Lesson Planner privacy policy

About this policy

This is the privacy policy for CloudX97 Lesson Planner, a lesson-planning web application for school departments. It covers the application at planner.cloudx97.com (opens in a new tab) and its use of Google APIs. The product page is cloudx97.com/lesson-planner/, and the terms of service go with this policy.

Operator: CloudX97, a one-person creative technology studio in Guyana. “I” and “me” in this policy mean CloudX97.
Privacy contact: hello@cloudx97.com. You can also reach me on WhatsApp through the contact page.
Effective date: 24 October 2026.
Other policy: how the CloudX97 website, quote form and business enquiries are handled is covered in the separate website privacy policy. This page does not cover them.

On this page:

What is live and what is not
Information the application handles
Google API access
How information is used, and Google’s user data rules
AI providers: what is sent, and what is not controlled
Who else handles information
Storage and security
Retention and deletion
Student information
Your choices, rights and contact
Changes to this policy

What is live and what is not

The application is hosted at planner.cloudx97.com and is being prepared for its first pilot with school Heads of Department (HODs). Accounts are by invitation only. This policy describes the hosted application as it works now. A newer version has been built and tested on my own computer but is not yet deployed or accepted in live use. Features of that version are listed separately here so that nothing is described as available when it is not.

Live on the hosted application now:

Sign-in with an email address and password. Accounts are invitation-only. HOD sessions last up to 12 hours, or up to 30 days (ending after 7 days of inactivity) if you choose “Remember me” on that device.
Connecting Google Drive with the single drive.file permission, and choosing files and folders with Google Picker, described in Google API access.
Reading scheme-of-work files you select, preparing master lesson plans with AI (Google Gemini, Groq or OpenRouter, as the platform owner configures them), review, explicit HOD approval of an exact saved version, version and approval records, and distribution of approved copies to teacher folders you authorise.
Recoverable working drafts that expire after seven days (see Retention and deletion).
Optional reviewer accounts, and prices shown in the application before the HOD authorises billable work.

Built, but not yet live (not available to hosted users):

Signing in with Google. Until it is released, the application does not use Google Sign-In and does not collect your Google account identifier, name or email address from Google.
The intelligent scheme importer, billing for AI reflections, the redesigned interface, and department-supplied AI keys.
Cloudflare Workers AI as an additional AI provider. It exists only in the version on my computer. It will not receive any information from the hosted application until it is released and this page is updated.
Encrypted storage of HOD stamp images, and the new reviewer interface that is hidden from ordinary HOD workflows by default.

Not available: automatic stamping of plans, automatic switching to another AI provider if one fails, and unattended weekly automation, which is turned off on the hosted application. Automatic email from the application is also not available (see Who else handles information). Because the pilot has not started, some details may change; before any change in how Google user data is used, I will update this page.

Information the application handles

Information you or your HOD give the application directly

Account and membership: name, email address, role (HOD, teacher or reviewer), the school and department you belong to, and the subjects and grades you are set up for. Your password is used to sign you in. If you choose Remember me, a sign-in token is kept on that device.
Teachers: a teacher who is given a lesson-plan copy does not necessarily have an account. The application holds the information an HOD enters about the teacher so copies can be prepared and delivered, such as the teacher’s name, the classes taught and the Drive folder chosen for their copies.
Academic settings: the department’s subjects, grades and weeks, class details, and planning settings.
Lesson-planning content: the schemes of work you provide, the curriculum information taken from them, master lesson plans, teacher copies, your edits, and reflection drafts if you ask for them.
Approvals and records: which plan version an HOD approved and when, version history, and the record of what the application prepared and distributed.
Billing records: authorisations, estimates and invoices for billable work. Payment is made by hand against an invoice; the application does not take card payments.
Messages: anything you send me when you ask for support.

Information obtained through Google APIs (only after you connect Google Drive; see Google API access)

The identifiers of the Google files and folders you selected or authorised, and relevant details about them such as their names and types.
The content of scheme-of-work files you selected, so that the curriculum can be read from them.
The lesson-plan Google Docs and folders that the application itself creates for you, and their identifiers.
The Google connection credential that lets the application keep working with your Drive after you leave the page (a “refresh token”), which the server stores encrypted, and short-lived access tokens, explained under Google API access.

Technical and security records: the application keeps records needed to run it and keep it secure, such as sign-in and session events, a record of administrative and authorisation actions (who did what, to which record, and when), and error records. It uses cookies or similar tokens only to keep you signed in. I do not use advertising cookies.

Google API access

When you connect Google Drive, the application asks for exactly one Google permission (OAuth scope):

https://www.googleapis.com/auth/drive.file

Google describes this scope as access to files that you open with, or share with, an app, and files the app creates. It is the only Google permission the application is set up to request. Google shows you its own consent screen, with this scope, before you agree. The application does not use any broader Drive permission, and it does not request access to your Gmail, Calendar, Contacts or other Google services.

What this means in practice

The application cannot browse your Drive. It does not receive unrestricted access to your files. It can work only with files and folders that it creates itself, and files and folders that you select or authorise for it.
You choose the files and folders. You select the scheme-of-work files, the teacher folders and the Lesson Bank folder through Google’s own selection and consent steps. A file or folder you did not select or authorise is not available to the application.
Choosing a folder does not share its contents. Selecting a folder gives the application a place to put the files it creates. It does not by itself give the application the right to read the other files in that folder. Who else can open files in a folder is decided by that folder’s sharing settings in Google Drive, which you control.

How the application uses that access

Reads scheme documents you select. The application reads a scheme of work so that it knows what your department plans to teach, by subject, grade and week, and turns it into a structured, standard form of the curriculum. That curriculum information goes through a verification step before it is used, and lesson planning is built from the verified curriculum.
Creates approved lesson plans. After an HOD approves an exact saved version of a plan, the application creates it as a Google Doc in your department’s Lesson Bank folder.
Creates teacher copies. It creates each teacher’s copy, with class information and dates filled in, in the Drive folder selected for that teacher, and it can update the files it created. Inserting an HOD stamp into copies is not yet available.
Remembers what it needs. It stores the identifiers and relevant details of the files and folders you selected, the normalised curriculum information, and records of the work done.

How Google credentials are handled. The long-lived refresh token is stored encrypted on the server and is opened only when the application acts on your department’s Drive. To let you choose files and folders, the application loads Google’s own Picker script from Google and gives your browser a short-lived Google access token so the Picker can open. That token is therefore present in your browser while you make a selection, and Google access tokens expire on their own. I do not claim that access tokens never reach your browser.

Signing in with Google (not yet live). The hosted application currently signs you in with an email address and password, separately from connecting Drive. If Google Sign-In is released, the application will use it only to recognise you, using basic account identity information (your Google account identifier, name and email address). Drive access would remain a separate authorisation. This page will be updated first.

Withdrawing access. You can withdraw the application’s access to your Google account at any time at myaccount.google.com/permissions (opens in a new tab). After that the application cannot reach your Drive until you connect again, and work that depends on Drive will not complete. Disconnecting Google does not delete the documents already in your Drive, and it does not by itself delete the records the application holds. To have those deleted, see Retention and deletion.

How information is used, and Google’s user data rules

I use the information described above only to provide the Lesson Planner to your department:

creating and managing accounts, department membership and access;
reading authorised schemes of work, processing curriculum information, and generating draft lesson plans and optional reflection drafts;
letting your department review, edit and approve plans, and keeping version and approval records;
creating the approved lesson-plan documents and teacher copies in the Drive folders you authorised, and distributing them;
billing for authorised work, keeping the records the business needs, and sending you invoices;
keeping the application secure, investigating abuse and errors, and giving you support.

Google’s rules, stated accurately. The application is subject to the Google API Services User Data Policy (opens in a new tab) and the Google Workspace API User Data and Developer Policy (opens in a new tab), which governs Google Drive integrations. Their general requirements apply to every scope, whatever its sensitivity: accurate notice of what data is accessed and why, requesting only the permissions needed, handling data securely, and using it only as disclosed. Google’s “Limited Use” section is written for data from sensitive and restricted scopes, and the one Drive scope this application uses, drive.file, is classified by Google as non-sensitive. I do not treat that classification as an exemption from Google’s requirements or as permission to use your data more freely, and I do not claim that Google has reviewed or approved these practices. These are the commitments I make:

I use Google user data only to provide the user-facing lesson-planning features you ask for, as described on this page.
I do not sell Google user data or transfer it to advertising platforms, data brokers or information resellers. I do not use it for advertising or to decide creditworthiness or lending.
CloudX97 does not use Google user data to train its own AI or machine-learning models.
People do not read your Google data unless you ask me to for support and agree, it is needed to investigate abuse or keep the service secure, or the law requires it.
The one place Google user data leaves the application for a third party, other than Google and my hosting provider, is an AI operation you authorise. What is sent and what I cannot control are set out plainly in the next section. I do not treat a statement about providers’ own practices as a substitute for controls in the application.

I will not use Google user data in a new way without first updating this policy and, where required, getting your consent.

AI providers: what is sent, and what is not controlled

The application uses AI to draft master lesson plans, to review them for quality, and to write the optional reflection drafts. The hosted application can be configured, by me as platform owner, to use Google Gemini (one model, gemini-2.5-flash-lite), Groq or OpenRouter. OpenRouter passes a request on to the company that runs the model, so a further company may be involved. Cloudflare Workers AI is an upcoming provider that is not yet available to hosted users.

When. Information is sent to an AI provider only when an HOD takes an explicit action in the application that sends it, such as asking for a lesson-plan draft. There is no unattended sending and no automatic switch to another provider if one fails.
What is sent for a lesson plan. The subject, grade, term, week and week-ending date, the scheme topic and subtopic, and the curriculum fields that your HOD accepted for that week: general objective, content, activities, resources and evaluation strategy. These fields come from the Google Doc scheme of work you selected, so they are Google user data.
What is sent for a review or a reflection. The lesson plan being reviewed or reflected on, which was produced from the above.
What is not sent. Passwords, Google credentials and tokens, your email address, teacher names, Drive file and folder identifiers, billing records and stamp images are not part of what the application builds into a request. The application also rejects a request that appears to contain a student identifier. That check is pattern-based and is not a guarantee, so please do not enter students’ names or other identifying details anywhere in the application.
Scheme-layout identification (not yet live). The intelligent scheme importer may, optionally, send only the short table headings found in a scheme document to an AI provider to recognise its layout. It is built but not released. Lesson generation is separate from it.

What the application does not control. Please read this carefully, because it is a real limit and not a formality:

The application does not check or enforce whether an AI provider keeps the content it receives, for how long, whether people at the provider can read it, or whether the provider may use it to improve or train its models. Those outcomes depend on the provider’s terms and on the type of account or plan its API key belongs to.
For example, the application does not check whether a Gemini key is on a free or a paid plan, and it does not set OpenRouter’s data-collection or zero-retention options. Some provider plans allow the provider to use submitted content to improve its products.
Choosing a provider is done by me as platform owner. Each approval is my own review of that provider’s terms, recorded as a confirmation in the application. It is not a technical restriction on what the provider does with the content.
CloudX97 itself does not train models on the content, and I do not sell it. I cannot promise what a third-party provider does.

I am telling you this so that your department can decide whether to use AI generation for content taken from your Google Docs. Technical controls that would restrict Google-derived content to provider configurations with confirmed no-training and no-retention terms have not been built. Until they are, this page will not say that such a restriction exists. If you do not want content from your Google Docs to go to an AI provider, do not authorise AI generation, and write to hello@cloudx97.com. AI drafts can also be wrong, which is why the application is built around human review. An AI-generated reflection is a draft; it is not evidence that a lesson took place or of what students did.

Your department. The HOD and the teacher and reviewer accounts the HOD has authorised can see the department’s records. Teachers who receive copies see the files placed in their Drive folders.
Google, which provides Google Drive, Docs and Picker when you connect them, and the Gemini service when it is used.
Groq and OpenRouter, and the company that runs the model behind OpenRouter, when they are used for an authorised AI operation. Cloudflare will be added here only when its integration is released.
Hostinger, which provides the hosting and the databases the application runs on.
Email and messaging. The application does not currently send automated email. I deliver invitation links and account help myself, using email or a messaging service such as WhatsApp, so those services will handle the message I send you.
Me, as the operator, for support, security and running the service.
Authorities, where the law requires a disclosure.

I do not sell information, rent it, or share it for marketing, and CloudX97 does not use it to train AI models. Third-party AI providers are covered in the previous section. If your school has its own rules about staff or student information, those apply to you as well.

Storage and security

The application runs at planner.cloudx97.com over HTTPS, on Hostinger’s hosting infrastructure, with its records kept in MariaDB databases. The protections I use include:

invitation-only accounts, sign-in with a password, and session management, with optional Remember me;
multi-factor authentication (MFA) for the accounts I use to run the service as platform owner;
separation by school and department, so that a department’s records are reachable only through accounts that belong to that department;
the Google refresh token, and AI provider keys, stored encrypted on the server and bound to the department they belong to; short-lived Google access tokens are given to the browser only for Google Picker, as explained above;
private working drafts, and approval and version records.
Password recovery is manual: there is no automatic reset email. See Your choices, rights and contact.

Encrypted storage of HOD stamp images is part of the pending release and is not yet live. No online service can promise perfect security. I do not claim any independent audit, security certification or compliance certification, and I do not claim that backups have been tested for restoration or promise that information can be recovered from a backup. You are responsible for keeping your own password, device and Google account secure.

Retention and deletion

I have not set fixed retention periods for most Lesson Planner records, and this page does not promise automatic deletion after any set time. A department’s records are kept while it uses the application, because it needs them to work: your curriculum, your plans and their history, and your invoices. Invoices and payment records may also have to be kept for business and tax purposes.

Working drafts. Recoverable working drafts (a lesson you were editing but have not saved as a version) expire after seven days. Expired drafts are no longer offered to you and are removed opportunistically, when the application next looks at your own drafts; there is no scheduled purge. An expired draft may therefore remain in the database, and in backups, for longer than seven days.

Disconnecting Google. This ends the application’s access to your Drive. It does not delete documents in your Drive and does not delete the application’s records.
Deleting documents in Drive. Files the application created in your Drive are in your Drive. You can delete them there yourself.
Deleting application records or closing an account. Write to hello@cloudx97.com. I may need to confirm who you are first, and a request about a whole department’s records may need to come through its HOD. I will tell you if I have to keep something, such as invoices and payment records, and why.
Backups. Deleted details may remain in backup copies for a time. I have not set a period for that on this page.
Access and correction. You can ask me what I hold about you or your department, and ask me to correct it.

Student information

The Lesson Planner is for school staff, and students do not create accounts or sign in. It is designed around lesson plans, schemes of work and class details, not student records, and it does not need student names or other identifying details to work. Please do not enter them. If someone does enter student information, it is handled like the other information in this policy, and it must not be submitted for AI processing. This policy does not claim compliance with any particular children’s-privacy or education-privacy law. Your school remains responsible for its own obligations about student information.

Your choices, rights and contact

You choose whether to connect Google Drive, and which files and folders to select. You can withdraw access at any time at myaccount.google.com/permissions (opens in a new tab).
You choose whether to use optional features, such as Remember me, AI reflections and reviewer accounts.
Forgotten password. The hosted application does not send reset emails. Write to hello@cloudx97.com from the address on your account. I will check that it is really you, then reset your access by hand and give you a new link directly. This is a manual process, so it can take time.
You can ask me for access, correction or deletion, and ask for help with disconnecting. If the law that applies to you gives you further rights, this page does not limit them.

Contact: write to hello@cloudx97.com and I will reply personally. If a message is about privacy, please put “Privacy” in the subject. CloudX97 is based in Guyana.

Changes to this policy

If how the application handles information changes, this page changes with it and the effective date above is updated. If I change how Google user data is used, I will update this page before the change and tell the affected users. The earlier combined policy for this application was published at cloudx97.com/privacy/; that page now covers the website, and keeps a short pointer to this policy.

CloudX97 Lesson Planner: privacy policy