Rubricly ("Rubricly," "we," "us," or "our") provides an AI-assisted grading platform designed to help teachers evaluate student assignments using teacher-provided rubrics.
This Privacy Policy describes how Rubricly collects, accesses, processes, uses, shares, retains, and protects information when teachers, schools, and school divisions use our services ("Services").
Because Rubricly is designed for educational use, protecting student information is a fundamental part of how we design and operate the Services. Rubricly is intentionally designed to minimize the amount of student information it collects and retains.
This summary provides an overview of Rubricly's privacy practices. Additional detail is provided throughout this policy.
Depending on how the Services are used, Rubricly may process: teacher-provided grading rubrics; student assignments uploaded by teachers; images, PDFs, handwriting, typed responses, and other student-created content; student names or identifiers contained in assignments, file names, or classroom rosters; information imported from Google Classroom when a teacher chooses to connect it; teacher-provided grading information and adjustments; account and authentication information; and limited technical and security information necessary to operate the Services.
No. Rubricly does not sell student personal information.
No. Rubricly does not use student personal information for targeted advertising, behavioral advertising, or advertising profiles.
No. Rubricly does not use student assignment content to train or fine-tune Rubricly's own AI models. Student assignments are processed only to provide the grading service requested by the teacher or educational institution.
Yes. Rubricly uses artificial intelligence to analyze teacher-provided rubrics and student assignments and generate suggested grades, feedback, and standards tags. AI-generated results are intended to assist teachers — teachers remain responsible for reviewing and determining final grades and feedback.
Student assignment content may be transmitted to OpenAI through its API for AI processing. If a teacher connects Google Classroom, Rubricly also communicates with Google to retrieve the classroom information and student submissions selected by the teacher. Rubricly may also use infrastructure and security service providers necessary to operate the Services.
Rubricly is designed to retain student assignment files only for the period necessary to complete grading. Uploaded files are automatically deleted from Rubricly's active application storage after grading is completed, typically within seconds. Rubricly does not currently maintain persistent server-side grading history.
Rubricly does not use cookies or tracking technologies for advertising or behavioral profiling. Rubricly uses a technically necessary cookie to keep a teacher signed in, and may use other technically necessary browser storage required for security or basic operation of the Services.
The information Rubricly processes depends on how the Services are used. Rubricly is primarily designed to process information provided by teachers, schools, and school divisions rather than information submitted directly by students.
Teachers may provide: name; email address; authentication information; grading rubrics; student assignments; student names or identifiers; class or course information; grading results; feedback; standards tags; and other information entered into the Services.
Student assignments may include: names; handwriting; typed responses; images; photographs; drawings; diagrams; project files; written answers; and other student-created work.
Rubricly does not require student assignments to contain a student's name. However, a student's name may appear in an assignment, filename, document metadata, or classroom roster.
Rubricly may process information a teacher enters or modifies after receiving AI-generated results, including: adjusted scores; edited feedback; standards tags; teacher comments; and other grading information. Rubricly does not currently retain this information in a persistent server-side grading database.
Student assignments and related information may constitute education records or personally identifiable information from education records under applicable federal or state law. Rubricly treats student information as sensitive educational information and processes it only for authorized educational and service-related purposes.
Rubricly does not:
Rubricly is designed to minimize the collection and retention of student information.
Rubricly offers an optional integration with Google Classroom. A teacher must affirmatively choose to connect Google Classroom and authorize the requested permissions through Google's authentication and consent process.
Depending on the course and assignment selected by the teacher, Rubricly may access: course information; assignment information; student roster information; student names; student submissions; and files attached to student submissions.
Rubricly requests read-only access for this integration. Rubricly does not use the Google Classroom integration to: create, modify, or delete assignments; create or modify grades; delete student submissions; modify course information; or modify or delete files in the teacher's Google Drive.
Rubricly does not receive or store the teacher's Google password. Google Classroom integration is optional — teachers may use Rubricly without connecting Google Classroom.
When teachers use Rubricly, Rubricly and its infrastructure may automatically process limited technical information necessary to operate, secure, troubleshoot, and maintain the Services, including: IP address; browser type; operating system; device information; date and time of requests; authentication events; error information; performance information; security logs; and other information reasonably necessary to operate and protect the Services.
Rubricly does not intentionally include student assignment content in application or diagnostic logs. Rubricly does not use technical information to create advertising profiles of students.
We process information to accept teacher-provided rubrics; receive and process student assignments; import assignments from Google Classroom when authorized; generate AI-assisted grading results; return grading suggestions and feedback to teachers; and provide related functionality requested by the teacher or educational institution.
We may process limited technical information to secure the Services, detect unauthorized access, prevent abuse, diagnose technical problems, maintain system availability, and protect the integrity of the Services.
We may process or disclose information when reasonably necessary to comply with applicable law, respond to lawful legal process, protect the rights or safety of Rubricly, schools, teachers, students, or others, or investigate security incidents or unlawful activity.
Rubricly does not use student personal information for targeted advertising, behavioral advertising, sale of student information, student advertising profiles, unrelated commercial profiling, marketing directed at students, or training or fine-tuning Rubricly's own AI models.
Rubricly uses artificial intelligence to assist teachers in evaluating student assignments. The grading process may involve:
Teacher rubric → Student assignment → Rubricly processing → AI processing → Suggested grade/feedback → Teacher review
AI-generated results may include suggested scores, feedback, standards tags, explanations, and other grading assistance. AI-generated results may contain errors, omissions, or incorrect interpretations. Rubricly therefore treats AI-generated grading results as teacher-assistance outputs rather than final educational decisions — teachers remain responsible for reviewing AI-generated results and determining the final grade or feedback provided to students.
Rubricly does not make autonomous decisions concerning student discipline, admissions, school placement, special education eligibility, student expulsion, student suspension, or other high-impact decisions concerning students.
Rubricly uses the OpenAI API to process rubric information and student assignment content for the purpose of generating AI-assisted grading results. Relevant text and images from a grading request may be transmitted to OpenAI for processing.
Rubricly configures applicable OpenAI API requests not to store model responses for OpenAI's API application-state storage where that option is available. However, this setting does not mean that Rubricly can guarantee that every piece of information associated with an API request is immediately deleted by OpenAI. OpenAI's applicable API data-processing, security, abuse-monitoring, and retention policies may apply to information transmitted through the API.
Rubricly does not currently have an OpenAI Zero Data Retention agreement in place. Accordingly, Rubricly does not represent that student assignment information transmitted to OpenAI is subject to zero retention. Rubricly does not authorize OpenAI to use student assignment information for advertising or student profiling. Rubricly will update this Privacy Policy if its OpenAI data-processing or retention configuration materially changes.
When Google Classroom is connected, the general data flow is:
Google Classroom → Rubricly → AI processing provider → Rubricly → Teacher
Rubricly retrieves the specific classroom information and student submissions selected by the teacher, and temporarily processes that information to provide the grading service. Rubricly does not send student assignments back to Google as part of the grading process. Google separately processes information according to Google's own privacy policies and terms.
Rubricly does not sell student personal information. Rubricly may share or transmit information in limited circumstances, including:
Rubricly may process student information as directed by the school, school division, or authorized teacher for educational purposes.
Student assignment information may be transmitted to OpenAI to provide AI-assisted grading.
When authorized by a teacher, Rubricly communicates with Google's APIs to retrieve classroom information and student submissions.
If a teacher upgrades to a paid Pro subscription, payment information is collected and processed directly by Rubricly's payment processor, Stripe — Rubricly does not receive or store full card numbers.
Rubricly may use service providers necessary to operate the Services, including providers for cloud infrastructure, security, authentication, transactional email delivery, error monitoring, technical support, AI processing, and other infrastructure functions. Such providers are permitted to process information only as necessary to provide their contracted services and subject to applicable contractual and legal requirements.
Rubricly may disclose information when reasonably necessary to comply with law, legal process, or a valid governmental request.
Rubricly may disclose information when reasonably necessary to protect the security, rights, property, or safety of Rubricly, its users, schools, or students.
Rubricly may rely on third-party service providers to operate portions of the Services. Principal third-party services currently include:
| Provider | Purpose | Handles student data? |
|---|---|---|
| OpenAI | AI processing for grading assistance | Yes |
| Google Classroom/Drive API integration when authorized | Yes | |
| Stripe | Payment processing for Pro subscriptions | No — teacher billing only |
| Resend | Delivery of account emails (e.g. password reset) | No — teacher email only |
Rubricly may also use infrastructure and security providers (such as its hosting platform and database provider) that process limited technical information. Rubricly requires applicable service providers to process information only for authorized purposes and to maintain appropriate security and confidentiality protections. Rubricly will update this table as the Services evolve.
Rubricly follows a data-minimization approach and is intentionally designed to retain as little student information as reasonably necessary.
Uploaded rubric and student assignment files, including files imported from Google Classroom, are automatically deleted from Rubricly's active application storage after grading is completed, typically within seconds. Rubricly does not intentionally maintain a permanent repository of student assignments.
Rubricly does not currently store grading results in a persistent server-side database. During the current implementation, grading results are maintained only in the teacher's active browser session and a short-lived in-memory job status used to show live progress while grading, which is cleared automatically. Rubricly does not currently provide persistent grading history.
Unlike student assignment data, a teacher's account information — name, email address, a securely hashed password (never the password itself), and subscription/usage status — is retained persistently for as long as the account exists, so the teacher can sign back in and their plan and usage are remembered correctly. A teacher may request deletion of their account and this information at any time by contacting us. A short-lived, single-use password-reset token (expiring after one hour, or immediately once used) is stored temporarily when a password reset is requested.
Google authorization information used for an active Classroom session is held in server memory while actively being used and is not written to a persistent database. The connection is cleared after inactivity or a server restart.
Rubricly does not intentionally create persistent backups of student assignment files or grading results. Technical service providers may maintain limited infrastructure-level records or logs necessary to operate and secure their services. If Rubricly introduces persistent grading history, cloud storage, or backups of student work, this Privacy Policy will be updated accordingly.
Rubricly maintains administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and security of information processed through the Services, including, as applicable: HTTPS/TLS encryption for information transmitted to and from Rubricly; restricted access to production systems; protection of API credentials and application secrets; role-appropriate access controls; measures designed to prevent student content from being included in application logs; automatic deletion of temporary assignment files; read-only permissions for the Google Classroom integration; and security monitoring and troubleshooting measures.
Rubricly continually evaluates its security practices as the Services develop. No internet-based service can guarantee absolute security, and Rubricly cannot guarantee that unauthorized individuals will never defeat security controls.
If Rubricly becomes aware of unauthorized access to, acquisition of, or disclosure of student personal information, Rubricly will take reasonable steps to: investigate the incident; contain and remediate it; determine what information may have been affected; preserve relevant information necessary for investigation; cooperate with the affected educational institution; and provide notification where required by applicable law or the parties' agreement. Additional incident-response requirements may be established in a Data Processing Agreement or Student Data Privacy Agreement with a school or school division.
Student assignments and related information may constitute education records or personally identifiable information from education records under the Family Educational Rights and Privacy Act ("FERPA"). When Rubricly is engaged by a school or school division to provide grading services, Rubricly processes student information on behalf of the educational institution and for authorized educational purposes.
Rubricly will use and disclose student information only as necessary to provide the Services, comply with applicable law, or as otherwise authorized by the educational institution. Where applicable, Rubricly will operate pursuant to the educational institution's written agreement and applicable FERPA requirements governing school officials and service providers. A school or school division may establish additional requirements through a Data Processing Agreement, Student Data Privacy Agreement, or other written agreement. This Privacy Policy does not replace or supersede a separate agreement between Rubricly and an educational institution.
Rubricly may process information relating to children under 13 when Rubricly is used by or on behalf of a school or educational institution. When applicable, Rubricly will comply with the Children's Online Privacy Protection Act ("COPPA") and applicable Federal Trade Commission requirements.
In the educational context, schools may authorize educational technology providers to collect and process children's information for authorized educational purposes. Rubricly will limit such processing to the educational purposes for which the Services are provided and will not use student information collected through school authorization for unrelated commercial purposes. Rubricly does not knowingly require students to provide unnecessary personal information in order to participate in the educational service, and does not use children's information for targeted advertising, behavioral advertising, marketing profiles, unrelated commercial purposes, or training or fine-tuning Rubricly's own AI models. Rubricly will reasonably assist schools in responding to applicable requests concerning children's information.
Rubricly is designed to support compliance with applicable Virginia student-data privacy requirements. Virginia law establishes requirements for covered school service providers, including requirements concerning transparency, privacy policies, security programs, access and correction, authorized uses, deletion, and restrictions on targeted advertising, profiling, and sale of student personal information.
To the extent applicable to Rubricly and a particular school or school division relationship, Rubricly will: provide clear information concerning student information processed through the Services; maintain a student-data privacy policy; maintain a comprehensive information-security program reasonably designed to protect student information; support applicable access and correction requests; process student information only for authorized purposes; require applicable service providers to comply with relevant privacy and security obligations; delete student personal information upon an authorized school or school-division request within the period required by applicable law or agreement; and not knowingly use student personal information for targeted advertising, unauthorized student profiling, or sale of student personal information.
Virginia law also permits certain uses of student personal information for purposes such as maintaining, developing, supporting, improving, or diagnosing a school service, subject to applicable requirements. Rubricly will limit such activities to uses permitted by applicable law and the school's agreement.
Depending on applicable law and the relationship between Rubricly and the educational institution, individuals may have rights concerning personal information processed through the Services, including access to personal information, correction of inaccurate information, deletion of information, obtaining an electronic copy of information where required, information concerning how data is processed, and other rights provided by applicable law.
When Rubricly processes student information on behalf of a school or school division, requests concerning student education records should generally be directed to the educational institution. Rubricly will reasonably assist the educational institution in responding to applicable requests. Because Rubricly is designed to delete student assignment files after grading, Rubricly may not retain information that can be provided after a session has ended.
Rubricly does not claim ownership of student assignments, student education records, or school-provided educational information. When an educational institution provides student information to Rubricly, the institution retains control of that information subject to applicable law and the parties' agreement. Rubricly processes such information only for authorized educational and service-related purposes.
Rubricly does not use cookies or tracking technologies for targeted advertising or behavioral advertising. Rubricly uses a technically necessary cookie to keep a signed-in teacher authenticated, and may use other technically necessary cookies or browser storage for purposes such as security, session management, and maintaining application functionality. Rubricly does not use student assignment content for advertising or behavioral tracking. If Rubricly introduces analytics, advertising, or other tracking technologies in the future, this Privacy Policy will be updated as appropriate.
If Rubricly undergoes a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and contractual obligations. Any successor entity acquiring student information will be required to comply with applicable privacy obligations and agreements governing that information.
Rubricly may disclose information when required by law, subpoena, court order, or other valid legal process. Where legally permitted and reasonably appropriate, Rubricly will provide notice to the affected educational institution before disclosing student information in response to legal process.
Rubricly may update this Privacy Policy as the Services, technology, legal requirements, or data-processing practices change. The "Last Updated" date at the top of this policy indicates when it was most recently revised. If Rubricly makes a material change affecting how student information is collected, used, disclosed, retained, or protected, Rubricly will provide prominent notice and, where required, additional notice to affected schools or users. Rubricly will not materially expand the permitted use of student information in a manner inconsistent with applicable law or an educational institution's agreement without taking the steps required by applicable law or agreement.
If you have questions, concerns, or requests concerning this Privacy Policy or Rubricly's privacy practices, please contact us at jdbeasley5@gmail.com. Schools and school divisions may also contact Rubricly regarding Data Processing Agreements, Student Data Privacy Agreements, security practices, subprocessors, or student-data requests.