This policy explains exactly what Corra collects, where it goes and who else can see it. Corra is used by teachers and holds records about their students, so the short version matters: student data is stored in a single United States region, it is never sold or used for advertising, and it is de-identified on our servers before any of it reaches an AI model.
Five things are true of Corra, and the rest of this page is detail.
Corra is an independent product operated at https://corra.aoneahsan.com, maintained by Ahsan Mahmood. For privacy questions, data-access requests or complaints, write to aoneahsan@gmail.com.
Corra collects three kinds of information, and it is worth separating them, because they are treated very differently.
Under the Family Educational Rights and Privacy Act, Corra acts as a school official with a legitimate educational interest, performing a service that the school would otherwise perform itself, and as a service provider under state student-privacy laws. We process student records only on your instructions, we do not use them for our own purposes, and we do not disclose them onward except to the processors listed below.
Every AI feature goes through a gateway we run on Cloudflare Workers, and de-identification happens there rather than in your browser, so it cannot be skipped by a client that has been tampered with or by a bug in the page.
We process your data to run the product you asked for, and for nothing else. Where the UK and EU GDPR apply, our lawful bases are performance of a contract with you (running your account and the features you use), our legitimate interests in keeping the service secure and working, and your consent where a feature is optional, such as push notifications.
These services receive data today, because their integration is configured and live. Nobody else does.
The code for these services ships in the app but no credentials are configured, so no data reaches them at all. They are listed so the disclosure stays true if that ever changes — and this page will be updated in the same change that switches one on.
Your data lives in Google Cloud Firestore in a single United States region, and stays there for as long as your account exists. Deleting your account removes your account record and the teaching data attached to it; backups and audit records age out on their own schedule, which is measured in weeks rather than years.
Access is enforced by server-side security rules rather than by the app, so a modified client cannot read data it is not entitled to.
You can access, correct, export or delete your data. Deletion is self-service and immediate — the delete-account page inside the app runs it without an email exchange. For access, correction or export, or to object to processing, write to us and we will answer within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority; if you are in California you have the rights described in the CCPA, and we do not sell or share personal information as those terms are defined there.
When the policy changes materially — a new processor, a new category of data — the date at the top of this page changes and account holders are told by email. Minor wording fixes just update the date.
Last updated: 2026-07-21
Corra — The calm core of your teaching day.