Privacy Policy
Last updated: 21 October 2026Who we are
Rune Academy is operated by its founders and is not yet a registered company. This section will be updated with the registered company's name, registration number and address once registration is complete. For anything in this policy, contact hello@runeacademy.net.
What we collect
- Teachers and headmasters: name, email address, and a password (stored hashed, never in readable form).
- Students: the name their school enters, and a generated username. We do not ask students for an email address, phone number, or date of birth.
- Schoolwork: photographs of handwritten answers, the marks awarded, and the feedback produced.
- Usage: which tests were taken and when, so teachers can see progress.
Why we collect it
To mark work and show students and their teachers how they are doing. We do not sell personal data, and we do not use it for advertising.
Who else sees it
Photographs of student work and question text are sent to Google, whose AI models do the marking and write the feedback. They process this on our instructions to return a result. Account data is stored with our database provider (Turso) and our application host. Payment details are handled by our payment providers and never reach our servers.
These providers operate outside Uganda, and some outside the European Union, so data is processed abroad.
The school's role
A school decides which students to enrol and what to call them. The school is responsible for telling students and their parents that it uses Rune Academy, and for having whatever permission is required. We act on the school's instructions in respect of its students' data.
How long we keep it
Account and schoolwork data is kept while the school uses Rune Academy. If a school stops, it may ask us to delete its data and we will do so within 30 days, except where we must keep payment records for accounting.
Your rights
A school, or a parent through their school, may ask to see, correct, or delete a student's data. Write to hello@runeacademy.net and we will respond within 30 days.
Security
Connections are encrypted in transit and passwords are stored hashed. No system is perfectly secure; if a breach affects a school's data we will tell that school.