The short version
- Students have no accounts. No email address, no name they typed, no age, no password. There is nowhere in Rally's database to put any of those.
- A student is a made-up name and a score that exists for one game and is deleted when the teacher deletes the game.
- If a teacher adds real names for grading, they stay on the teacher's own device, encrypted. Rally never receives them. See Names for grading.
- Files you upload are never stored. A question set is read in the request that carries it and discarded. Only the questions survive.
- Nothing is sold, licensed, brokered or used for advertising. Not now, and not as a change of plan later. See “What we will never do”.
- No third-party analytics, trackers, advertising pixels or SDKs run in Rally.
1. Who this covers
Rally is operated by SentinelGrid at rally.sentinelgrid.us. It has two kinds of user and they are treated very differently.
Teachers and school staff sign in through the SentinelGrid portal. They have accounts. A school whose staff use Rally is a user of the service, not its owner or operator; see Who owns Rally.
Students join a game with a six-character code. They do not have accounts, are never offered one, and no part of Rally can create one for them.
2. What Rally holds about a student
When a student joins a game, Rally creates one row containing:
- a display name it generated, for example
BriskOtter47. The student does not type a name and cannot choose one. - the character they picked, as an identifier like
otter. - a random join token, stored only as a hash, which is how their browser proves it is the same browser. It works only in that one game.
- their score and the answers they gave, as choice numbers and how long each took.
- the time they joined and finished.
That is the complete list. Rally does not collect or receive a student's name, email address, phone number, date of birth, photograph, school ID, device identifier, precise location, contacts, or anything from their microphone or camera.
Because names are generated, a student's row cannot be linked to a real person by Rally, by SentinelGrid, or by anyone who obtained a copy of the database. Only the teacher standing in the room knows who was BriskOtter47.
What stays in the student's browser
While a game is open, the student's browser holds the join token, the encrypted questions for that game, and, in games that have sound, whether the student switched the sound off. The questions are removed when the game finishes and the rest goes when the tab is closed. Game sounds are made by the browser itself; Rally never uses a microphone or records anything.
Names for grading
Names a teacher adds for grading stay on the teacher's device. On a finished game's report, a teacher may type a student's name beside a made-up one to turn the report into grades. This is optional, it is done by the teacher and never by a student, and the names are never shown on the projector.
- They are never sent to Rally. They are not in its database, they do not pass through its servers, and SentinelGrid cannot see, search, recover or hand over them. The part of the page that holds them is a separate, sealed page that the browser blocks from making any network request, and the teacher help bubble is not on it.
- They are encrypted where they are stored. The teacher's browser encrypts them with AES-256-GCM under a key it created itself and will not allow to be exported.
- They do not last. They are deleted from that browser 12 months after they were last saved, when the teacher deletes that game's records from its report, or whenever the teacher chooses to forget them.
- The grades file is the teacher's. A teacher can download the names and marks as a file. It is made on the teacher's device, Rally never receives a copy, and from then on it is an ordinary file that the teacher and their school look after like any other gradebook.
What this cannot do: it does not protect the names from someone using the teacher's unlocked, signed-in computer, and clearing the browser's data or changing computers loses them, because there is no copy anywhere else.
3. What Rally holds about a teacher
- Identity from the SentinelGrid portal: email address, display name, organisation, and the role the portal assigns. Rally receives these in a signed sign-in token; it never sees a password.
- Sessions: a hashed session token, when it was created and when it expires, the IP address and browser user-agent it was opened from.
- Their content: the question sets they create or import, and the games they host.
Session IP and user-agent are kept because “where was this staff session opened from” is a question a school administrator can reasonably need answered. No equivalent is kept for students.
Share links
A teacher can create a link that shows one of their question sets to anyone who opens it. While that link exists, the page it opens shows the set's questions and answers, the teacher's display name and their school. It does not show their email address, any of their other sets, any game, or anything at all about a student.
Rally does not count, log or report who opens a share link. There is no visitor list, no view counter and no notification, because the only way to build one would be to start keeping a row per visit.
A link is created only when a teacher presses Share, and it stops working the moment they press Stop sharing or delete the set. Sharing the same set again afterwards produces a different address; the old one does not come back.
4. Imported sets
Rally can import question sets exported from other quiz tools, and from CSV or JSON. The uploaded file is never written to storage. It is parsed in memory during the request that uploaded it and discarded when that request finishes.
This is enforced by design rather than by policy: Rally has no database column that could hold a file. The only trace an import leaves is the original filename, kept as a label so a teacher can tell two imports apart.
If your file contained anything beyond questions and answers (a hidden sheet, a class roster in column K), that content is not extracted, not stored, and is gone when the request ends.
Importing from a link
A teacher can also import a set that is still published on Kahoot by pasting its address. When that happens Rally makes one request to Kahoot and sends it only the set's public identifier: no name, no email address, nothing about the school, and nothing about any student. It is the same request anybody opening that public set in a browser makes.
Blooket does not answer automated readers at all, so Rally never contacts Blooket. Importing a Blooket set means opening it in your own browser and pasting the result in; the text is parsed exactly like an uploaded file, and no request leaves Rally.
Rally itself can only read a Kahoot set its author has made public. The Blooket route runs in the teacher's own browser, signed in as themselves, so it reads whatever that teacher can open there, which is normally their own sets. Any pictures in the set are copied into Rally's own storage so that games do not depend on the other service continuing to serve them, and deleting the set deletes them too, unless another of that teacher's sets still uses the same picture.
5. Network information
Rally is served by Cloudflare, which processes IP addresses to route and protect the request, as any web host must. Cloudflare's retention is governed by its own terms.
Rally's pages use web fonts, and Rally fetches and serves them itself. A student's or teacher's browser never contacts Google or any other font service, so no third party learns that a device opened Rally.
Within Rally itself, IP addresses are used only to rate-limit abusive traffic, and are not stored: the limiter records a salted, truncated, one-way hash of the address which cannot be reversed to an IP. Each record is used only for its window, a minute for most and an hour at most, and is deleted by Rally's housekeeping, which runs at most hourly whenever Rally is in use.
6. What it is used for
Only to run the game and show the teacher the results: matching a browser to its player, computing scores, drawing the leaderboard, producing the after-game report, and stopping abuse.
It is not used for profiling, behavioural analysis, engagement scoring, advertising, model training, or any purpose beyond the lesson it was collected in.
7. How long anything is kept
- Student rows live as long as the game does, and a game is deleted automatically, with every player row in it, 12 months after it ends, or sooner if the school or district has chosen a shorter period in Rally (as short as one day). A teacher can delete any finished game, or all of them at once, from the Games page, and deleting a question set deletes its games and every player row in them. Either way it is immediate and permanent.
- Names a teacher added for grading are held only in that teacher's browser and are deleted from it 12 months after they were last saved, or sooner when the teacher deletes that game's records from its report or chooses to forget them. See Names for grading.
- Abandoned games (a lobby opened and never used) are closed automatically after a few hours.
- Teacher sessions expire within a day and are deleted.
- Rate-limit records expire with their window (a minute for most, an hour at most) and are then deleted by housekeeping that runs at most hourly whenever Rally is in use.
- A teacher's question sets and past reports stay until the teacher deletes them, or until material in them is removed after a valid copyright complaint.
8. Who else sees it
SentinelGrid uses Cloudflare to host and serve Rally. That is the entire list of third parties Rally sends data to. Rally sends no data to analytics providers, advertising networks, data brokers, or AI services. Fonts are fetched by Rally's server, not by your browser, so the font service is told nothing about who is using Rally.
One request goes outward rather than inward: importing from a Kahoot link asks Kahoot for a set by its public identifier, and tells them nothing else. Rally never contacts Blooket at all. See Imported sets.
The help bubble is for teachers, and only on teacher pages. The signed-in teacher console, the import guide and the districts page carry a help bubble from SentinelGrid's own support desk (support.sentinelgrid.us), described under Related SentinelGrid systems. It is never loaded on the join screen, the game screen, a share page or the front page, so a student's browser never contacts it. It is also not on the sealed page where a teacher types names for grading, and it cannot read them.
A teacher can also choose to publish one of their own question sets as a share link. That is the account holder deciding to show their own content to people they send the address to, and it exposes nothing about anybody else.
The current list of infrastructure providers is at Subprocessors.
9. What we will never do
We will not sell, rent, license, or trade data from Rally. We will not use it for advertising or share it with advertisers. We will not build profiles of students. We will not use student answers to train machine-learning models. We will not add third-party tracking to Rally.
These are not preferences that a future business decision quietly reverses. If SentinelGrid is ever acquired or restructured, this policy travels with the service, and any change that would weaken it will be announced to schools before it takes effect and never applied retroactively to data already collected.
10. Children
Rally is designed to be used by children in a classroom under a teacher's direction. Because it collects no personal information from students at all, there is nothing about a child for a parent to request, correct, or have deleted beyond the game row itself, which the teacher can delete at any time. If a teacher has added real names for grading, those are held by the teacher on the teacher's own device and not by Rally, so a question about them goes to the teacher or the school.
See Children, COPPA and FERPA for how this works for a school.
11. Access, correction and deletion
Teachers: you can see and delete everything Rally holds for you from within the app: your sets, your games, and the player rows inside them. To have your account removed entirely, write to privacy@sentinelgrid.us.
Schools and parents: because student rows contain no identifying information, SentinelGrid cannot locate “a particular child's data” on request, because there is nothing in it to search by. A teacher can delete the game, which deletes everything from that lesson. Any names a teacher added for grading exist only on that teacher's device; SentinelGrid does not have them and cannot produce, correct or delete them, and the teacher or school can. Requests can be sent to privacy@sentinelgrid.us.
12. Security
- Everything is served over HTTPS with HSTS.
- Teachers sign in only through the SentinelGrid portal, using short-lived single-use tokens. Rally stores no passwords.
- Session and join tokens are stored only as hashes.
- Names a teacher types for grading are encrypted in the teacher's browser with a key that cannot be exported, on a page the browser forbids from sending anything anywhere.
- Question content is delivered to a student's browser encrypted, decrypted one question at a time, and scoped so that one student's copy is unusable to anyone else.
- Scores are computed on the server from the answers a student gave. A browser cannot report its own score.
No system is perfect. If you find a security problem, please write to security@sentinelgrid.us; we will not pursue good-faith researchers who report responsibly.
13. Changes
Material changes will be posted here with a new date and, where a school has an agreement with us, sent to the contact on that agreement before taking effect.
14. Contact
SentinelGrid, privacy@sentinelgrid.us