Loom for Schools
School security & privacy
A plain-language summary of what happens to student information when a school, university or library uses Loom. Last reviewed October 3, 2026.
This is a summary, not a contract. It does not replace our Terms of Service or Privacy Policy, which govern if anything here differs. Points marked Under counsel review describe arrangements our counsel has not yet confirmed.
1 What we collect about students, and why
| What | Why |
|---|---|
| Name and email address — from the school’s invitation, a sign-up on the school’s verified email domain, or the learning platform (LMS). An LMS launch also sends the student’s role and course. | To sign the student in, put them in the right course, and show their name to their teacher. |
| Seat record — the institution, the role on the licence, and when the seat was granted. | To give the access the licence pays for, and no more. |
| Class records — classes joined, assignments, when work was started and handed in, whether it was late (stamped by our server’s clock), and the teacher’s feedback. | So the teacher can run the class. |
| The student’s work — the cards, quotes, notes, claims and connections they make, the history of how the investigation was built, the frozen versions they hand in, and any images they upload (screened automatically for safety). | It is the work itself. |
| Research assistant conversations — the question and the contents of the investigation it is answering from. | To answer. Kept fourteen days after the last message unless the student pins the thread. |
| Technical records — sign-in and security records, and error reports. | To keep the service working and secure. Error reports carry no personal information beyond an internal account identifier. |
2 Who can see it
- The student sees everything they made.
- Their teacher sees the class roster, who has started and handed in each assignment and when, the frozen versions handed in, and the feedback they gave. A teacher does not see a student’s other investigations unless the student invites them.
- The institution’s administrators see the roster (name, email, role, seat status) and an audit log of administrative actions. The licence’s data export adds an index of members’ investigations — title, size and visibility — never their contents.
- Classmates see only what a student chooses to share: an investigation they invite someone into, a frozen version they send for peer review, or an investigation they publish. An institution can switch publishing to the public wall off for all its members.
- Anyone with the link to a frozen version. A hand-in is a permalink so a teacher or an examiner can open it without an account. Its address is long and random, the page is marked not to be indexed by search engines, and only the student can list their own versions.
- Temple Seven staff, under role-based access, when needed to support the institution or keep the service running.
3 No advertising, no selling
We show no advertising, work with no advertising partners, and do not sell student information or use it for marketing. We process it on the institution’s behalf to provide the service the institution licensed. Under counsel review
4 Analytics are off for school accounts
For anyone signed in with a school seat, or who arrived through their school’s LMS, site analytics (Google Analytics for Firebase) are switched off and their account is never attached to analytics — whatever the cookie banner says. Students do not choose the tools their school gives them, so we do not rely on a click from them.
Until we know whose account is signed in — the first moment of a visit — analytics stay off for everyone. For people without a school account, analytics run only after they accept analytics cookies.
5 Getting data out
- Institutions download a JSON export of the licence, its roster, its audit log and an index of members’ investigations from the licence page, without a support ticket.
- Students export their own investigations — to Word, an essay outline, BibTeX and RIS for reference managers, GraphML and CSV, or an image.
- A full copy of an account is not yet self-serve: ask privacy@templeseven.com and we prepare it.
6 Deletion requests
- A student can delete their account from their Account page. It can be restored for seven days; after that, private account data is deleted permanently. A deleted investigation can be recovered for seven days, then is deleted.
- An institution can ask us to delete or return its students’ records by writing to privacy@templeseven.com. Parents, guardians and students should raise requests about school records with the institution first; we work with the institution to answer them.
- What a deletion does not reach automatically. Frozen versions are permanent by design — nobody, the student included, can edit or delete one — and an investigation’s history is kept after the investigation is deleted. A request to erase personal information from them is reviewed by our staff under the law that applies. Under counsel review
- Legal hold. While an institution has legal hold switched on, nothing belonging to it can be permanently deleted, by anyone, including by the retention policy below.
7 When a member leaves
Removing someone frees their seat at once, and deletes nothing. Their account and their investigations stay theirs; they simply lose the access the licence was providing.
The institution decides how long it keeps their class records. An administrator can set a retention period on the licence page. Once a person has been gone that many days, a daily job takes them off the rosters of classes taught by the institution’s teachers and deletes those classes’ hand-in records for them (the started / handed in / late / feedback rows). It never deletes the person’s investigations or the frozen versions they made, does nothing while legal hold is on, and stops if the person rejoins. Each run is recorded in the institution’s audit log as counts, without names.
With no retention period set — the default — class records are kept for as long as the class exists.
When a licence ends, its records are deleted or returned at the institution’s request, except billing records, which we keep for seven years for tax purposes. Under counsel review
8 Security
- HTTPS only, with HSTS preload and a Content Security Policy.
- Every change to who holds a seat or who is in a class goes through our server, never straight from a browser, and seat changes are written to the institution’s audit log.
- Frozen versions cannot be changed by anyone after they are made, and the time on a hand-in comes from our server’s clock, not the student’s device.
- Stored content files are served through signed links that expire after thirty minutes.
- Rate limiting on abuse-prone and sensitive actions, optional two-factor sign-in, and automatic safety screening of uploaded images.
- LMS launches are refused unless they come from a platform we have registered with the institution, and are checked against that platform’s signing keys.
No system is perfectly secure. If a breach affects personal information and the law requires notice, we notify those affected and/or the relevant regulator as that law requires.
9 Who processes it for us
The service providers that handle student information when a school uses Loom:
| Provider | What for |
|---|---|
| Google LLC — Firebase and Google Cloud | Sign-in, the database, file storage, hosting and server functions; Cloud Vision for page text and image safety screening; the Gemini API for the research assistant, which receives the question and the investigation it answers from. |
| Resend | Delivering email — invitations, class and investigation notifications, sign-in and security email. |
| Sentry | Error reports, with no personal information beyond an internal account identifier. |
| Copyleaks | An originality check of an investigation’s text — only when someone runs one. |
| Stripe, Inc. | Payments — for example a licence paid by card, or a purchase someone makes in our store. Class records and investigations are not sent to Stripe. |
| The institution’s own LMS | Over LTI 1.3, the identifiers needed to launch Loom and return a linked investigation. |
We have not yet verified each AI provider’s model-training terms, so we make no statement here about whether a provider trains on what it processes for us. Under counsel review Our full list of providers is in Section 12 of the Privacy Policy.
10 Age
Personal accounts are for people aged thirteen and over (sixteen where local law sets a higher age). Younger students use Loom only through a school or other institution that licenses it, and that institution is responsible for any parent or guardian consent the law requires. Under counsel review
If your institution needs a data-processing or student-privacy agreement, write to us — the standard terms we offer institutions are being reviewed by our counsel.
11 Contact
Privacy questions and requests: privacy@templeseven.com. Licences, pilots and LMS setup: contact@templeseven.com, or request a pilot. Our mailing address is in the Privacy Policy.