Legal
Privacy Policy
Last updated: August 2026
Overview
Marka is a peer-evaluation service for teachers. This policy explains the data used to provide the service, including data that teachers enter about their students. We do not sell personal data or use classroom data for advertising.
1. Data used by Marka
Teacher account data
When you create and use an account, Marka uses your email address, password hash, display name, an optional credentials/suffix string, account settings, and session information. Passwords are hashed, not stored as readable text.
Teacher-entered classroom data
Marka stores the data a teacher enters to run the service: student ID numbers, full names, optional group/team labels, class and section information, rubrics and their indicator text, evaluation-period settings, and the peer-evaluation records students submit: rubric scores, private notes, and public notes. Marka generates a unique access code per student when a roster is imported.
Technical and security data
We process IP addresses and timestamps in rate-limiting and session records for abuse prevention. These records support login security for both teacher password login and student access-code entry.
2. How data is used
- To authenticate teacher accounts and student access codes.
- To run evaluation periods and compute aggregated, anonymized results.
- To display reports and exports requested by the teacher.
- To provide support and investigate service or security problems.
- To send account-related messages such as verification and password-reset emails.
We do not send marketing email from the app. Students never receive email; the only email address the system uses belongs to the teacher.
3. Storage and service providers
Marka uses Neon-hosted PostgreSQL for its application database and Resend for the transactional email described above (teacher signup verification, password reset, and Insights upgrade-request notifications). These providers process data only as needed to operate their services for Marka.
Data sent between the app and Marka is protected in transit with HTTPS/TLS. Passwords are stored as hashes, and both teacher and student sessions use HMAC-signed, secure, HttpOnly cookies.
4. Support access and sharing
We do not sell, rent, or share teacher or classroom data for advertising. Authorized Marka support personnel may access data only when reasonably needed to provide support, maintain the service, investigate a security or reliability issue, or meet a legal obligation.
5. Anonymity in peer evaluations
A student's public notes are shown to the classmate they're about with no attribution: the API layer itself never returns evaluator identity to a student-facing endpoint. Teacher-facing views do show who wrote a note, since moderating it meaningfully requires that context. Numeric results and public notes are withheld from a student entirely until at least 3 evaluators have submitted for them, unless a teacher explicitly overrides that threshold for a specific student.
6. Student and minor data
Marka is intended for teachers, not for students to create their own accounts. Teachers are responsible for deciding what student data to enter and for obtaining any permissions required by the laws and school rules that apply to them. Marka does not knowingly collect personal information directly from students; students authenticate with a code the teacher generates and hands out, never a self-registered account.
7. Access, exports, and deletion
Teachers can view and update their classroom data in the app, including rubrics, rosters, and period settings. Reports and CSV exports are available for supported records.
You can delete your account in Marka under Settings → Delete account. The app requires your current password and typing DELETE to confirm before it deletes the account's associated data. You can also use our public account-deletion request page if you cannot sign in.
Account deletion removes the account's classroom data, settings, sessions, tokens, and account information. We retain only limited de-identified security and audit records when needed to protect the service or meet legal obligations.
8. Retention
Housekeeping data (expired password-reset and email-verification tokens, expired sessions, stale rate-limit records, and abandoned draft evaluations that were never submitted) is automatically deleted after a short window. A class or evaluation period only becomes eligible for automatic deletion once it has been both archived by the teacher and untouched for a long, configurable window (2 years by default). Before anything in that second category is deleted, we send an advance email warning with an export option and a "keep this indefinitely" override; only archived, long-inactive data is ever a candidate, and export-before-purge is the default path, not a side option.
9. Cookies and website analytics
The app uses essential, HttpOnly session cookies to keep an authenticated teacher or student signed in; these are not used for advertising or cross-site tracking. This public marketing website does not currently run analytics; if that changes, this policy will be updated first.
10. Changes and contact
We may update this policy by changing the "Last updated" date. For privacy questions or account-deletion requests, email [email protected].