Privacy Policy

Distil EDU is operated by Youssef Mohamed Hamdy, based in Sheikh Zayed, Giza, Egypt.

The school, college or tutor using Distil EDU decides which students are entered and why, and is the data controller for that educational information. The operator processes it to provide the service on their instructions. The operator is separately responsible for the staff-account, security and operational processing it determines. These responsibilities depend on the actual relationship and applicable law; a school's separate data-processing agreement may set out further instructions and safeguards.

If you are a parent or a student and want to know what is held about you, ask the school or the teacher who marks your work first - they can see and change it directly. Questions about the platform itself go to privacy@distiledu.com.

You can register publicly by continuing with a verified Google account; no invitation is needed. This creates a teacher account with its own empty workspace if the address is new. An administrator can also create an account. A teacher can invite somebody to be their assistant by email; nothing about that person's account changes unless they sign in with that address and accept. An account holds:

• the name and email address supplied by Google or the person creating the account, and an optional title such as “Dr”, used for teacher attribution on exported documents;
• the roles held - any combination of administrator, teacher and assistant - and, for an assistant, which teacher they work for. No password is stored: staff sign in with Google;
• whether the account is active or paused, and which administrator paused it and when;
• interface preferences: the chosen colour theme, and which columns that person wants on an exported sheet.
• any short-lived messages sent to or from that account through the in-app staff messaging feature, including the text of the message and the sender’s name and email address. These delete themselves - see the retention section below.

If a member of staff connects a Google account, Distil EDU also stores that account's Google identifier and email address, the permissions granted, and the access tokens themselves encrypted. Those tokens are what allow the platform to read a class roster or return a mark on that person's behalf. Revoking Google access stops future authorised API use; removal of the stored connection is a separate request to the operator.

If you link accounts in Settings, we store which accounts you have linked after you authenticate with Google for each. This lets you access your linked teaching workspaces from one login. Each school's records and assistants stay in its own workspace. Only active linked teacher workspaces are included; administrator roles and workspaces merely assisted in do not transfer. Google actions on an owned class use its owning account's connection, including that account's Drive for sheets and attachments. Removing a link ends that shared access without deleting records or revoking Google permissions.

Plan records can include workspace and billing-account membership, assigned tier, plan dates, administrator changes and reasons, and usage counts. Active-student usage records hold a Google Classroom or local student identifier, the term, when usage was counted and which staff member triggered it. These records enforce limits and resolve usage questions. Online payments are not currently enabled; this launch service does not collect payment-card details.

Activity records may include staff identifiers, email and roles, the action and time, record identifiers and labels, action details, and the request IP address and browser user-agent where available. These support security, troubleshooting and accountability.

There is no parent portal. A student's class records are created by their teacher, or imported from a linked Google Classroom course. A student's own account (section 4) is separate from these records and never gives access to anybody else's. The class records hold:

• the student's name, the name last reported by Google and whether staff corrected it, an internal reference code, and class membership;
• their Google Classroom identifier, where the class is linked to a course;
• marks, grades, absences, and whether each piece of work was handed in, handed in late, or not handed in;
• lesson attendance dates and statuses, including present, absent, late or excused, who recorded them and when;
• up to two parent or guardian contacts per student - a name and a phone number - and whether that family has been opted out of automated messages;
• a student email address, only where the teacher or Google Classroom supplied one.

The current forms do not collect parent email addresses.Messages home use WhatsApp or printed reports. Older installations may contain legacy fields until the operator removes them; removing a field from a form does not itself erase older records.

Submission records can include local staff notes, draft and assigned marks, return times, Google submission identifiers and states, hand-in timestamps and manual overrides. Local notes are not sent to Classroom or included in parent messages by the platform.

Class records include the subject, school and teacher attribution, optional crest, assessment instructions, components, deadlines, attachment references, grading boundaries and report settings. Student work can be fetched from Classroom and opened in Google Drive's preview. Files selected or uploaded through Google Picker are handled by Google; the platform uses their identifiers and links for attachments. The same student may have separate records in several classes.

A teacher may also save Google Meet or Zoom join links, a WhatsApp group invite link, and the next class title, time and duration. These details are available to the teacher and their assistants. Opening a link takes you to that provider. Copying an invitation or downloading a calendar event includes the meeting link; it does not automatically notify students. A student can also download a calendar file (.ics) for the next class from their class page. It is made in the student's own browser from what that page already shows - the class, its teacher, the time, the meeting link and a link to the class page, never the WhatsApp group link - and nothing is sent to us or to a calendar provider when it is made. A downloaded file is a copy: it does not update itself if the class is rescheduled, and it stays in the calendar it was added to until the student removes it. WhatsApp group members may see one another's phone numbers. Replacing a saved link here does not revoke the old invitation at its provider.

Where the student portal is available, a student can create their own account on the student sign-in page by continuing with Google, the only way a student signs in. Signing in asks Google only for the student's basic identity - name, email address and profile picture - and for no access to their Classroom, Drive or other Google data. The student sign-in page uses the same Cloudflare security check as the staff one, and new accounts are rate limited.

A student account holds:

• the Google account identifier, and the email address and whether Google verified it, as Google reported them at sign-in;
• the student's name (taken from Google and editable), a link to their Google profile picture, and - asked when they first sign in - their year or grade and their school, plus an optional short bio;
• when the account was last active, the “Show when I'm online” and notification-sound settings, and two-step verification if the student turns it on;
• which roster records the account is connected to, and the history of each connection: when it was requested, approved, declined, made, moved to another record, suspended, reactivated or ended, and by whom.

A student account sees nothing until it joins a class. There are two ways to join. A personal invite from the student's teacher, one of their assistants or an administrator is a link or an eight-character code for one place on the class list, which works once and expires (between ten minutes and thirty days after it is made). While an invite is still usable, its link and code are kept encrypted so staff can copy or resend it; that copy is removed when the invite is used, revoked or replaced, and an expired one is never shown again. A class code is one eight-character code a teacher shares with the whole class; anyone who has it can use it until staff reset it, turn it off or it expires. It is stored as a one-way hash plus an encrypted copy so staff can show it again.

Joining with a class code creates a record on the class list from the student account's Full Name, with a new student code. Unless the class's teacher turns approval off, staff must approve each student who joins this way: until then the student sees only the class's name, its teacher and that they are waiting, and staff see the request with the student's name, how they signed in and their sign-in email. Declining removes the new record if nothing has been recorded on it yet. Staff can also match a student who joined with the class code to a record already on the class list; the new record is then removed and the student's account is connected to the existing one. Staff can suspend, reactivate or end a student's access to a class and undo a join within a week; the teacher can unlink the account or switch the student portal off for the class.

Classes waiting for you from Google Classroom. A class linked to Google Classroom has a class list imported through its teacher's own Classroom connection, which holds each student's Google account identifier as Classroom reports it. When a student signs in with Google, Distil EDU compares the Google account identifier from that sign-in with those identifiers - never a name or an email address - and, where one matches a record that no account has joined, shows “Your teacher's class … uses Distil EDU” with a Join button. This needs no extra Google permission from the student and no access to their Classroom: it uses only the identifier their sign-in already provides. Joining this way connects the account to the record already on the class list (no new record or student code is made) and follows the class's approval setting, exactly as a class code does. A match never gives access by itself. Not Now hides the offer for that class; the list of classes a student dismissed is kept with their account. Staff see “Matches a Distil EDU student account” on a record whose joined account has the same Google identifier.

A student sees their own classes - the class name, subject and teacher - and the online-class rooms and next class time their teacher saved, but never the class WhatsApp group link. They can open the profiles of their own teachers and assistants. Students never see each other: there is no list of classmates, and no student's profile is shown to another student. The student portal shows a student a homework mark and their teacher's written feedback only after the teacher returns that homework; it shows no other marks.

Announcements and materials. A teacher or assistant can post announcements and materials to a class, with up to five photos each - for example a photographed paper notice. Every student whose access to that class is approved sees what is published there, including students who join the class later; a student waiting for approval sees nothing. A post stores its title, text, optional topic, who wrote it and when, and whether it was edited or withdrawn. Withdrawing a post removes it from students at once; staff still see it.

Posts copied from Google Classroom. For a class linked to Google Classroom, Distil EDU copies the course's published announcements and materials into the class's announcements and materials, reading them through the teacher's existing Classroom connection (no new permission is asked of anyone). A copy keeps the text as Classroom gives it, when it was created and last changed, a link back to Classroom, and its attachments as links only - the title and address of each Drive file, YouTube video, web link or Google Form. No attachment is downloaded or stored, and no Drive sharing is changed: a student can open an attached file only if Google already lets them. Drafts, scheduled posts, posts meant for individual students and the class's Grades post are not copied. Copies are kept in step: an edit in Classroom updates the copy, and a post deleted in Classroom is withdrawn from students. Staff can hide a copy from students but cannot edit it. Students are notified only about copies Classroom published in the last three days.

Photos. A photo is stored in the class teacher's own Google Drive, in a folder the app creates, and is never shared from Drive with students or anyone else. Before it is stored, its details such as the camera, the time and the location (EXIF and GPS) are removed, and it is re-saved as a new image. A small preview copy is kept in our database so a class page loads quickly. Students only ever see a photo inside Distil EDU, and each time one is opened the app first checks that the student still has approved access to that class, so a suspended or removed student cannot open it again. If the teacher deletes the photo from their Drive, students see that it was removed.

Homework. A teacher or assistant can show a homework to a class's students. Students with approved access see its instructions and due time, and can hand it in with a written answer (up to 20,000 characters) and up to ten photos or PDF files of up to 20 MB each. While they work, an unsent draft of their answer is saved; their teachers and assistants cannot see a draft. Each hand-in is kept as a separate, unchangeable version with the time our server received it, whether it was late, and its files, and the student gets a receipt. The class's teacher and assistants see the handed-in versions, mark them in the gradebook and can write feedback for the student; they can also give one student a later due time, which is recorded. The student sees the mark and the feedback only after the teacher returns the work. Other students never see a student's answer, files, mark or feedback. Homework photos and files are stored in the class teacher's own Google Drive, in a folder the app creates, and are never shared from Drive with anyone: photos have their camera, time and location details removed and are re-saved, PDF files are kept as sent, and each file is opened only inside Distil EDU after a check that the person may see it. A file a student uploads but never hands in is deleted after about 24 hours, unless it is kept in their saved draft.

Lectures. A teacher or assistant can add a recorded lecture to a class, by uploading a video or choosing one from the class teacher's Google Drive. Staff can also link one Google Drive folder of lecture videos to a class: Distil EDU stores that folder's identifier and name, and adds the videos staff choose from it as hidden drafts. The video stays in the class teacher's own Google Drive; Distil EDU keeps its title, module, order and publication time. Only a video staff show to students is shared; hidden videos and the rest of the folder are not shared by Distil EDU, but anyone the teacher shared the folder with in Google Drive themselves can still see everything in it. When a lecture is published, every student with approved access to the class who signed in with a Google account is given view access to that video in Google Drive, so it can play in Google's own player on the lesson page or open in Google Drive (on an iPhone, Google may first ask the student to allow its cookies in the player). To do that, the student's Google email address is shared with the teacher's Drive file and appears in that file's sharing list, where the teacher (and anyone else who can manage the file in Drive) can see it. Google does not email the student about it. While a student watches, Google sees that they are viewing the video, under Google's own terms and privacy policy. A student without a Google sign-in is told they need one to watch. When a student is suspended, their access ends, they are removed, their account is deleted, or the lecture or class is deleted, the lesson disappears from Distil EDU at once and their Drive access is removed in the background, usually within minutes; until Google confirms, staff see “Removing access”, and copies already downloaded or recorded cannot be recalled. Distil EDU only removes access it gave; access the teacher shared in Drive themselves is left as it is and shown to staff. A student can mark a lecture as completed: this is their own record, never a grade or attendance, and staff see only how many students marked it.

Class materials (PDFs). A teacher or assistant can upload PDF files for a class. Each file is stored in the class teacher's own Google Drive (in a “Materials” folder for the class) and is never shared from Drive; Distil EDU keeps its title, module, order, size and when it was shown. A student with approved access to the class can view or download it only through Distil EDU, which fetches the file from the teacher's Drive each time and stamps every page with the teacher's name, the Distil EDU name and web address and, if the teacher has added one in Settings, the teacher's phone number, so a copy passed on outside the class still leads back to the teacher. The stamp carries nothing about the student, and staff see the same stamp. The stamped copy is made in memory and not kept. The teacher can replace the large text across each page with their own words and choose how strongly it shows. A teacher's phone number and watermark text for materials are optional, set and removed by the teacher, and shown only on their class materials. When a student loses access, or the file is hidden or deleted, they can no longer open it in Distil EDU; copies already downloaded cannot be recalled.

Problem reports. On a lecture or a material, a student can report a problem by choosing one of a few reasons (such as “Can't open video”) and adding an optional note of up to 500 characters. The report records which lecture or material it is about and its version, the reason, the note, when it was sent and the student who sent it; nothing else is collected (no link, screenshot or device details). The class's teacher and assistants see the reports, including who sent each one, and mark them resolved; other students never see them. A student sees only their own reports and whether they were resolved.

Private questions. Where the teacher allows it, a student can privately ask about an announcement, material, lecture or homework. A question records which item it is about and its version, the student who asked, the messages (plain text, up to 2,000 characters each), when each was sent or edited, and whether it is open, answered or closed. Only that student and the class's teacher and assistants see it; other students never see a question, who asked it or how many questions there are. A student can edit or delete their own message until staff reply after it, and close their question. Staff can reply, mark it answered, reopen it, and hide a student's message, which the student then sees as “Removed by staff”; hiding is recorded in the audit log by reference only, never with the words. To limit misuse, the number of messages a student can send in an hour and in a day is limited, counted from the messages they have sent. A student who loses access to the class no longer sees their questions; staff still do.

Class Q&A. When an answer helps everybody, the teacher or an assistant can write a Class Q&A: a question and answer shown under the item to every student who can see it. It is a separate staff record. The editor starts from the student's question (their words, never their name) and the staff reply, and staff edit both before publishing, taking out anything that identifies a student. Nothing on it shows who asked or links to the private question it came from. Staff can edit or withdraw it.

Profiles. Staff and students have a profile page with their name, role, Google picture or initials, optional bio and the classes in common with the person viewing it, limited to classes that person can already see. A student's profile, including their year and school, is visible to the teachers and assistants of the classes they have joined; an administrator sees only a student's name, role and online status. Students see their own teachers' and assistants' profiles but never an email address. Staff see one another's profiles under the same rule as staff messaging. Profiles never show marks, attendance or phone numbers.

Online status. The time an account was last active is recorded at most once a minute while it is being used, including while a signed-in page is open and visible. Others who can see the profile see it as “Online”, “Active 5 min ago” or “Last seen” with a date. Turning off “Show when I'm online” in Settings hides it from everybody else.

Today and Catch up. A student's Home shows their next class, homework due, what is new and marks returned this week, all from the class records already described here. To show what is new since the last visit, the app records when the student last opened Home (at most once a minute). Nobody else sees it, and it is deleted with the account.

Notifications. The bell shows in-app notifications. A teacher and their assistants are told when a student joins one of their classes, or asks to join with the class code. Students are told when a new announcement or material is published in a class they have approved access to, and again only when the teacher chooses to tell them about a change. They are also told when a homework is shown to their class, about a day before a homework they have not handed in is due (a reminder sent by our background service), and when their own homework is returned, when a lecture is published, and when a class material (PDF) is first shown to them. A teacher and their assistants are told, at most once a day per lecture or material, when students report a problem with it; the notification gives a count, not names. They are also told when a student asks a private question (once per question until one of them opens it, with a count of new messages but never the student's name or words). A student is told when their own question is answered, and when a Class Q&A is first published on an item they can see. A notification about a post, homework or lecture that is later withdrawn, or about a class the student can no longer see, is hidden. A notification stores only identifiers; names are looked up when it is shown, and one about something you can no longer see is hidden. Notifications are deleted 90 days after they are created. The optional notification sound is made by your browser; nothing is downloaded for it.

Phone notifications. Students and staff can choose to receive phone or computer notifications for the updates their bell shows. They are off until you press Turn On in Settings on that device, and your browser then asks for permission. Each device that turns them on stores a registration: which account it belongs to, a random identifier for that browser, the browser's push address and encryption keys (stored encrypted), a general device label such as “Chrome on Android”, and when it was last used. A student's notification repeats the line their bell shows: the class teacher's name and the title of the item, for example “Mr Hamdy posted: Week 3 notes” or “New homework: Waves Reading, due Thu”. It never contains another student's name, a mark, or the text of a post, an answer or a question. A staff notification that a student joined or asked to join does not name the student. Because a phone can show notifications on its lock screen, anyone who can see the phone may see these titles; to hide them, turn notifications off in Settings, or set the phone to hide notification previews on the lock screen. Tapping it opens the app, which checks again that the update is still yours to see. A device belongs to one account at a time: turning notifications on for another account on the same browser removes the first. Turn Off, Remove (for another device), signing out on that device and deleting the account all stop them; a notification a phone has already received cannot be taken back.

Leaving. “Delete my account” in Settings deletes the student account, its sign-in identities, its class connections, its notifications and its unsent homework drafts at once and ends its access to every class; files it uploaded that were never handed in are then deleted from the teacher's Google Drive in the background. Homework it handed in and the teacher's other class records stay with the class. An account that never joins a class is deleted automatically about 30 days after it was created (the clean-up runs once a day on a schedule, so it can happen up to a day later). An account whose classes end is kept until the student deletes it. A student account can be converted into a teacher account once; that ends its class access and cannot be undone.

Parent alerts require a staff action. The platform proposes a list, a member of staff reviews it on a confirmation screen and can remove anybody from it, and only then is anything sent.

There are two routes, and they differ in who handles the message:

• By hand. The platform opens a WhatsApp chat on the teacher's own device with the text prepared. The message travels through the teacher's own WhatsApp account, and Distil EDU sends nothing itself.
• Automatically. Where the school has configured it, the parent's phone number and the message are sent to Meta's WhatsApp Business service for delivery.

Alert records include the student and class, reasons and occurrence counts, recipient phone numbers, message body, sending staff member, time, route, and any provider message identifier or error. API acceptance and a staff-confirmed manual send are recorded differently; neither proves that a parent read the message. Failed attempts may also be recorded. Successful records help suppress repeated alerts about the same recorded circumstances.

A printable student report can also be shared as prepared WhatsApp text. This separate sharing route does not create the same alert-history record. When API messaging is unconfigured, a dry run sends nothing and may write the proposed phone number and message to server logs.

Distil EDU does not sell personal data, does not use it for advertising, and does not use it to train machine-learning models. It is used for the educational and operational purposes described here. Providers involved in delivering the service include:

• Google (sign-in, Classroom and Drive) - account identity, rosters, coursework, submissions, attachments, announcements, returned marks and live sheets, according to the connected features and permissions granted. Student sign-in uses Google for identity only.
• Meta (WhatsApp Business) - a parent's phone number and message on the API route. On the manual route, WhatsApp also handles the prepared chat and any message you send through your own account.
• Resend - email delivery, used for three things only: telling a member of staff an administrator created their account, telling somebody a teacher invited them to assist, and sending a student's class invite to the email address the teacher chose. Resend receives the recipient address and email content and reports delivery events, bounces and complaints. Public self-registration does not send an invitation email. Parent alerts are never sent by email.
• Cloudflare (Turnstile) - a security check on the sign-in pages (only there) that tells people from automated traffic, using signals from the visitor's browser, including IP address and browser and connection information. We send the challenge token and client IP address for verification. See the Cloudflare Turnstile Privacy Notice. It is not used by this platform for advertising.
• MongoDB Atlas - the database the records are stored in.
• Railway - the hosting provider that runs the application and its scheduled background tasks.
• Push services - when you turn on phone notifications, your browser's own push service delivers them: Google (Chrome, Edge and Android), Apple (Safari on iPhone, iPad and Mac), Mozilla (Firefox) or Microsoft (Windows). It receives an encrypted message that it cannot read (the line described under Phone notifications), the device's push address, and when it was sent.

Teachers can access their own and verified linked teaching workspaces, and assistants can access the workspace of their assigned teacher. Holding both roles allows both kinds of access without changing ownership. Administrators manage accounts, totals and platform activity records; the administrator role does not open teaching workspaces. The one exception is adding a student: on the student-invite screen an administrator can see a teacher's class names and, for the chosen class, its students' names and student codes, in order to invite a student, and nothing else - no marks, attendance, homework, contact details or other class content. The activity log can nevertheless contain student or class names in record labels and details of actions. An administrator who also teaches sees only the workspaces authorised through their teaching or assistant roles.

The operator and authorised infrastructure personnel may need access to stored data or logs for support, security, recovery and legal obligations. Application role restrictions do not mean the hosting operator cannot access the database. Undelivered email in development can be written to server logs. Disclosures may also be required by applicable law.

Google sign-in opens an existing account or creates a teacher account through public registration, subject to security checks. With the permissions you grant, the integration can discover or create courses, read rosters and student work, manage coursework, topics, announcements and materials, and return grades. Syncs can run when signing in, opening a class or exporting, as well as when you press a sync button. For classes with approved students, the platform's background job also reads a linked course's announcements and materials, at most every two hours per class, using the class owner's connection; it stops if that connection lapses, until it is reconnected.

Sign-in requests the Classroom permissions and per-file Google Drive access together. Drive access covers files created by the app or selected for it through Google Picker, including attachments, live grade sheets and temporary files used for PDF exports. It allows reading and managing those files. Student work can also open in Google's preview under your Google access. Google Picker receives a short-lived access token in your browser. Older connections may retain broader permissions previously granted; review or revoke those in your Google account before reconnecting.

Photos added to class announcements and materials are uploaded into the class teacher's Drive through that teacher's connection, including when an assistant adds them, under the same per-file access. The app reads them back only to show them to staff and to students with approved access, and deletes them when the post or the class is deleted. If the connection is revoked, photos stop loading until the teacher reconnects.

Homework photos and files handed in by students are uploaded into the class teacher's Drive in the same way, through that teacher's connection; students never need a Google connection of their own for this. The app reads them back only to show them to the student who handed them in and to that class's teacher and assistants, and deletes them when the homework, the student or the class is deleted.

Lecture videos are the one thing Distil EDU shares from Drive. A video uploaded in the app goes from the uploader's browser directly to the class teacher's Drive (it does not pass through our servers), through an upload session opened with that teacher's connection. When an assistant chooses an existing video from the teacher's Drive, the assistant's browser receives a short-lived key, valid for about an hour, limited to the files Distil EDU can manage in that teacher's Drive (not Classroom or the rest of their Drive); each one is recorded. If Google will not issue such a limited key, only the teacher can choose existing files. To give students view access, Distil EDU adds each student's Google email address to the video's sharing as a viewer, and later removes only the access it added. If the teacher chooses “Stop viewers downloading”, Distil EDU changes that setting on the teacher's file. Distil EDU never deletes the teacher's video unless the teacher chooses to when deleting a lecture.

Distil EDU's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google data is not used for advertising, sold, or used to train general-purpose AI models.

Revoke access through your Google account connections. The current app does not offer a disconnect-and-delete control in Settings. Contact the operator to request removal of stored credentials; deleting the staff account also removes its stored Google connection. Revoking access does not erase stored credentials or previously imported records, uploaded files, returned marks or existing Classroom posts.

Update Live Sheet can share class-wide results. It uploads the selected grade workbook to the teacher's Drive and, for a linked course with the required Google permissions, also creates or reuses a published Grades material in Classroom. Included student names, marks and hand-in information are then visible to the course. This is a class sheet, not a private result page for each student.

The sheet follows saved export choices and student exclusions, and later updates overwrite the contents at the same link. Without a linked course, the new sheet is created in the teacher's Drive without the Classroom post. Existing sharing permissions on a reused file still matter. A downloaded workbook or CSV can also contain a whole class; student reports contain one student's results and class comparisons.

Publishing to Classroom can happen within the sheet-update action, without a separate publication step. Staff must check the audience and have authority to disclose the included information. Removing the post alone should not be treated as revoking file access: review Drive sharing too. Unlinking or deleting the local class does not remove the external sheet or recall copies already downloaded or messages already received.

Student pages are private links, not private accounts. When a teacher turns student pages on for a class, each student can be given a page at a long, random link, shown to whoever opens it without signing in. The link is sent to families - typically inside the parent alert message - and anyone it is forwarded to can see the page.

A student page shows that one student's name, class, school and teacher; their attendance; their homework hand-in states; the marks and grades the teacher has returned; class averages (only once at least five marks are returned, so an average cannot reveal another child's mark); plain-language notes when something needs attention; and the next online class's meeting link. It never shows other students, phone numbers, student codes, private comments, marks that have not been returned, or the class chat link. Teachers can switch individual sections off. Families can save a progress report from it as a PDF, which their own browser makes.

The link stays the same while the student is in the class, and stops working when they are removed. A teacher can replace a link (the old one stops working at once), any staff member can switch one student's page off, and a teacher can pause or turn off pages for the whole class. Pages are marked not to be indexed by search engines and tell browsers not to keep a copy. When a page is opened, the time is recorded at most once an hour; who opened it is not recorded. To have a page switched off, contact the child's teacher or the address in section 1.

• Class and student records have no automatic term-end expiry. Deleting a class removes its students, assessments, their marks, attendance, their hand-in records, and the record of any messages sent about them, together with its announcements, materials, their photos and the notifications about them. The copies of those photos in the teacher's Google Drive are removed in the background: the platform keeps retrying until Google confirms, and shows the teacher any removal Google has not yet confirmed until it succeeds or the teacher deletes the file themselves. Deleting a single post removes it and its photos the same way. A photo uploaded but never attached to a post is deleted after about 24 hours (the check runs hourly).
• A student moving between groups of a Group Set. When a teacher moves a student to another group of the same set, their marks on assignments the two groups share go with them, and everything else from the old group (other marks, attendance, hand-ins, questions) is deleted with their old record. When a linked Google Classroom course drops a student from a group in a set, their marks on the set's shared assignments are kept for up to 30 days, so they can follow the student if Classroom adds them to another group of the same set; they are then deleted automatically if that has not happened. Deleting the set or the teacher's workspace deletes them sooner.
• Copies of Google Classroom posts are kept in step with Classroom while the class is linked and are deleted with the class. Unlinking the class from its course withdraws them from students at once; staff still see them for 30 days, after which they are deleted (linking the same course again within that time restores them).
• Homework hand-ins - answers, saved drafts, every handed-in version, the files in the teacher's Google Drive, feedback and the related notifications - are kept as long as the class is. Deleting the homework, the student or the class deletes them; the Drive copies are removed in the background in the same way as photos. A student deleting their own account does not delete the homework they handed in to a class, which belongs to that class's record. Homework files uploaded but never handed in are deleted after about 24 hours unless kept in a saved draft; deleting the student account deletes its saved drafts, and their files are then deleted in the same way.
• Private questions and Class Q&A - questions, their messages and staff replies, and Class Q&A - are kept as long as the class is, and deleted with the item they are about or with the class. A student's questions are also deleted with their place in the class or with their student account; a Class Q&A, being a staff record, stays. A message a student deletes loses its text at once; an empty record of it stays only so the message limit cannot be avoided, and goes with the question.
• Lectures - their titles, modules and order, students' completion marks and problem reports, and the related notifications - are kept as long as the class is, and deleted with the lecture, the module or the class; completions and reports are also deleted with the student or the student's account. The videos stay in the teacher's Drive. The record of which student Google accounts were given, or must lose, view access to a video (the Google account identifier and email address, the file and the state of that access) is kept while the access exists and, after access ends, until Google confirms the removal - even after the class or the student's account is deleted, so that the removal can finish - and is then deleted after 30 days.
• The grade history - who changed which mark, and when, including saved score snapshots, absence flags, identifiers and staff email - has no automatic expiry and is retained after a student, assessment or class is deleted.
• Routine activity records, such as a sheet being exported or a roster synced, are scheduled to expire after 30 days. Database cleanup may occur shortly after that threshold.
• Security-relevant records - an account created, paused, linked, unlinked or given different roles, plan changes and messages sent to parents - are kept without automatic expiry. These can retain staff email, record labels, action details and request information after the original record is removed.
• Staff messages sent through the in-app messaging feature are deleted automatically: 24 hours after the recipient first opens one, or 30 days after it was sent if it is never opened, whichever comes first. The recipient can also delete one immediately. Nothing about the message - not its text, not who sent it, not that it existed - is written to the activity record. Copies outside the active messaging system, such as backups or screenshots, are subject to their own retention. Messages can only be sent between staff who share a workspace, or to and from an administrator.
• Student page links are stored as a one-way hash and an encrypted copy on the student's record, and are deleted with it. A cached copy of what the page shows is refreshed when the class changes and expires automatically 30 days after it was last built.
• Student accounts are kept until the student deletes them, except that an account which never joins a class is deleted about 30 days after it is created. A student's class connections and their history last as long as the roster record and the class: deleting the student or the class removes them. Records that an account was created, asked to join, joined or left a class, or deleted itself, stay in the activity record without automatic expiry, holding identifiers and counts.
• Class invites store only one-way hashes of the link and code, plus the encrypted copy described in section 4 while the invite is usable. The invite record is deleted automatically seven days after it expires.
• Class codes are stored on the class as a one-way hash and an encrypted copy. Resetting a code replaces both at once, and both are deleted with the class.
• Notifications are deleted automatically 90 days after they are created.
• Phone-notification registrations are kept while notifications are on for that device. Turning them off, removing the device, signing out on it or deleting the account deletes its push address and keys at once; the rest of the record (account, device label, dates) is deleted 30 days later. Delivery jobs for a notification hold only identifiers and are deleted 30 days after they finish.
• Assistant invitations hold the invited email address, an optional name, the inviting teacher and who sent it. They are deleted when accepted, declined or cancelled, and expire automatically 30 days after they were last sent.
• Email delivery records include the recipient, subject, delivery status, attempts and provider references, and are scheduled to expire after 30 days. Pending email bodies are encrypted and removed when sending completes or is abandoned. Bounced or complaining addresses are kept on a suppression list without automatic expiry until reviewed or removed. That list prevents further email and can also prevent new self-registration.
• Background job records track work the platform finishes after a change - removing a photo or homework file from a teacher's Google Drive, giving or removing students' view access to a lecture video, publishing a scheduled lecture, the scheduled clean-ups and the daily lecture-access check described here, a homework due-soon reminder, retrying an email. Each holds only identifiers (such as the class, the teacher's account and the Drive file), its status, the number of attempts and a short error description - never message text, an email address, a password or a sign-in token. A finished record is deleted automatically 30 days after it finishes. One that stopped retrying is also deleted after 30 days, except a photo removal from a teacher's Drive or a change to a lecture video's sharing, which is kept until it succeeds or is resolved. A summary of each background run (counts and timings only) is deleted after 7 days.
• Student usage records are scheduled to expire 400 days after the end of the relevant term. Deleting a student or class does not ordinarily remove that term's usage record. Account plan records have no automatic expiry. Database expiry cleanup can occur shortly after its scheduled time.

Deleting an individual student removes their active marks and submissions but does not itself delete their past parent-alert records. Class deletion removes those alert records. Removing a staff account removes its stored Google connection, but does not erase historical logs. Pausing an account preserves its data. Deleting local data does not delete Google or WhatsApp records, downloaded exports or printed reports.

The application has no self-service erasure control for retained audit records. Requests concerning those records require the operator's review under applicable law; the software's lack of expiry does not override legal rights or justify indefinite retention in every case. Provider logs and any backups follow their configured retention schedules; local deletion does not guarantee immediate removal from those systems.

• The platform stores no passwords: staff and students sign in with Google, which can enforce two-step verification. Anyone can also turn on two-step verification here with an authenticator app; its secret is encrypted and recovery codes are stored only as one-way hashes. Google tokens are encrypted with AES-256-GCM.
• Signed-in sessions end after 14 days without use or 60 days in total, by default, and then you sign in again.
• Access is limited to owned and verified linked teaching workspaces and any workspace the account is assigned to assist. That is enforced on the server for every request, rather than only hidden in the interface.
• Deleting or pausing an account takes effect on that person's next protected request. It cannot remove data already displayed, downloaded or shared outside the platform.
• Starting a sign-in on either sign-in page is rate limited and passes a Cloudflare Turnstile check that the server verifies. New registrations require a verified Google address and are also rate limited. Public registration does not bypass paused-account or workspace-access restrictions.
• Grade-save and activity histories support accountability for changes.

No system is perfectly secure. If you believe an account has been misused, contact privacy@distiledu.com and ask an administrator to pause it. Pausing blocks further protected requests and is reversible. While a teacher is paused, their students see each of that teacher's classes as paused and can open nothing in it or join it, and the teacher's Google connection is not used; resuming the teacher restores both.

Distil EDU holds information about school-age children, entered by their teachers. Where the student portal is switched on, students can also have their own accounts (section 4) to see the classes they have joined and hand in homework there (section 4). The platform does not advertise to children.

The platform analyses marks and hand-in records to calculate T-scores, quartiles and grades, and to flag low marks, missing work or absences against configured thresholds. These flags help staff decide what to review and whom to contact. They are not a diagnosis or an independent decision about a child: staff review results and authorise parent alerts. Students and parents can ask their teacher to explain or correct the underlying records and resulting assessment.

The lawful basis for holding a child's marks and a parent's phone number, and any consent needed before contacting a family, is the school's responsibility for its processing. The operator remains responsible for its own obligations. Applicable requirements for children's data and parental or guardian consent must be met before information is entered or shared, and before students are invited to create their own accounts. A student's alert opt-out stays set until staff change it; separate report sharing still requires staff to honour the family's communication preferences.

Subject to applicable law, you can request access to or a copy of your information, correction or deletion, and object to or seek restrictions on processing. Where processing relies on consent, you may withdraw it for future processing. Rights and lawful retention exceptions depend on the circumstances; agreeing to the Terms does not waive these rights.

For educational records, contact the school or teacher first, or email privacy@distiledu.com so the request can be directed to the responsible party. Staff-account and platform requests go to that email directly. We may need proportionate identity or guardian-authority verification before releasing information. An ordinary grade export is not a complete copy of all personal data; retained logs and alert history can require the operator's assistance.

You may also raise a concern with Egypt's Personal Data Protection Center or another competent authority where applicable. Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations No. 816 of 2025 provide the local data-protection framework.

Essential authentication cookies maintain sign-in, for staff and students alike, and protect login flows. Browser session storage remembers whether the current account has completed its sign-in Classroom refresh in that tab. Interface and export preferences are stored with the staff account. The application does not include advertising trackers or a third-party analytics SDK.

Short-lived security cookies record a successful human check on each sign-in page, an account-linking request and a pending new teacher account; those expire after ten minutes. The browser also remembers small interface choices, such as dismissing the two-step reminder, and the first name and account type (student or teacher) last used on this browser, so the front page can offer “Continue as” that person after signing out; “Not you?” removes it. Attendance changes made while offline can be saved in this browser's local storage, including student and class identifiers, dates and statuses, pending upload. These are local copies on the device; clearing browser storage can discard unsent changes. Protect shared devices as well as your Google account.

On signed-in pages the app registers a small background script (a service worker) whose only job is to show phone notifications and open the app when one is tapped. It does not store pages, files or class content, and it does not work offline. Turning notifications on also keeps a random identifier for this browser, and which account turned them on, in local storage; neither is shared with anyone else.

Google sign-in, Picker and embedded Drive previews may use Google's cookies and receive browser or connection information when used. WhatsApp links open that provider's service. Those providers govern their own cookies and account activity. Blocking essential cookies can prevent sign-in or connected features from working.

The operator is based in Egypt. Hosting, database, email, Cloudflare, Google and WhatsApp services may process information in other countries, depending on deployment settings and provider operations. This service does not promise that information remains in Egypt. Contact the operator for the locations and safeguards applicable to your deployment.

Any required transfer safeguards, permissions and consents must be in place before personal information is transferred. This notice is not evidence of a regulatory licence or transfer approval and does not replace a required agreement with a school.

If what Distil EDU stores, or who it is shared with, changes, this page changes with it and the date at the top is updated. Where a change materially affects account holders, students or parents, affected account holders and schools will be told directly rather than left to notice.