Using this site is not consent to psychological research. There are three separate things a person can agree to here, they are asked for separately, and the third one is granted by a guardian when the learner is a managed child. This is how that is arranged and what it refuses to do.
Three tiers, not two
| Tier | What it covers | How it is given |
|---|---|---|
| Learning | The learner’s own answers, shown back to them and to a teacher who teaches them. Review scheduling, mastery, error patterns. | Always on. It is the product — there is no version of this service that does not record whether an answer was right. |
| Analytics | Third-party analytics about site usage. | The cookie banner, unchanged. Refusing it costs you nothing in the product. |
| Research | Pooled or de-identified use, arms of a pre-registered study, cognitive probes, publication. | Explicit, separable and revocable — and for a managed child, granted by their guardian rather than by them. |
An A/B test on a paywall is not research
The research row above says “arms of a pre-registered study”, and the wording is doing real work. Like most sites, we sometimes show two versions of a commercial page — two wordings of an upgrade panel, two layouts of a pricing table — and count which one people prefer. That does not require research consent, and we do not ask for it.
What separates the two is not the method. Both pick a side using the same hash. It is what the side is allowed to change, and what happens to the answer. A study changes something about your learning — what you are taught, when review comes back, what a checkpoint measures — states its hypothesis before anyone is enrolled, and may end up published. A product experiment changes the presentation of the same offer, and the answer changes a button. Only the first is research, and only the first is behind the switch.
Two limits on the second kind, so it cannot quietly grow into the first. It may only touch commercial surfaces — a paywall, an upgrade prompt, a pricing or landing page — which is enforced by the column that records which surface each experiment belongs to, not by anybody remembering the rule. And it never includes a guardian-managed child account: deciding which framing makes someone likelier to pay is not something to do to an account that cannot decide to pay.
A child cannot consent to research on their own behalf
Where an account is a guardian-managed child, a research permission is only valid if a guardian actually gave it. The record carries who granted it, and a grant with no guardian signature is read as no consent at all — so a child cannot turn their own research participation on by finding the endpoint.
This is checked when the permission is read, not only when it is written. A check that only ran at the point of saving would be bypassed by anything that wrote the row another way.
Every failure means no
The question "may we use this person’s data for research right now?" fails closed in every direction. No record, a withdrawn record, a record we cannot parse, a managed child’s record with no guardian behind it, or a database error — all of them answer no.
The only thing that answers yes is a live, current, affirmative record. There is no default, no inherited permission and no "unless you object".
Withdrawing, and seeing that you withdrew
Withdrawal is recorded, not erased. A revoked permission updates the record rather than deleting it, because a learner who withdraws is entitled to see that their withdrawal happened and when — and a deleted row cannot show them that.
This is why there are two separate answers inside the system: one that decides what may be done right now, and one that reports what the record says. The first deliberately throws away detail in order to fail safe; the second is the ledger, and the moment somebody withdrew is exactly the fact a withdrawal record has to preserve.
When the wording changes
Consent is stored against a version of what was agreed to. If the wording changes materially the version moves, and existing consents are marked stale rather than quietly carried over onto terms nobody saw.
A stale consent is visible to the person who gave it, which is the point: it is their decision whether the new wording still describes something they agree to.
The claim a school should check
That is a deliberate design choice rather than a policy promise, and it is the right one to interrogate. A promise that probe data is "not shown" can be changed by a setting; a system that never joins the table cannot leak it by misconfiguration.
The reason is simple enough to state: a cognitive measure in a teacher’s hands stops being a research instrument and becomes a label on a child.
Common questions
No. Everything the learner uses, and everything their teacher sees, runs on the learning tier, which is the service itself. Research consent adds nothing to your own experience — that is why it can be asked for honestly.