Effective date: September 8, 2026  | Version 1.0 

---

 

1. Purpose and Relationship to the UT Web Privacy Policy

Deafverse is operated by the National Deaf Center on Postsecondary Outcomes (“NDC”), a program within the University of Texas at Austin (the “University”). Deafverse is governed by the University’s Web Privacy Policy as supplemented by this Notice. This Notice is a “local” policy adopted under Section 3 of the Web Privacy Policy and applies specifically to student users and to schools, districts, and educators that use Deafverse for an educational purpose. Where this Notice provides protections more specific than the University’s general policy with respect to student data, this Notice governs.

2. Our Role: School Official Under FERPA

When Deafverse is used for a school purpose, NDC acts as a “school official” performing an institutional service or function for which the school or district would otherwise use its own employees, under the direct control of the educational institution with respect to the use and maintenance of education records, consistent with FERPA (34 C.F.R. § 99.31(a)(1)). NDC uses education records only for the authorized educational purpose and does not re-disclose them except as permitted by FERPA or directed by the institution.

Children under 13 (COPPA). Deafverse is an educational game that may be used by students under the age of 13. NDC collects only the limited information needed to provide the educational service and does not use it for advertising or any commercial purpose. When Deafverse is used in a school context, NDC relies on the school as the agent of the parent to provide consent on the parent’s behalf, consistent with the Children’s Online Privacy Protection Act (COPPA), and limits its use of student information to the educational purpose authorized by the school. Where Deafverse is used outside a school context, verifiable parental consent is obtained before an account is created for a child under 13.

3. Information We Collect

For a Deafverse account, we collect only what is needed to operate the game and support learning:

• Name
• Email address (not required for Student accounts created by a teacher)
• Password, stored only as a salted hash (bcrypt); no plaintext passwords are stored
• IP address and device/browser information
• Accessibility preferences (e.g., text size/display, audio on/off)
• Session data and gameplay history (progress, items viewed/earned)

Guest accounts use randomized credentials and do not save progress. We do not knowingly collect more information than is described here.

4. How We Use Information

We use student information solely to provide, secure, and improve the Deafverse educational service, including authentication, saving progress, sending transactional emails (email confirmation and password reset), and IRB-authorized research and evaluation to improve the game and NDC’s technical-assistance services for deaf individuals and the professionals who serve them. Any research or reporting use of student data is limited to de-identified, aggregate form.

Accessibility data. Deafverse collects accessibility preferences (such as text-size, display, and audio settings) solely to deliver an accessible experience to deaf and hard-of-hearing users. NDC treats this information as sensitive, scopes it strictly to service delivery, and never uses it for advertising and never sells it. Some states classify accessibility-related and authentication data as protected personal information; NDC handles such data accordingly in all jurisdictions.

5. What We Will Never Do

• We do not sell, rent, or trade student data.
• We do not use student data for targeted advertising or build advertising profiles.
• We do not use student data for any commercial or non-educational purpose.
• We do not claim ownership of student data or student-created content; it remains the property of the student and/or the contracting institution.
• We do not use Google Analytics or similar third-party advertising trackers. We use Vercel Analytics only for anonymized aggregate visitor statistics.
  
  

6. Data Sharing and Sub-Processors

We share student information only with service providers that process data on our behalf and under contract to operate Deafverse (for example, transactional email and hosting providers such as Postmark/Mailchimp and our hosting infrastructure). These providers are bound to use the data only to perform services for NDC. We otherwise disclose student data only as directed by the contracting institution or as required by law.

7. Data Ownership, Retention, and Destruction

The contracting institution retains ownership and control of student education records. NDC will, at the institution’s request and upon termination of the relationship, return or destroy student personal information, except where retention is required by law or by the University’s records-retention obligations. De-identified data may be retained for research and product-improvement purposes.

8. Security

Deafverse is served entirely over HTTPS. Passwords are hashed with bcrypt, and stored data is encrypted. NDC follows the University’s information-security program and incident-response procedures.

9. Data Breach Notification

In the event of a security breach affecting student personal information, NDC will notify the affected institution(s) without unreasonable delay and, where the institution is in a state requiring a defined timeline (including Connecticut’s 48-hour standard under PA 16-189), within that required timeframe. NDC will cooperate with the institution’s breach-response and notification obligations.

10. State Law Compliance

NDC complies with applicable state student-privacy laws and enters into the data privacy agreement that each state or district requires. The commitments in this Notice, including purpose limitation, the prohibitions on sale and targeted advertising, vendor non-ownership of student records, return or deletion of data on request, and breach notification to the district within 48 hours, apply in every jurisdiction and are intended to meet or exceed the strictest applicable state standard, so they do not change as additional states are added. Where a state or district requires specific contractual terms, NDC executes the corresponding agreement or addendum.

11. Educator Responsibilities

Educators are responsible for reviewing their school or district policies and obtaining any parental or student consent required by law or local policy before using Deafverse with students. Schools in states requiring a data privacy agreement may request NDC’s standard agreement at the contact below.

12. Your Rights and Contact

Students, parents, and institutions may request access to, correction of, or deletion of personal information, subject to applicable law and the University’s records-retention schedule. These rights operate alongside the rights described in the University’s Web Privacy Policy. To exercise a right, request a data privacy agreement, or ask a question, contact our Help Team.