Mosaic Privacy Policy
Effective September 15, 2026 · Updated October 29, 2026 · Back to Mosaic · Terms of Service
Mosaic is a classroom vocabulary-puzzle website operated by James Kohn, an individual teacher, as an independent project. It is not owned, operated, or endorsed by any school district. This policy explains exactly what information the site collects, why, where it is stored, and how to have it removed. It is written to be readable by parents, students, and school technology staff.
The short version
- Students never create accounts and are never asked for an email address, password, birthday, photo, or student ID.
- The only information a student provides is the name they type when joining a puzzle and their answers to that puzzle.
- No information is sold, shared with advertisers, or used for any purpose other than showing the teacher how the class did.
- There are no ads, no advertising trackers, and no analytics cookies.
- Any teacher, parent, or school can request deletion of a student's data at any time by email, and it will be deleted within 10 days.
What is collected, and from whom
| Who | What | Why |
|---|---|---|
| Students | The name typed into the "Your name" box (the teacher decides what students enter — it may be a first name and last initial, a nickname, or a class number); the puzzle code they joined; their tile placements at submission; their score; time taken; when they started and finished; how long the puzzle tab was open and active; and a random identifier stored in the browser so a student can return to an unfinished puzzle (this also lets the teacher see when two names were entered from the same device). | So the teacher can see which student completed the puzzle and which terms the class is struggling with. |
| Teachers | Email address and either a password (stored in hashed form, never readable by anyone) or, for teachers who choose "Sign in with Google," the name and email address on their Google account; plus the puzzles they create. New teacher accounts are switched on by the site operator before they can create puzzles. | To sign in and see results for their own puzzles. |
| All visitors | Standard web server logs (IP address, browser type, pages requested), kept automatically by the hosting provider for security and error diagnosis. | Operating the website. |
Mosaic does not collect grades from any gradebook, does not integrate with any school system, and does not ask for any information beyond the above.
What is not collected
Student email addresses, passwords, dates of birth, photographs, physical addresses, phone numbers, government or district ID numbers, location data, or anything from a student's device beyond the answers they submit. The site does not use Google Analytics or any similar tracking service, and it does not use cookies to track students.
Where the information is stored
- Database: Supabase, Inc. (United States, US-East region). Supabase is a database hosting provider; it stores the data and does not use it for its own purposes. Supabase privacy policy.
- Web hosting: Netlify, Inc. (United States). Netlify delivers the web page and keeps standard server logs. Netlify privacy policy.
- Pictures: The artwork revealed in puzzles is public-domain art loaded from the Art Institute of Chicago's public image server (artic.edu). Like any image on the web, their server sees the requesting IP address. No student information is sent. Art Institute privacy policy.
- Fonts: The page loads two typefaces from Google Fonts. When a font is loaded, Google's servers see the requesting IP address, as with any web font. No student information is sent to Google. Google Fonts privacy FAQ.
- Teacher sign-in with Google: Teachers (never students) may sign in through Google. Google then confirms the teacher's name and email address to the site and nothing else; the site receives no access to the teacher's Google Drive, Gmail, or Classroom. That sign-in step is governed by Google's privacy policy.
Data is transmitted over encrypted connections (HTTPS) at all times.
Who can see student data
Only the teacher who created a puzzle can see the submissions for that puzzle. Students cannot see other students' names, answers, or scores. Access rules are enforced by the database itself, not just by the web page. The site operator (James Kohn) has administrative access to the database for maintenance and for fulfilling deletion requests, and does not view student results for any other purpose.
How the information is used
Student information is used only to display results to the teacher who assigned the puzzle. It is never used for advertising, never sold, rented, or traded, never used to build a profile of any student, and never shared with any third party other than the storage providers listed above, who process it solely to run the service.
How long it is kept
Puzzle results are kept until the teacher deletes the puzzle or requests deletion, and in any case no longer than the end of the school year following the one in which they were submitted (at most about 21 months). Server logs are retained by the hosting provider for at most 30 days.
Deleting information
A teacher, parent, guardian, student, or school official may request that any student's information — or all information from a class or school — be deleted by emailing the address below. Requests are honored within 10 days, and confirmation is sent by reply. No account or verification hoop is required beyond enough detail to identify the records (for example, the puzzle code and the name entered).
Children's privacy
Mosaic is designed to be used by students under the direction of their teacher. Because students do not create accounts and no contact information is collected from them, the site does not communicate with students directly and cannot be used to contact them. Student information is handled as educational-record information under the teacher's control, and requests from a parent or school regarding it are honored as described above.
Security
Teacher passwords are stored using industry-standard one-way hashing. Database access is restricted by row-level security rules so that a request can only read or write the records it is entitled to. All connections use HTTPS. If a security incident affecting student data ever occurred, affected teachers would be notified by email without unreasonable delay so they could inform their school.
Changes to this policy
If this policy changes, the effective date at the top will be updated. Changes that reduce privacy protections will not be applied to information already collected without notice to the teachers who collected it.
Contact
Questions or deletion requests: kohnhistory@gmail.com
Operator: James Kohn, Texas, United States. Mosaic is an independent project and is not affiliated with any school district.