Privacy Policy
The short version
- Today Goal100 collects almost nothing: the courses and challenges keep progress only in your browser, on your device.
- No ads, no tracking cookies, no analytics, no selling or sharing personal information. Ever.
- The contact form (adults only) sends us your name, email, role and message.
- When accounts and paid plans open, we will collect only what the Service needs, and update this policy first.
- Student information from schools is used only for the school's purposes, under its agreement and NY Education Law § 2-d.
- You can ask to see, correct or delete your information through the Contact page.
This summary helps you read the full text; the full text controls.
Contents
- Who we are and what this policy covers
- What we collect today
- What we will collect when accounts and payments open
- How we use information
- What we never do
- Who we share information with
- Children and teens
- Cookies, local storage and privacy signals
- How long we keep information
- How we protect information
- Your choices and rights
- Emails
- Where information is stored
- Changes to this policy
- Contact
1. Who we are and what this policy covers
This Privacy Policy explains how ZAKAZIKY LLC, a New York limited liability company doing business as Goal100 Learning (“Goal100”, “we”) handles personal information on goal100learning.com, the Goal100 app, courses and challenges, and related services (the “Service”). Special rules for children under 13 are in the Children's Privacy Notice, and for student data from schools in Student Data Privacy. If a school's signed agreement conflicts with this policy, the agreement controls for that school's data.
2. What we collect today
| Who | What | Where it goes |
|---|---|---|
| Students and course users | Nicknames, settings, answers and progress | Stays in the browser's local storage on the device. Not sent to us. |
| Progress codes | Nickname, scores and settings (no email, birthday or last name) | Created on the device; goes only where the student pastes it (for example to a teacher). |
| Contact form (adults 18+) | Name, email, role, school or district (optional), message | Delivered to us by our host (Netlify Forms) and kept to answer you. |
| Every visitor | Standard technical data such as IP address, browser type and pages requested | Processed by our host, for delivery and security. |
3. What we will collect when accounts and payments open
We will update this policy before any of this starts. We plan to collect only:
- Adults (parents, teachers, school staff): name, email, role, school or district, password (stored only as a secure hash by our sign-in provider), plan and settings.
- Students: only through a school (under its agreement) or with a parent's verifiable consent: a nickname, class code, picture password, progress, scores and settings. No student email, birthday, last name, photo, voice recording or precise location.
- Payments: handled by our payment processor (Stripe). We receive name, email, billing country or postal code, card brand, last four digits and expiry date, never the full card number.
- Security signals: sign-in times, device type and IP address, used to keep accounts safe (for example the one-active-session rule) and to stop fraud.
4. How we use information
- To provide, run, secure and support the Service you asked for.
- To answer messages and requests.
- To process payments, send receipts, renewal reminders and other required notices.
- To keep accounts safe, prevent fraud and misuse, and enforce our Terms.
- To fix errors and improve lessons using information that does not identify any person.
- To comply with the law and respond to lawful requests.
5. What we never do
- We never sell personal information or share it for targeted (cross-context behavioral) advertising.
- We never show ads in Goal100.
- We never build advertising profiles of students or children.
- We never use student data or children's personal information to train artificial intelligence models.
- We never use student data for any commercial or marketing purpose (New York Education Law § 2-d).
6. Who we share information with
Only with service providers that help us run the Service, under contracts that limit their use of the information to that work, and only as needed:
| Provider | Purpose | Status |
|---|---|---|
| Netlify (privacy) | Website hosting, contact form delivery | In use |
| Supabase (privacy) | Sign-in and database, U.S. region | Planned; not in use for real users |
| Stripe (privacy) | Payment processing | Planned |
| Cloudflare Turnstile | Bot protection on forms and sign-in | Planned |
We may also disclose information (a) when the law, a court order or a valid legal process requires it (for school data, with notice to the school as Part 121 requires unless the law forbids it); (b) to protect someone's safety or to prevent fraud or a security threat; (c) with your consent; or (d) to a successor in a merger or sale, which must keep the promises in this policy and in any school agreement. Recorded narration is created in advance with a voice service (ElevenLabs); no user information is sent to it.
7. Children and teens
Children under 13: see the Children's Privacy Notice. Teens 13 to 17: under the New York Child Data Protection Act, we process a teen's personal data only when it is strictly necessary for the service requested or another purpose the law allows, or with informed consent; student data from schools is handled under New York Education Law § 2-d. The contact form is for adults 18+.
8. Cookies, local storage and privacy signals
We do not use advertising or tracking cookies or analytics. See Cookies and Local Storage. Because we do not sell or share personal information, we treat a Global Privacy Control (GPC) or similar opt-out signal as a confirmed opt-out and do nothing further that would conflict with it.
9. How long we keep information
| Information | How long |
|---|---|
| On-device progress and settings | Until you clear it in your browser (we never receive it) |
| Contact messages | Up to 12 months, then deleted, unless needed for a legal claim |
| Adult accounts (when open) | While the account is active; deleted within 60 days after closure, except records the law requires us to keep |
| Student data from schools (when open) | As the school's agreement says; returned or deleted at the end of the contract |
| Children's data in family accounts (when open) | See the data retention policy in the Children's Privacy Notice |
| Payment and tax records | As tax and accounting laws require (generally up to 7 years); held mainly by the payment processor |
10. How we protect information
We maintain reasonable administrative, technical and physical safeguards as New York's SHIELD Act (General Business Law § 899-bb) requires, including encryption in transit (HTTPS) and, when accounts open, encryption at rest, least-privilege access, two-step sign-in for administrators and row-level security so each school sees only its own data. No system is perfectly secure. If a breach of private information occurs, we will notify affected people and authorities as the law requires (General Business Law § 899-aa requires notice within 30 days after discovery), and schools as their agreements and Part 121 require. See Security.
11. Your choices and rights
- You may ask to access, correct, delete or get a copy of personal information we hold about you, and ask how we use it. We offer these rights to everyone, wherever you live.
- For school accounts, we send requests to the school and help it respond, because the school controls student records.
- We may need to verify your identity before acting. An authorized agent may act for you with proof of authority.
- If we deny a request, we explain why; you may ask us to reconsider by replying to our answer. We never treat you differently for using your rights.
- Residents of states with consumer privacy laws may have additional rights; we honor them where they apply.
- To remove on-device progress, clear your browser's site data.
12. Emails
We send service emails you need (receipts, renewal reminders, security and legal notices). Any marketing email goes only to adults, says who it is from, includes a working unsubscribe link and our postal address, and stops within 10 business days of an unsubscribe request, as the CAN-SPAM Act requires. We never send marketing email to students.
13. Where information is stored
The Service is operated from the United States, and we store account data in the United States. It is intended for users in the United States.
14. Changes to this policy
We post changes here with a new date. Before we collect new kinds of personal information or use it in a materially new way, we update this policy first and, where the law requires, ask for consent (including new parental consent for children).
Ask Goal100 in ChatGPT
Ask Goal100: New York school help is our read-only app inside ChatGPT. It has no sign-in and no account. When you use it, ChatGPT sends our app only the short request it needs for one answer, for example a topic, a grade, a subject, a role (such as family or teacher) and a language. The app answers from Goal100’s own public course list, AI Prompt Library and checked New York State facts, and sends the answer back.
What we collect: no personal information. The app does not ask for names, email addresses, schools, locations, student records or any other personal information, and we ask you not to type them. The app does not save or log what you ask, and it never receives your whole ChatGPT conversation.
Who handles requests: our hosts Netlify (the address goal100learning.netlify.app/mcp) and Supabase (where the app’s code runs) pass each request to the app. Like every web host, they process standard technical data such as IP address, time and request status for delivery and security, under their own privacy policies. We do not use this data to track or profile anyone, and we never sell or share it.
How long we keep it and your choices: we keep nothing from your requests. You can stop using the app at any time by disconnecting or removing it in ChatGPT. ChatGPT is run by OpenAI under OpenAI’s own privacy policy; to see or delete your ChatGPT chats, use ChatGPT’s own controls. Questions: use the Contact page and mark your message “Privacy”.
Ages: the app is for families, teachers, school staff and students 13 and older, as OpenAI’s rules for apps require. Children under 13 use Goal100 with a grown-up; see the Children's Privacy Notice.
15. Contact
Use the Contact page and mark your message “Privacy”. Operator: ZAKAZIKY LLC, a New York limited liability company, doing business as Goal100 Learning.
Laws and official sources referenced
- NY General Business Law § 899-bb (reasonable data security safeguards): https://www.nysenate.gov/legislation/laws/GBS/899-BB (checked Nov 7, 2026)
- NY General Business Law § 899-aa (breach notification; 30-day outer limit added Dec. 2024): https://www.nysenate.gov/legislation/laws/GBS/899-AA (checked Nov 7, 2026)
- NY Child Data Protection Act, General Business Law § 899-ee and following (effective June 20, 2025): https://www.nysenate.gov/legislation/laws/GBS/899-EE (checked Nov 7, 2026)
- NY Attorney General, Child Data Protection Act guidance: https://ag.ny.gov/child-data-protection-act-guidance (checked Nov 7, 2026)
- COPPA Rule, 16 CFR Part 312: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 (checked Nov 7, 2026)
- FERPA regulations, 34 CFR Part 99 (school official exception, § 99.31(a)(1)(i)(B)): https://www.law.cornell.edu/cfr/text/34/99.31 (checked Nov 7, 2026)
- New York Education Law § 2-d: https://www.nysenate.gov/legislation/laws/EDN/2-D (checked Nov 7, 2026)
- FTC CAN-SPAM Act compliance guide (15 U.S.C. § 7701 and following; 16 CFR Part 316): https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business (checked Nov 7, 2026)
Questions about this document: use the Contact page; we answer in writing. We post every change on this page with a new date.