Privacy

Build Physics privacy

The app can use PostHog to count a small set of anonymous product-usage events. Analytics are disabled unless the site operator supplies both required PostHog environment variables when creating the production build.

Anonymous analytics

The app only sends these event names and limited non-personal categories:

• page views, page leaves, app opening, and simulation starting;
• the identifier of a selected preset or tutorial;
• tutorial completion and graph opening;
• Power Core stage opening, with only the stage number recorded;
• practice set starts, problem completions, and set completions, with content identifiers and whether solution help was used;
• class creation, first student profile activation, and assignment creation, with the assigned public activity and current roster count;
• the export format used for a world export and when feedback is opened;
• save workflow steps, with only “computer” or “account” recorded as the destination;
• browser errors with raw messages and source-code context redacted; known failures use fixed technical categories, application stack locations, and a build fingerprint.

What analytics do not collect

The analytics code does not collect names, email addresses, school names, typed content, uploaded scene files, saved scene contents, world names or descriptions, object labels, exported data, account identifiers, URL query strings or fragments, or other personally identifiable information. Automatic click, form, and input tracking, session replay, console-log capture, surveys, and user profiles are disabled.

Anonymous operation

Browser analytics use an anonymous identifier held only in browser memory and are not persisted across visits. Classroom events sent by the server use a fresh anonymous identifier for each event. Analytics respect the browser's Do Not Track setting, and classroom events also respect Global Privacy Control. We ask PostHog not to use IP addresses for analytics or geolocation. As with any web request, the analytics service may process basic network metadata to deliver the request.

Optional feedback

The Send Feedback feature opens a Tally form only when you choose it. If you submit the form, Tally receives the answers and attachments you intentionally provide, an optional contact email if you enter one, and limited technical context: app version, build number, current preset and curriculum unit, whether a tutorial is active, browser and operating-system category, screen size, page URL without its query or fragment, and submission time.

Do not include student names, grades, school identification numbers, or other private information in feedback or attachments. A saved-world JSON file may contain labels or other text entered into the simulation, so review it before uploading. Feedback is separate from anonymous analytics and is never submitted automatically.

Local and cloud scene data

Automatic scene recovery, display preferences, and tutorial progress are stored locally in the browser. Downloading a scene to your computer does not require an account and does not send the scene JSON to the server.

If you choose “Save to my account,” the reviewed scene is sent to the Build Physics API and stored privately in Cloudflare R2. Cloudflare D1 stores the account owner, world name, optional description, dates, size, and object count. Cloud scene data is not sent through anonymous analytics. A pending save stays in page memory during authentication and is not placed in browser storage or a URL.

While signed in, completed lessons and Power Core stages are automatically saved privately to your account in Cloudflare D1, with completion dates. These records do not include lesson answers, grades, or simulation data. Account progress is also cached in this browser, separately from guest progress. Pending saves remain on the device until syncing succeeds. Guest progress stays local unless you choose to copy it into your account from Account details.

Accounts, Google sign-in, and transactional email

If you create an account, Cloudflare D1 stores your email address, a salted password hash, email-verification status, account tier (normal, teacher, or admin), and hashed session, email-verification, and password-reset tokens. Build Physics does not store plaintext passwords or raw authentication tokens.

If you choose Sign in with Google, Google authenticates you and provides a stable Google account identifier, your email address, and confirmation that Google verified that address. Build Physics stores the identifier with your account so you can sign in again. It does not request or store your Google profile name, profile photo, contacts, files, or other Google account data, and it does not retain Google access or identity tokens.

Resend processes your email address and the contents of verification and password-reset messages only to deliver those requested account emails. Verification and reset links expire, are single-use, and are not sent to anonymous analytics.

Classroom pilot

Teacher access applications include your account email, school or organization, teaching role, and any verification details you provide. Administrators can review this information and approve or decline access. We retain application status, decision notes, and an audit record identifying the reviewing administrator and account. Do not include student information in an application. Application and approval pages do not send PostHog analytics.

Class profiles use a teacher-issued alias, class code, and private passphrase. We do not ask students for an email, real name, or birth date. Teachers keep their own mapping from aliases to students. Activation codes and passphrases are stored as hashes. These profiles are separate from personal accounts.

Assignment work saves automatically in the student's browser. Students can also choose Save progress up to four times per lesson or practice assignment to store a private online copy and continue after signing in to the same class profile on another device. Online saves include lesson responses and completed steps, or practice answers, reasoning, check results and solution-use indicators, plus the place to resume. Each save replaces the previous online copy. The four saves are shared across devices and do not reset if a teacher un-submits the assignment. Local edits do not use this allowance or upload automatically. When no saves remain, students can keep working on that device and submit when ready. If a newer online copy conflicts with local work, the student chooses which copy to continue. Avoid personal information in responses.

Saved progress is private to the student's class profile and is not shown to the teacher. Choosing Submit to teacher separately sends final lesson responses or practice responses and reported feedback, plus a submission time, to the teacher's private class. Submission does not use a progress save. Submitted work is read-only until the teacher un-submits it. Saved progress and submitted work are stored privately in Cloudflare D1 and R2 respectively; neither is sent through anonymous analytics or shared as a live step-by-step activity history.

Browser analytics remain disabled on classroom pages and in assignment sessions. The server sends three anonymous PostHog events: when a class is created, an activity is assigned, or a student first activates a class profile. Assignment events include only the public catalog activity's type, identifier, and title, plus the number of current student profiles, including profiles awaiting activation. These events do not include class names, teacher-entered assignment titles or instructions, account or profile identifiers, login codes, passphrases, or responses. Student device IP addresses are not forwarded to PostHog. Normal hosting and security logs can still include network information such as an IP address.

Teachers can export results, reset student logins, and delete profiles or whole classes. Class data, saved progress, and submitted results are retained until deleted with the student profile or class; deleting an assignment also removes its saved progress. Archiving stops student access and keeps saved work. Signing out or clearing browser storage removes local drafts; a previously saved online copy remains available after signing back in. Teachers should export needed results and delete classes when they are no longer needed.