Privacy Policy

KosClass (kosclass.com) is a classroom app for teachers, run by Chereuta Kostiantyn (an individual), Da Nang, Vietnam. For teachers' account data, KosClass is the data controller and processor. Personal-data contact: privacy@kosclass.com; general help: support@kosclass.com.

When you create an account and use KosClass:

• Your email address and name; your Google profile picture if you sign in with Google.
• Your password — stored only as a one-way scramble (nobody can read it, us included).
• How you sign in (Google / email), your plan (Free / Premium and its end date), when you joined and were last active.
• When you agreed to the Terms and this Policy, and which version.
• How many times you used the AI "Create from photo" feature (for the daily limit).
• Administrator notes about the account (e.g. Premium given, account blocked) and why.
• What you send us when you ask for help.

Your classes, kept in your account: classes, students' names and avatars, groups, points and points history, gems, attendance, the games you make, folders, profile details (such as school, country and grade) and your settings. They are stored on our server in Vietnam so you can open them on any computer; the browser you are using keeps a copy, which is removed when you sign out.

Technical data: when you open a page, Cloudflare (our network and security provider) processes your IP address and browser details to deliver the page, block attacks and run the robot check. Our server in Vietnam keeps no access log. We use no analytics, advertising or tracking tools.

We do not collect sensitive personal data (such as health, religion, biometrics or location) and never ask you for it.

KosClass is for teachers and parents aged 18 and over. Students do not create accounts; they only sign in with the class code and PIN from the teacher, in the cases in "Parent accounts and learners' sign-in". Student details (names, avatars, points, attendance) are entered by the teacher and kept in the teacher's account on our server in Vietnam; the teacher (or the centre or school) decides how they are used and is responsible for them, including when they are shown on a screen in class.

Under Article 24 of Law 91/2025/QH15, a child's personal data is processed with the consent of a parent or guardian, and making public information about the private life of a child aged 7 or over also needs the child's consent. Under Article 60 of Decree 330/2026/ND-CP, processing the data of a child aged 7 or over needs the consent of both the child and the parent or guardian. Teachers and centres need this consent before entering student data.

We never sell student data, never use it for advertising, never build profiles of students and never send student data to AI. KosClass processes student data on behalf of, and on the instructions of, the teacher or centre: only to store the classes and show them to them (see the Terms of Use, "Student data").

From 29 November 2026 (earlier for teachers who press "I agree" to this version).

• Parents connecting to their child: the teacher gives the family a code for that one learner. The parent makes a KosClass account (email or Google), types the code, confirms they are the child's parent or legal guardian, confirms the child's age (under 16 / 16 or older) and that the child knows and agrees (for a child aged 7 or over). The class's teacher must approve each parent. At most 4 parents per learner. We keep: who connected to which learner, when, the version of the consent text, and the teacher's decision.
• What a parent sees: only their own child — points, gems, avatar, points history and lesson reports. Never another learner. The teacher sees the name and email of parents waiting or connected.
• Learners signing in: with the class code and a 6-digit PIN from the teacher — no email, no password. A learner under 16 can sign in only after a parent connected and switched on "Let my child sign in" (Law 91/2025/QH15, Article 24; under the Law on Children a child is under 16). Learners 16 or older (by the class's setting) can sign in themselves. A learner sees only their own points, gems, avatar and history — never the reports sent to parents. At the first sign-in the learner presses "I agree" themselves (and a learner signing in without a parent confirms "I am 16 or older") before seeing anything; we keep the time and the version.
• Age check: the teacher sets the class's age group; the parent confirms the child's age when connecting; a learner aged 16 or over confirms it at the first sign-in. Each confirmation is kept with its time.
• Stopping guesses: after 5 wrong tries from one address, that class code is locked for 15 minutes for that address. We keep only a hash (it cannot be read back) of the code and the address, for 15 minutes.
• Taking consent back: a parent can switch off their child's sign-in or disconnect at any time on the "My children" page; the child's sign-in stops at once. "Ask to delete my child's data" deletes the connection, the child's sign-in sessions and consents on our server at once and asks the teacher to delete the child's data from the class. A parent can also write to privacy@kosclass.com.
• Where and how long: on our server in Vietnam. Learner sign-in sessions: 30 days. Parent connections: until the parent disconnects, the teacher removes them, or the teacher's account is deleted.

From 28 November 2026 (earlier for teachers who press "I agree" to this version).

• The data: the phone number of a student's parent or guardian, entered by the teacher; and the lesson reports the teacher sent (the text and the date).
• Why: only so the teacher can send a report about that one student to that student's own parent. Reports are written automatically from the lesson's points, from ready-made sentences, on the teacher's own device — no AI. The teacher reads, edits and sends each one.
• How it is sent: KosClass never sends reports to parents by itself. When the teacher sends a report to a connected parent's account, KosClass emails that parent a short notice (no child's name, no report text; at most one email every 12 hours; switched off on "My children"). When the teacher presses "Copy and open Zalo", the text is copied on the teacher's device and Zalo opens a chat with that number; the teacher pastes and sends it from their own Zalo account. Sending through Zalo falls under the teacher's own terms with Zalo (VNG Corporation, Vietnam); KosClass sends no data to Zalo.
• Who can see it: the class's teachers (the owner and co-teachers). Nobody else, including other parents. Reports are never sent to a class group.
• Consent: the teacher (or the centre or school) is the controller and must have the parent's consent before saving the phone number and sending reports. A parent can ask at any time to stop receiving reports or to have the number deleted — to the teacher, or by writing to privacy@kosclass.com.
• Where and how long: in the teacher's account on our server in Vietnam, while the class exists; the teacher can delete it at any time.

In UnikCloud, learners join with a code or QR code on their phone — no account, no name. We receive only: the answer the learner types (at most 40 characters), a random code the phone's browser makes (so each phone sends at most 3 answers per question) and the IP address (to stop abuse).

• While the room is open, each answer is held only in our server's memory in Vietnam and deleted when the room ends (at most 2 hours; 20 minutes when a teacher uses it without an account).
• If the teacher has an account, the word cloud is saved automatically in the teacher's account on our server in Vietnam ("Your clouds"): the question, the words shown on the screen and how many people sent each — no names and no phone codes. It is kept until the teacher deletes it or the account is deleted. Without an account, nothing is saved.
• Answers are anonymous by default. Only when the teacher turns on "Ask learners' names" for a class do phones show that class's names for each learner to tap their own; the big screen still shows only words, and the saved cloud also records which learner sent which word, in the teacher's account like the class's points.
• On the screen, answers show without names. Rude words are blocked automatically; the teacher can remove any word.
• The random code is kept in the phone's browser ("cx_cloud_phone") and contains no personal information.
• A picture of the cloud the teacher saves is saved on the teacher's own computer, not on our server.

Teachers should remind learners not to type names, phone numbers or other personal details into their answers.

• When you share a game in the Library, every KosClass teacher sees it and the name you set in KosClass (as its author) — never your email, school or classes.
• We count how often a game is played and copied, not who played it.
• When you report a game we keep the reason, your note and your account to review it; the author is never told who reported it.
• Pictures in games you save (for example from Pixabay, or in a game imported from a link) are copied to our server so they keep showing.
• When an account is deleted its games leave the Library and the counts and reports about them are deleted.

• When you invite a teacher to teach a class with you, we email the address you type and keep it with the invite (for up to 30 days, or until it is answered or cancelled).
• When they accept, they see that class’s data — learner names, points, groups, attendance — as you do. The class stays stored in your account in Vietnam; no copy is made.
• Teachers of a class see each other’s names (the name set in KosClass, never the email). Each new point records which teacher gave it.
• When you delete the class, take a teacher out, or delete your account, they no longer see the class.

• If you create an account through an invite link, we record who invited you. The inviter sees only your first name, the day you joined and whether you bought Premium — never your email, classes or amounts.
• When you pay for Premium we record the amount, plan, how and when you paid, to give Premium, handle refunds and give invite rewards.
• When you create an account and when you sign in, we keep your internet address (IP) and a random code for your browser ("cx_dev"), only to spot people inviting themselves and to protect the admin dashboard. Never for advertising or tracking.
• For each signed-in device we keep the browser and system name (for example “Chrome on Windows”) and when it was last used, so you can see it and sign it out in My profile & settings.
• All of this is deleted with the account.

• Create and keep your account, let you sign in, send sign-in codes and account emails (e.g. Premium ending soon) — to provide the service you signed up for, based on your consent.
• Keep your classes in your account, so you can use them on any computer.
• Provide Premium, the AI feature and fair-use limits.
• Keep KosClass safe: robot checks, stopping break-ins, blocking accounts that break the rules.
• Answer help requests and requests about your data.
• Meet obligations under Vietnamese law (e.g. when a competent authority requires it).

We do not sell or rent data. Only these providers process data for us, and only as far as needed:

Photos for "Create from photo" are sent to Google only to make the questions; we do not keep them. Do not photograph students' faces, names or details. We give data to state authorities only when the law requires it.

KosClass's server is in Vietnam (a data centre in Vietnam, with encrypted backups also in Vietnam). Teachers' accounts and classes are stored on this server; each sign-in and page load still passes through Cloudflare (which runs the website) on its way there. Using Cloudflare, Google and Pixabay (section 5) is a transfer of personal data abroad; we transfer only what each task needs and meet the cross-border transfer obligations of Law 91/2025/QH15 and Decree 356/2025/ND-CP.

• Your account and related data: while the account exists; deleted within 15 days after you ask.
• Sign-in sessions: 30 days. Sign-in codes: 10 minutes. Failed sign-in records: 15 minutes. Records of emails sent: 24 hours.
• Encrypted backups: daily copies 35 days, monthly copies about 13 months, then deleted automatically.
• Classes in your account: while the account exists; a class you delete stays in the bin for 30 days, then is gone.
• The copy of your classes in your browser: removed when you sign out.
• Parents' phone numbers and the reports sent: while the class exists, or until the teacher deletes them.

• Every connection uses HTTPS (encrypted in transit).
• Passwords are hashed with PBKDF2-SHA256 and their own salt; sign-in codes and session tokens are stored only as hashes.
• Robot checks on sign-up, sign-in and password reset; temporary lock after repeated wrong passwords.
• The server accepts only key-based logins (no passwords), with a firewall and automatic security updates.
• Backups are encrypted with AES-256 before they leave the server.
• Only administrators with two-step verification can reach account data.

Under Law 91/2025/QH15 you have the right to:

• be informed about the processing of your data; give or refuse consent; withdraw consent;
• see and correct your data, and ask for a copy of it;
• ask for deletion; ask us to restrict processing; object to processing;
• complain, report, take legal action and claim compensation as provided by law.

Send your request to privacy@kosclass.com from your account's email (so we know it is you). We confirm receipt within 2 working days and complete the request within 15 days. Withdrawing consent or deleting your account data means closing the account, because the service cannot work without it; the classes in the account are deleted too. Before that you can back up your classes yourself under Account → My data.

We use no advertising or analytics cookies. Google sets its own cookies on Google's pages when you sign in with Google.

If we find that personal data has been exposed, lost or accessed without permission, we fix it at once and notify the personal-data protection authority (Ministry of Public Security) and the people affected within the time the law sets (no later than 72 hours where the law requires).

For important changes (e.g. collecting a new kind of data or adding a provider) we tell you at least 15 days ahead by email or in the app, and ask for consent again where the law requires. The date and version are at the top of this page.

Personal data and your rights: privacy@kosclass.com. General help: support@kosclass.com. You may also complain to the personal-data protection authority of the Ministry of Public Security.