This policy explains what data CodeWithMark collects, how it is used, and your rights under the Data Privacy Act of 2012 (RA 10173).
On this page
This platform is operated by a faculty member at the College of Engineering and Information Technology (CEIT), Kalinga State University. It is a faculty-led initiative, not an institutional service operated by Kalinga State University.
Operator contact: pangaymark1@gmail.com
Account and profile data
Name, email address, assigned section or course, and role (teacher or student). This is provided at account creation by a teacher or administrator, or by you when you first sign in with Google.
Google sign-in and Link Google
If you sign in with Google, or link a Google account in Account settings, we receive your Google account ID and email address, and your name when Google sign-in creates a new account for you. Google's sign-in response also includes your profile photo; we do not store it. We do not receive your Google password. See Google user data below.
Course and assessment activity
Lessons accessed, quiz and exam submissions, code submissions, scores, time-on-task, and attempt history. This data is necessary for grading and academic record-keeping.
Anti-cheat and academic integrity checks
During graded quizzes, exams and labs, the platform records when you leave fullscreen, switch tabs or apps, or open developer tools, and it blocks text pasted from outside the editor (each blocked paste is recorded). In graded labs it also checks for unusually fast typing and compares the code you submit with other students' code for the same lab. On the Android app, screen pinning prevents switching apps. Only your teacher for that course and the platform administrator can see these records. They help your teacher decide what to review. Similarity results and review priorities do not change your grade automatically; your teacher reviews them and decides. If you believe a flag is wrong, talk to your teacher.
Assignment submissions
When a student submits a written assignment, the content is stored in the platform database. When a student submits a PDF file, the file is stored server-side in a secured upload directory. PDF files are permanently deleted when the teacher deletes the assignment or when the student removes their own submission before grading. Submission files are accessible only to the submitting student and the teacher of the course.
OMR scan images
When a teacher uses the Scan & Grade feature, the Android app captures a photo of a printed answer sheet. The image is processed locally on the device for bubble detection. For identification-type or write-in answers, anonymized text extracted from the image is sent to a third-party AI service (Anthropic) for grading. The original photo is not stored on our servers.
Technical data
IP address, browser type, device type, and session timestamps, collected automatically for security and operational purposes.
Your data is not sold, rented, or shared with third parties for marketing or commercial purposes.
Within the platform, access is role-scoped: • Administrators can see all user accounts, audit logs, and system-wide activity. • Administrators can also review what a teacher or an administrator types into Ask M.A.R.K. (Analytics questions, Help questions and Draft instructions) and which data tools ran for them, to catch misuse and help teachers who get stuck. The answers and generated drafts are not recorded. These records are kept for one year. • Teachers can see data only for students enrolled in their own courses. • Students can see only their own records.
Your data is stored on secured cloud infrastructure hosted in the Asia-Pacific region. All storage and transmission systems are access-controlled and encrypted.
For OMR Scan & Grade with identification or write-in answers, anonymized text extracted from answer sheets is processed by a third-party AI grading service. No personally identifiable information is included in these inputs.
Certificate verification links (QR codes on certificates) are intentionally public — anyone with the link can verify a certificate. No personal data beyond the certificate holder's name and course is exposed through this link.
This section covers the information CodeWithMark receives from Google: through Google sign-in, through Link Google in Account settings, and through the Google meetings connection that a teacher can turn on in Settings. It applies in addition to the rest of this policy.
What we access: sign-in and Link Google
Your Google account ID and email address. Google's sign-in response also carries your name and profile photo: the name is used only when Google sign-in creates a new account for you, and the photo is not stored. No other part of your Google account is accessed.
What we access: Google meetings (teachers who connect)
The Google account ID and email address of the connected account, and the Google Calendar permission "calendar.app.created". That permission lets CodeWithMark create one secondary calendar named CodeWithMark in your Google account and create and update events on that calendar only. It gives no access to your other calendars or events, your contacts, your email, or your files.
How we use it
To sign you in and to match your CodeWithMark account to your Google account. For teachers who connect Google meetings: when you start a meeting, CodeWithMark creates it as an event with a Google Meet link on the CodeWithMark calendar and invites the enrolled students it is for (the whole class, or the members of a class chat channel) who sign in with Google or have linked a Google account, at their Google address, so Meet lets them in without waiting to be admitted. While the meeting is live, the guest list is updated as students join or leave the class, and the event is ended when you end the meeting. Invitations are created without Google sending email when a meeting starts; a student added to a meeting already in progress may receive an invitation email from Google. Guests cannot see the other guests or invite anyone; the teacher who owns the meeting can see its guest list in Google Calendar. The call itself takes place on Google Meet under Google's terms.
What we store
Your Google account ID and Google email address, with your CodeWithMark account. For each Google meeting, the calendar and event identifiers and a record of which students were invited and at which Google address. For teachers who connect Google meetings, the Google account ID and email address of the connected account, the permissions Google granted, the CodeWithMark calendar ID, and a refresh token. The refresh token is encrypted at rest with AES-256-GCM and is decrypted only on the server when a Google request is needed. Short-lived access tokens are kept in server memory only and are never written to the database.
What we do not do
We do not sell Google user data. We do not use it for advertising. We do not use it to develop, improve, or train artificial intelligence or machine learning models. We do not share it with anyone other than Google, except as needed to provide the features described here, to keep the platform secure, or when required by law.
Limited Use
CodeWithMark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The policy is published at developers.google.com/terms/api-services-user-data-policy.
Disconnecting and removing access
Teachers can disconnect at any time in Settings → Google meetings → Disconnect. This revokes CodeWithMark's access at Google and deletes the stored refresh token and connection record. The CodeWithMark calendar and its events remain in your Google account, where you can delete them in Google Calendar. You can also remove CodeWithMark's access from your Google Account at myaccount.google.com/permissions; CodeWithMark then marks the connection as needing to be reconnected the next time it tries to use it, and Disconnect deletes the stored token as well. Students who linked a Google account can ask the operator to remove the link.
Retention
Your Google account ID and email address are kept with your CodeWithMark account until the account is deleted or you ask us to remove the link. A teacher's refresh token is kept until the teacher disconnects or reconnects Google. Meeting records, including which students were invited, are kept with the course's records as described under Data retention. CodeWithMark never deletes events from your Google Calendar; ending a meeting only moves the event's end time.
Contact
For questions about Google user data, or to have it deleted, contact the platform operator at pangaymark1@gmail.com.
This platform is also being developed as a faculty research project at KSU-CEIT. As part of this research, anonymized and de-identified usage data and in-platform survey responses may be collected and analyzed.
No student is identified by name or personally identifiable information in any research output or publication. Participation in any formal research survey is voluntary and separate from academic assessment — declining to participate has no effect on your grades or standing.
Student academic records are retained for the duration of the course and for a reasonable period thereafter for academic record-keeping purposes.
Code comparisons between students are worked out when your teacher views the lab results and are not stored.
You may request deletion of your account and all associated personal data at any time by contacting the platform operator. Accounts placed in the recycle bin are soft-deleted and may be permanently removed within 30 days. Hard deletion is permanent and irreversible.
All data is stored in an encrypted, access-controlled cloud database. All data transmitted between your device and the platform is protected via HTTPS/TLS encryption.
All administrative actions are recorded in an immutable audit log. Access to the database is restricted to the platform operator and is not publicly accessible.
No security system is perfect. In the event of a data breach that affects your personal information, we will notify affected users as required by applicable law.
Under Republic Act No. 10173 (Data Privacy Act of 2012), you have the right to:
• Be informed about how your data is collected and used • Access the personal data we hold about you • Correct inaccurate personal data • Request deletion of your personal data • Object to processing of your personal data • File a complaint with the National Privacy Commission (NPC)
To exercise any of these rights, contact the platform operator at pangaymark1@gmail.com. We will respond within a reasonable time and in compliance with applicable NPC guidelines.
Some users of this platform may be minors enrolled in KSU-CEIT courses. Accounts for minors are created and managed by teachers or administrators, and data collection is limited to what is necessary for academic purposes. We do not knowingly collect data from minors outside the context of their enrolled courses.
We may update this Privacy Policy from time to time. Continued use of the platform after changes are posted constitutes acceptance of the revised policy. The date at the top of this page reflects the most recent update.
For privacy questions, data requests, or concerns, contact the platform operator at pangaymark1@gmail.com.
For concerns that cannot be resolved with the operator, you may contact the National Privacy Commission of the Philippines at www.privacy.gov.ph.