Skip to main content

Privacy Policy

Last updated: March 2026

1. Who we are

CoStudy is a peer evaluation platform for higher education, built and operated by Aleph Null LLC ("CoStudy," "we," "our," or "us"). We help professors run research-backed peer evaluations in their courses through native Canvas LTI integration.

This Privacy Policy describes how we collect, use, store, and protect information when you use our platform at platform.costudy.co and our marketing site at costudy.co (together, the "Services").

2. FERPA compliance

CoStudy treats all student data as educational records under the Family Educational Rights and Privacy Act (FERPA). We act as a "school official" with a legitimate educational interest when processing student data on behalf of institutions and professors.

  • Access controls: Student evaluation data is accessible only to the professor of record for each course and authorized CoStudy support staff operating under strict confidentiality obligations.
  • No re-disclosure: We do not disclose personally identifiable student information to any third party except as required to operate the Service or as required by law.
  • Data retention: Course data is retained for the duration of the professor's active account plus one academic year. Professors may request earlier deletion at any time.
  • Institutional deletion requests: Institutions may request deletion of all student data associated with their courses by contacting privacy@costudy.co. Deletion requests are processed within 30 days.

3. Information we collect

a. Information you provide

  • Account information: Name, email address, and institutional affiliation when you create an account or request a demo.
  • Course data: Roster information imported from Canvas via LTI, including student names, email addresses, and group assignments.
  • Evaluation responses: Peer evaluation answers, ratings, and written feedback submitted by students through the platform.
  • Support communications: Messages you send to our support team.

b. Information collected automatically

  • Usage data: Pages visited, features used, and interaction patterns to improve the platform experience.
  • Device and browser information: IP address, browser type, operating system, and device identifiers.
  • Cookies: We use essential cookies for authentication and session management. We use analytics cookies (which can be disabled) to understand how the platform is used.

4. How we use your information

We use information we collect to:

  • Provide and operate the peer evaluation platform
  • Generate team health dashboards and student report cards
  • Sync course rosters and groups from Canvas
  • Send evaluation invitations and reminders to students
  • Provide customer support
  • Improve the platform based on aggregated, de-identified usage patterns

5. What we never do with your data

We never sell, share, or monetize student data. Period.

  • We do not sell personal information to anyone
  • We do not share student data with advertisers
  • We do not use student data for targeted advertising
  • We do not build marketing profiles from student information
  • We do not charge students to use the platform

6. Data storage and security

  • Location: All data is stored on servers located in the United States.
  • Encryption: Data is encrypted at rest and in transit using industry-standard TLS encryption.
  • Access controls: Internal access to production data is restricted to authorized personnel and protected by multi-factor authentication.
  • Backups: Regular encrypted backups ensure data availability and disaster recovery.

7. Data sharing

We share information only in these limited circumstances:

  • Infrastructure providers: Hosting, database, and email delivery services that process data on our behalf under strict data processing agreements.
  • Legal requirements: When required by law, court order, or to protect the safety and rights of our users.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify affected users before any such transfer.

8. Your rights

Regardless of where you are located, you have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate information.
  • Deletion: Request deletion of your personal information. We will honor deletion requests within 30 days, except where retention is required by law.
  • Export: Request your data in a portable, machine-readable format.

For EU/EEA users: You have additional rights under the General Data Protection Regulation (GDPR), including the right to restrict processing and the right to object to processing. Our legal basis for processing is legitimate interest (providing the educational service) and, where applicable, consent.

9. Canvas LTI integration

When professors connect CoStudy to their Canvas course, we receive roster and group data through the LTI 1.3 protocol. Students access CoStudy through Canvas using their existing institutional credentials. CoStudy never collects separate login credentials from students. No new account creation is required.

10. Children's privacy

CoStudy is designed for use in higher education. We do not knowingly collect information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of material changes by email or through the platform. The "Last updated" date at the top indicates when the policy was most recently revised.

12. Contact us

For privacy-related questions, data requests, or concerns:

CoStudy is a product of Aleph Null LLC.