Hosting & Data
| Hosting provider | Amazon Web Services (AWS) |
|---|---|
| Hosting region | US (AWS us-east-1, N. Virginia). Single-region architecture — all customer data is processed and stored together in this one region. |
| Encryption | Encrypted in transit (TLS 1.2 or later) and at rest. |
| Student data collected | We do not require students to give us a legal name, home address, phone, or government ID. School Edition accounts may use initials or a pseudonym. LTI launches always use an opaque LMS user id (sub). If the school's LMS is configured to send name and/or email, we receive what the school sends so we can provide the service. Assignment scores may return to the LMS gradebook (AGS). See the Privacy Policy, Students & LTI section. |
| Staff/teacher data collected | Name, email address, school, class details — for account management and class rosters only. |
| Data retention | Personal data is kept while the account or institutional license is active. In-app Delete Account immediately removes the Firebase Authentication login. After a verified deletion request (website form or school email), remaining personal data is removed within 30 days, except aggregated analytics that cannot reasonably identify the person and records we are legally required to keep. See /delete-data. |
| Subprocessors | AWS (hosting), Firebase (authentication and mobile analytics), RevenueCat (consumer subscriptions/entitlements), Stripe (School Edition web checkout — card numbers stay with Stripe), Google Analytics 4 on this website (consent-gated). We do not display ads and we do not sell personal information. |
Certifications
1EdTech LTI Advantage Complete
Certified April 21, 2026. Registration ID
IMSD2C6C25C26C27pl2026W1.
All four constituent services held:
- LTI 1.3 Core
- Deep Linking 2.0
- Assignment & Grade Services 2.0
- Names & Role Provisioning Services 2.0
Public verification: https://site.imsglobal.org/certifications/playwithasl
Accessibility
WCAG 2.1 AA — see our full Accessibility Conformance Report (VPAT® 2.5).
This report is an internal architecture-level review, not yet a hands-on third-party assistive-technology audit. A third-party audit is planned but has no confirmed date yet.
Data Residency
Play With ASL's infrastructure is built natively on AWS. Today, our production environment runs in a single AWS region (us-east-1, USA), and all customer data — regardless of institution location — is currently processed and stored there together, in-region. We have not yet stood up additional regional deployments, but because our stack (database, compute, storage) is AWS-native and region-portable by design, we're able to scope dedicated regional hosting (e.g., Canada, EU, APAC) for institutions with in-country data residency requirements as part of a specific partnership engagement.
Incident Response & Security Contact
If a security or privacy incident affects customer data, we notify affected institutions within 72 hours of confirmation.
Contact us with any security or privacy concern: privacy@playwithasl.com