This policy explains what Playalong Machine collects, why, and what we do with it. We have tried to write it in plain language rather than boilerplate, because the people who need to read it are teachers, school administrators and parents.
It covers two websites we operate:
AMK Learning Lab LLC, 4501 N Concord Ave, Portland OR 97217. Questions, requests and complaints: privacy@amklearninglab.com.
Nothing personal. There is no account and no sign-in. Your browser stores a few settings on your own device — such as light/dark theme and practice preferences. That information never reaches us and is not shared with anyone.
A student signs in with their school Google account to join a class. Our sign-in asks Google for two things only, openid and email; it does not ask for the student's name, photo or any other profile detail, and none is received. Our server checks that the account is school-managed and that its email domain matches a class, keeps the domain, and discards the email address without storing or logging it. In place of an account, the student's device holds an anonymous session, and our database keeps a one-way code made from Google's account number. The code lets a student who signs in again, on any device, return to their classes; on its own it does not reveal who the student is. We never request contacts, calendar, Drive, or any other Google service.
| What we hold | Why |
|---|---|
| A one-way code made from Google’s account number | Lets a student return to their classes on any device. We cannot turn it back into an email address or a name. |
| The school’s email domain | Confirms the student belongs to a school that uses our service. This check happens on our server and cannot be faked by the browser. |
| Which devices are signed in | Links each of the student’s devices, each an anonymous session with no name or email, to their classes. |
| Class membership and the date joined | Connects a student to their teacher's class. |
| The date the student was last seen | Lets us delete the record automatically once a student stops using the service. |
A school-managed account is required. Google identifies managed accounts with a “hosted domain” claim. If that claim is absent — as it is for a personal Gmail address — the sign-in is refused and nothing is kept. The domain must also match a class that is actively using the service.
The name a student's classmates see is typed by the student on their own device (we suggest a first name and last initial). It is kept only on that device and shown to the class during live sessions; we never store it.
Teachers join by invitation. We hold the teacher’s Google account email, their school email domain, their role, and the classes and songs they create. Teacher sign-in requests three scopes: openid, email and profile.
We sometimes run demo classrooms for adults at professional-development sessions and conferences. A demo participant types a name and an email address; there is no Google sign-in and no account is created. A demo session closes automatically after four hours, and the names and email addresses entered are deleted when it ends or expires. Demo classrooms are for adults and are never used with students.
Songs authored in the creator — chord charts, strumming patterns, tab, drum parts, section structure — are teaching material, not personal information. They are linked to the teacher account that created them.
Information we receive from Google is used only to operate the features described above: to sign you in, to confirm a student belongs to a participating school, and to connect a student to their class. For a student, the email address is read only to take its domain and is then discarded.
Songs play along to videos hosted on YouTube, shown through YouTube's embedded player. We use YouTube API Services to show them. We embed that player in privacy-enhanced mode (youtube-nocookie.com), which limits the information YouTube stores about viewing on our site.
YouTube is operated by Google and its handling of your information is governed by the Google Privacy Policy. We do not control it, and we do not receive viewing data back from YouTube.
We use a small number of providers to run the service. They process data on our instructions.
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database and sign-in | Teacher accounts; for students, anonymous sessions, the one-way code, the school’s domain and class membership |
| Cloudflare | Website hosting and delivery | Standard web request data |
| Sign-in provider | Email address, Workspace domain | |
| YouTube (Google) | Video playback | Governed by Google's own policy |
| Zoho | Company email (privacy@ and hello@) | The contents of emails you send us, such as privacy and deletion requests |
We do not use advertising or tracking cookies. We store a small amount of information in your browser to make the app work: your sign-in session, your theme choice, a saved class code, the name a student chose to show their class, and practice settings such as tempo. Clearing your browser data removes all of it.
Traffic is encrypted in transit. Our database provider encrypts data at rest. Access to records is restricted at the database level so that an account can reach only the data it is entitled to — a student their own membership, a teacher their own classes. If we confirm a breach of personal information we hold, we will notify the affected schools and account holders without undue delay, and no later than 30 days after we confirm it, describing what happened, what information was involved, and what we are doing about it. Where a school’s own agreement with us sets a shorter deadline, that deadline applies.
We keep a student's record and class memberships while the student is using the service. A student who has not signed in or opened their class for 12 months is deleted automatically, together with the sign-in of every device they used. A device sign-in that was never linked to a student is deleted after 30 days. A teacher can remove a student from a class at any time.
Because we do not know who a student is, we cannot find a student's record by name or email. A student can delete all of their information at any time with Delete my data in My Class, which removes their record, class memberships and the sign-in of every device at once. A school can have every student record for its domain, or for a class, deleted by emailing privacy@amklearninglab.com; we will do it within 30 days and confirm when it is done.
This service is provided to schools for classroom use. Where students are under 13, we rely on the school to provide consent on behalf of parents, as permitted under the Children's Online Privacy Protection Act (COPPA) when a service is used for a school-authorised educational purpose.
We use student information only to provide the service to the school. We do not use it for advertising, we do not build profiles for any purpose other than the classroom activity, and we do not disclose it except as described in this policy.
Parents may ask the school to review or delete their child's information. Because the records we hold do not identify any student, a single child's record is deleted from that child's device (Delete my data), or by the school deleting its students' records as a whole; the school can reach us at the address above. We do not knowingly collect information from children under 13 outside of a school relationship — sign-in requires a school-managed account, which prevents it.
Where information we hold forms part of a student’s education records, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), under the direct control of the school with respect to the use and maintenance of those records. The school retains ownership and control of student data. We also comply with the student-privacy laws of the states in which the schools we serve are located, including the Oregon Student Information Protection Act (ORS 336.184) and Washington’s student data privacy law.
If we change this policy we will update the date at the top. If a change materially affects how student information is handled, we will notify participating schools directly rather than relying on a quiet update.
AMK Learning Lab LLC, 4501 N Concord Ave, Portland OR 97217 · privacy@amklearninglab.com