Security & Privacy

Last updated July 26, 2026 · Questions: info@cubbyed.com

Parents and teachers should feel comfortable putting real learning here. We treat a child's data the way we'd want our own treated. This page is an honest, up-to-date account of what Cubbyed does — and doesn't yet do — to keep that promise. When you read about a learning platform getting hacked, the cause is almost always the same: one big database with overly broad access, an admin password floating in someone's email, no real per-user rules. Cubbyed was built without any of that. The list below is the architecture, not the marketing.

Access control

• Default-deny database rules. Every Firestore collection has an explicit, server-enforced allow rule keyed to identity — owner-only reads of user profiles, teacher-only writes of class study decks, author-only deletes of annotations, no client writes at all for AI-generated content. Adding a new collection requires adding an explicit rule; the safest failure mode.
• No "test-mode" wildcard rules. A previous version of the rules allowed any signed-in user to read or write any document. That hole is closed; rules are versioned and reviewed.
• Account-linked Cloud Functions require authentication. Callables that touch a user’s account, subscription, or classroom data reject unauthenticated requests. Public marketing endpoints (if any) do not expose private student records.
• Cloud project access is limited. Google Cloud / Firebase project administration is limited to authorized accounts (Google accounts support multi-factor authentication). We do not claim a third-party SOC 2 audit of our admin process.

Encryption

• In transit: HTTPS (TLS) on every request, enforced by HSTS with a one-year max-age and preload directive — your browser refuses to load Cubbyed over plain HTTP.
• At rest: all Firestore documents are encrypted at rest using Google-managed keys. Disk-level encryption on Cloud Functions storage.
• Secrets: API keys, webhook secrets, and the agent's Anthropic key live in Google Secret Manager, not in the codebase. They're injected into functions at runtime.

Authentication

• Sign in with Apple on iOS — Apple's privacy-preserving auth (private relay emails supported).
• Google Sign-In on web (works on school Chromebooks).
• Email + password via Firebase Auth. Passwords are never stored by Cubbyed — only by Firebase, which uses scrypt with project-level salt and pepper.
• Account deletion in-app under Settings → Account → Delete account. Profile and tokens are revoked immediately; queued backups purge on the next 30-day cycle.

Payments

• Stripe processes card payments on the web. Android consumer purchases remain disabled until native Google Play Billing verification is configured. Our application stores subscription/status metadata, not full card numbers (PAN), CVC, or expiration in Firestore.
• Apple In-App Purchase handles iOS subscriptions. Receipts are verified server-side against Apple's verification endpoint (with sandbox fallback for testing).
• Stripe webhooks are signature-verified before subscription state is written, using a webhook secret held in Secret Manager.

Web hardening

• Content-Security-Policy with full enforcement on the marketing site and report-only on the app while we baseline Flutter web's runtime needs.
• HSTS with preload.
• X-Frame-Options: DENY plus frame-ancestors 'none' — Cubbyed cannot be embedded in another site's iframe, eliminating clickjacking.
• X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy with camera, microphone, and FLoC turned off.
• Cross-Origin-Opener-Policy to prevent cross-tab attacks.

Privacy by design

• No advertising network. No sale of student data to brokers. We do not sell student personal information. The app does not include a third-party advertising SDK.
• No student-to-student messaging. Class annotations are scoped so they are not an open social feed between children.
• No third-party mobile analytics SDK in the Cubbyed client dependencies (we do not ship Firebase Analytics / Mixpanel / similar in the app package). Platform diagnostics from Apple/Google may still apply at the OS level.
• COPPA / FERPA design intent: consent and parental/teacher control are part of the product design; schools remain data controllers for records they manage. This is not a formal third-party compliance certification.
• AI is not a public back door to grades. Socrates (tutor / teacher assist) runs through authenticated Cloud Functions with usage limits. There is no public API that returns a student’s mastery or grades. Families may export a Learning Passport file from the app for their own records.
• Public curriculum for agents (optional connector): classical course outlines can be exposed via our MCP tools (subjects/courses/lessons — not student records). When that HTTP connector is hosted, free use is rate-limited by IP; student data is intentionally excluded.

Building for resilience

• All persistence is in Firebase / Firestore, which auto-replicates across multiple zones — there is no single-machine database that can be hacked in a smash-and-grab.
• Cloud Functions are stateless request handlers; sensitive ones check authentication before acting.
• Operations rely on Google Cloud / Firebase logging and IAM for the project (not a separate custom SIEM we claim as a product feature).

What we don't do (yet)

We'd rather list this honestly than imply certifications we don't have.

• No SOC 2 audit yet. Cubbyed is small and early. We design to those standards (least privilege, secrets management, encryption, audit trails) and intend to pursue formal certification once the product warrants the audit cost.
• No bug-bounty program yet. Disclosures via the email above are acknowledged and handled, but we cannot yet offer cash bounties.
• No third-party penetration test on record yet. Planned; we'll publish the letter when complete.

Update history

• 2026-07-26: Clarified AI / Learning Passport boundaries; comfort checklist for parents and teachers; portfolio security commitment linked.
• 2026-05-22: Initial public security policy. Default-deny Firestore rules deployed. Web security headers (HSTS, CSP, COOP, Permissions-Policy) added on both the marketing site and the app.

Cubbyed is built by Ryan Breitenbach. Questions, concerns, or disclosures: info@cubbyed.com.