 days, except where a child-safety review is open, where a legal obligation requires retention, or where the record is an audit record as described above. If We withhold anything, We will tell You what and why.

Parents or legal guardians may request deletion of their child's data at any time using the contact information above. Please contact Us to do this — self-service deletion is not currently available in the Platform interface.

When AlloyCity is used through a school partnership, retention and deletion terms are governed by the applicable Data Processing Agreement, which takes precedence over this section.

Security

We take the security of Your data seriously and employ industry-standard protections, including:

HTTPS-only encrypted connections (TLS)
Azure Managed Identity for database access (no stored credentials)
Cryptographically signed session tokens
Role-based access controls for administrative functions
Regular security reviews and testing

No system is perfectly secure. While We take all reasonable steps to protect Your information, We cannot guarantee absolute security. We will notify affected users and applicable authorities promptly in the event of any data breach.

Third-Party Links

AlloyCity may contain links to third-party websites, such as www.brasscitygamers.com. This Privacy Policy applies only to AlloyCity. We are not responsible for the privacy practices of any third-party websites. We encourage You to review their privacy policies before providing any personal information.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in Our practices, the Platform, or applicable law. When We make material changes, We will update the "Last Updated" date at the top of this page. If We make changes that significantly affect how We handle children's personal information, We will provide prominent notice and, where required by law, obtain renewed parental consent.

Contact Us

If You have questions about this Privacy Policy, wish to exercise Your privacy rights, or need to reach Us about Your child's data, please contact:

Brass City Gamers Tournament, Inc.

Waterbury, Connecticut

EIN: 47-5008696

Email: info@brasscitygamers.com

Website: www.brasscitygamers.com