Skip to content
Clearbyte

Student Data and Privacy

Effective Date: November 7, 2026

This page covers the Clearbyte lab platform: the part of Clearbyte that students open from an assignment in their course, where they work in an AWS account and their work is graded. The www.clearbyte.com website and its contact, request and SMS forms are covered by the separate Privacy Policy.

1. Clearbyte's role and FERPA

An institution uses Clearbyte to deliver lab activities that its instructors assign. Clearbyte receives student information only from the institution's learning management system (LMS) and from students' work in the labs, and uses it only to run, grade and report those labs to the institution.

Under the Family Educational Rights and Privacy Act (FERPA), Clearbyte acts as a school official with a legitimate educational interest in this information. It is under the institution's direct control with respect to the use and maintenance of the records, and it does not disclose them except as described on this page or as the institution directs.

Clearbyte will review and sign an institution's data privacy agreement on request.

2. What the LMS sends

When a student opens a lab, the LMS signs them in to Clearbyte over LTI 1.3 and sends:

  • the student's name and email address;
  • an LTI user ID, an identifier the LMS issues for Clearbyte (not the student ID number);
  • the student's role in the course (for example, Learner or Instructor);
  • the course's ID and title, and the assignment the lab was opened from;
  • the number of attempts the assignment allows.

Clearbyte stores the name, email address, role and LTI user ID with the course. It does not read or store photos, student ID numbers, or other profile fields.

When an instructor chooses Sync roster in the Clearbyte dashboard, the LMS also sends the name, email address, role and enrollment status of each student in the course. A student who leaves the course is marked as dropped.

3. What Clearbyte creates during a lab

  • Launches: which lab the student opened, when it started and ended, the attempt number, and which lab AWS account was used.
  • Answers: answers to questions in the lab, up to 4,000 characters each.
  • Uploaded files: files the lab asks for, such as screenshots, up to 20 MB each.
  • Results: the score, and whether each check and question passed, with the reason.
  • A summary file: the student's name, answers and score, sent to the LMS with the grade.
  • Snapshots of the lab account: a record of the AWS resources in the lab account when the lab is ready and when it ends, used for grading. For a lab that includes an EC2 instance, the snapshot can include the instance's installed packages, running services, open ports, user accounts, and the contents of files the lab names, up to 64 KB each.
  • AWS activity: for labs graded on what the student did, a list of the AWS actions made in the lab account (service, action, outcome, resource and region). It does not include IP addresses or browser details.
  • Ratings: an optional 1 to 5 star rating of the lab and a comment of up to 1,000 characters. The instructor sees them with the student's name.
  • Agreement acceptance: the version of the Student Agreement the student accepted, and when.

Edit log in code-editor labs

Some labs include a browser code editor. A lab of this kind can keep an edit log that records how each graded Python file was written: how many characters were typed, pasted or undone, a short preview of up to 20 pastes, whether the file was changed from outside the editor, and the timing between keystrokes. The edit log is shown only to the instructor. It is not used to calculate the score. Students are told about it in the Student Agreement.

IP addresses and cookies

An instructor can limit a lab to the institution's network. In that case the student's IP address is compared with the allowed address ranges when the lab starts. The address is not stored. The lab platform does not use cookies, analytics, advertising, or scripts from other companies.

4. Who can see it

  • The student's instructors, for their own course only: results, answers, uploaded files, ratings, edit logs, roster email addresses, and the student's lab account while the lab is running.
  • The LMS receives the score, the summary file and the uploaded files, and shows them in the gradebook.
  • Later students in the same lab account, in labs that give students read access to the account: the 90-day history of AWS actions that AWS keeps in every account, which shows the IP address and browser details of each action but not the student's name. See Security, section 2.
  • Clearbyte operators manage the lab accounts and can see their status across courses.
  • Clearbyte's platform administrators can access all stored data in order to run and support the platform.

Clearbyte does not sell student information, does not use it for advertising, and does not share it with anyone except as listed on this page.

5. AI models

Clearbyte sends student work to AI models in two cases:

  • Short-answer grading: when a typed short answer does not exactly match an accepted answer, the question, the accepted answers and the student's answer are sent to a model, which decides whether the answer is correct.
  • AI feedback: only in labs where the instructor turns it on. The lab's checks and questions and the student's answers (up to 2,000 characters each) are sent to a model, which writes feedback for the student. Uploaded files are not sent.

No name, email address or user ID is sent in either case. The models run through Amazon Bedrock in Clearbyte's AWS account, and all AI processing takes place in the United States. AWS states that model providers do not have access to Bedrock prompts and responses (Amazon Bedrock data protection).

6. Where it is stored

All platform data is stored in AWS in the US East (N. Virginia) Region. See Security for how it is protected.

7. How long it is kept

  • Sign-in sessions expire after 12 hours.
  • Uploaded files, lab account snapshots, AWS activity records, summary files and edit logs are deleted 30 days after the lab.
  • Course records (name, email address, role, agreement acceptance), launches, answers, results and ratings are deleted one year after the course's last lab, or sooner if the institution asks.
  • Database backups cover the last 35 days, so a deleted record leaves the backups 35 days after it is deleted.
  • Platform logs are kept for 30 days and do not contain student names, answers or tokens.

8. Requests from institutions and students

An institution can ask for a copy of a student's records, or ask for a student's or a course's records to be deleted, by emailing info@clearbyte.com. A student should ask their institution, which controls the records under FERPA.

9. Changes to this page

Changes are posted on this page with a new effective date. The Student Agreement is shown to students again when what it says about their data changes.

10. Contact

Questions about student data: info@clearbyte.com.