HamptonianXPrivacy at RePAX
RePAX is built for middle-school classrooms. Collect the least, protect what's collected, and keep it in the school's hands.
- Students sign in with their DroneWorks account (RePAX receives only an alias and a per-app ID), or with a class code, an alias and a one-time access code. RePAX never asks for a student's name, email address or student ID number.
- Teachers and administrators see student work by alias only. Leaderboards are off unless a teacher turns them on, and they use aliases.
- There is no advertising, no public profile, no social feed and no student-to-student messaging.
- Pax Patterson activities open on the provider's own site. RePAX never sees or stores provider passwords.
- Student records are never sent to external AI services. The optional Module Studio planner sends only the teacher's own text, and only when an administrator turns it on.
- Administrators can export or delete a student's RePAX data.
What RePAX stores
- Students
- An alias chosen by the teacher (must include a number), the class, a hashed one-time access code, and — only if your school connects DroneWorks sign-in — a pairwise DroneWorks subject identifier. No names, emails, birthdates or student ID numbers.
- Learning records
- Simulation attempts (the inputs a student made, and the server-computed score and feedback), module progress, skill evidence, XP, achievements, rewards earned, Pax Patterson activity status (opened / marked complete / verified / returned), and short optional notes a student writes (contact details are removed automatically).
- Teachers and administrators
- Name, school email, role, a hashed password, and an audit trail of administrative actions.
- Teacher uploads
- Sticker images, MP3s and album artwork, stored privately and served only to staff and to students who unlocked them.
Security
Role-based access on every request, tenant isolation between schools, hashed secrets, httpOnly sessions, rate-limited sign-in, server-verified scoring, private file storage and an audit log. Administrators can export or permanently delete a student's records and set retention periods.
What RePAX never does
No advertising, tracking pixels, public profiles, social feeds or student-to-student messaging. No student records are sent to AI services. Pax Patterson activities open on the provider's site — RePAX never sees provider passwords. Paxton/Patterson activities are licensed separately by your school and open on the provider's own site. RePAX is not affiliated with or endorsed by Paxton/Patterson.
These are technical safeguards. They support, but don't by themselves establish, compliance with FERPA, COPPA (where applicable), or district and state student-data requirements — that also takes district policy, agreements and review.