Privacy policy
Effective October 10, 2026
Summary
- We don't ask for real names, birth dates, diagnoses, email addresses, or passwords. Learners and accounts get generated names and private codes.
- Handy ABA Tools does not sell or share personal information. There are no ads, and we don't track you on other websites or apps.
- Saved records stay until an adult deletes them. We delete a learner's records 24 months after their last activity.
- Handy ABA Tools isn't for protected health information (PHI), and it is not HIPAA compliant.
Who we are
Handy ABA Tools (https://aba-tools.com and the iOS app) gives teaching activities and session tools to the adults who work with a learner. In this policy, "we" and "us" mean Handy ABA Tools. You can reach us at privacy@aba-tools.com.
Handy ABA Tools doesn't give medical advice, and it doesn't diagnose or treat any condition.
Who uses Handy ABA Tools
Adults use Handy ABA Tools: BTs, BCBAs, supervisors, parents, and RBT students. An adult creates each learner and each account.
Learners do activities on a device an adult controls. We don't ask learners for personal information, and a learner can't make anything public in Handy ABA Tools.
What we keep on our server
We keep only the data below. Each item is a choice from a fixed list, a number, a date, or a code. There's no place to type free text about a learner.
Learners
A generated name and picture for each learner (for example "Blue Otter") and a private learner code. We also keep the date the learner was created, the date of their last activity, and the time the adult checked "I am an adult" when creating them.
Tool setup for a learner
Which tools are on for the learner, each tool's setup choices, and the Next time lists. Each one is a choice from the tool's own lists.
Saved responses and scores
For each session: the date and time, the target, the response (a choice from the tool's list), and the result, plus the help level or condition. Flashcards also saves the card order and each card's score. Learners make some responses themselves, such as tapping a picture in Find It or a button in Say It. Adults enter the rest, such as Observe intervals, Tiny Bites steps, and Flashcards scores.
Trace It scores and pictures
The two scores for each trace. If Save trace pictures is on, we also keep the points of each line the learner traced. These pictures are the learner's drawings.
Assessments
Milestones Tracker, Barriers Checklist, and Transition Readiness: the date, the rater ("primary" or "second" only), and each item's score.
Supervisor and BT accounts
A generated name for each account (for example "Red Heron"), a private account code, and the account's groups. Also the learners on a supervisor's list, the learners assigned to each BT, and the prepared notes a supervisor sends. Group names and notes come from fixed lists.
RBT Gym study accounts
A generated name, a private study code, and your study progress: item IDs, counts, dates, and practice exam scores. We don't keep the answers you type.
RBT Gym problem reports
When someone taps Report a problem: the study item, its version, a reason from a list, and the time. A report has no account, code, network address, or typed text.
Content reviews
From adults we invite to review study content: the name the reviewer types, their marks, and their notes on study items. Notes must not be about a learner.
Anonymous usage counts
Daily numbers: how often the website, the app, a page, or a tool opened, and how often a tool started or finished. We also count setup choices, saves that worked or failed, errors by type, and uses of Share or a join link. We count time on page in ranges, device types, screen sizes, and, in the app, the iOS version. On the website, we also count visits, the kind of site they came from, browser families, and page speed. Each count has only the date, the platform, and the version. A count has no ID for a device, browser, visit, learner, session, or account, and no network address, location, time of day, answers, or scores.
Service records
The random ID of each response someone deleted, and the dates of a daily usage alert we send ourselves.
Generated names don't make records anonymous. Your learner's team can still know who the learner is.
How we get the data
The website and the app send data to our server when an adult creates a learner or an account, and when someone uses a tool for a learner. A tool saves only for a learner an adult has selected, and only when that tool is on for the learner. In guest mode, nothing is saved on the server.
Usage counts: the website and the app count how they're used. In the app, an adult can turn off Usage analytics in Privacy and analytics. Then the app counts nothing and sends nothing.
Page visits: on the public pages for adults, a page-visit counter from our hosting and security provider counts visits for us. It doesn't run on the screens a learner uses, or in an activity.
How we use the data
- To run the tools and save each learner's records.
- To show dashboards and CSV exports to people who have the learner code or a team account.
- To let a supervisor and their BTs work with the same learners.
- To keep the service secure and prevent abuse.
- To count use and find errors, using only the anonymous counts and the page-visit counter.
- To fix the study content, and to answer your messages.
We don't use the data for ads, to build profiles of people, or to contact a learner.
How long we keep data
Here's how long each kind of data is kept.
| What | How long | Details |
|---|---|---|
| Learners and their records | Until an adult deletes the learner, or 24 months after the learner's last activity | A learner with nothing saved is deleted 90 days after it was created. When supervisors delete their account, the learners they created are deleted too. If other supervisors also have one of those learners, it can be kept for them. |
| Tool setup for a learner | As long as the learner | Deleted with the learner. |
| Saved responses and scores | Until someone deletes them, or the learner is deleted | For 30 minutes, the person who saved a response can take it back with Back. A supervisor can delete a session or a single response at any time. |
| Trace It pictures | 180 days | The scores for each trace stay with the response. |
| Assessments | Until an adult deletes the assessment, or the learner is deleted | |
| Supervisor and BT accounts | Until the account is deleted | A BT can delete their own account. A BT account is also deleted when the supervisor removes the BT or deletes the supervisor account. A supervisor account with no learners and no BTs is deleted 90 days after it was created. |
| RBT Gym study accounts | Until you delete the study account | A study account that never saved progress is deleted 90 days after it was created. |
| RBT Gym problem reports | No time limit | They're the repair history of the study content, and they contain nothing about a person. |
| Content reviews | 365 days after the review link is turned off | Then the reviewer names, marks, and notes are deleted. |
| Anonymous usage counts | Daily counts: 25 months, then monthly totals with no time limit | Share and join counts have no time limit. No count can identify a person. |
| IDs of deleted responses | 7 days | So a deleted response doesn't come back. |
| Daily alert dates | 365 days | So only one alert is sent each day. |
| Database backups | 7 days | Copies kept to restore our databases. Data you delete can stay in a copy until the copy expires. |
| Network addresses | 60 seconds | Used only to limit requests. We don't store them. |
| Service logs | Up to 7 days | Used to find errors. They contain no codes, names, or network addresses. |
| Page visit data | 6 months | Full detail for the first 7 days, then only a sample. |
| Messages to us | 24 months after the last message | To answer you, and to keep a record of what we did. |
How to see, correct, or delete data
- See it: open the learner's dashboard with the learner code, or with a team account. You can export the records as a CSV file.
- Correct it: change the setup in the tool. A supervisor can delete a session, or a single response, on the dashboard.
- Delete a learner: in the learner menu, choose Delete for everyone and type the learner's name. All of the learner's records are deleted. BTs can't delete learners.
- Delete an account: on the Team page, a supervisor or a BT can delete their own account by typing its name. A supervisor can also remove a BT account. When supervisors delete their account, we also delete each learner they created, with all of that learner's records. If other supervisors also have one of those learners, the supervisor can keep it, and the supervisor who added it first becomes its owner. Learners they added with a learner code stay. A BT account is deleted with its notes, and its learners stay with the supervisor. You can delete a study account in RBT Gym.
- Stop a code from working: choose Reset code. Other devices then can't open the learner.
- If you can't do it yourself, email privacy@aba-tools.com. Include the generated name of the learner or account, and the name of the BCBA or clinic. We don't know learners' real names.
Children
Many learners are children. Handy ABA Tools is a tool for adults, but we take extra care with the data a learner creates.
- What we collect from a learner: the responses they make in an activity, such as the picture they tap, and the buttons they press in My Way and Say It. If Save trace pictures is on, also their trace pictures.
- How we use it: only to show the learner's progress to the adults on the learner's team.
- Who receives it: no one except our hosting and security provider, which stores it for us. A learner can't make it public.
- Identifiers: the learner code and the learner ID are persistent identifiers. We use them only to save and show the learner's records, to keep the service secure, and to count each save. We don't use them to contact anyone or to build a profile.
- How long: see "How long we keep data." Trace pictures are deleted after 180 days, and all records 24 months after the learner's last activity.
A parent or guardian can see a learner's records, delete them, and stop further collection. To see them, open the dashboard with the learner code. To delete them, choose Delete for everyone. To stop further collection, ask the learner's team to turn off the learner's tools, or delete the learner. If you don't have the code, ask the learner's BCBA, or email us.
We don't ask for more information than an activity needs.
Consumer health data
Some state laws protect consumer health data. A learner's records can reveal information about a behavioral intervention. We collect this data only to provide the service an adult asks for: saving and showing a learner's progress.
- Kinds of data: a learner's responses, scores, assessments, and setup (see "What we keep on our server").
- Source: the adults who use Handy ABA Tools, and the learner during an activity.
- Use: only to save and show the learner's progress.
- Sharing: none. Our hosting and security provider stores the data for us. We don't sell health data.
- Your rights: you can see this data, delete it, and withdraw your consent. To withdraw consent, delete the learner, or stop using the tools for that learner.
To use these rights, or to appeal a decision, email privacy@aba-tools.com. We reply within 45 days.
Not for protected health information
Handy ABA Tools is not for protected health information (PHI) as HIPAA defines it, and Handy ABA Tools is not HIPAA compliant. We don't sign business associate agreements.
Don't use Handy ABA Tools as a clinic's clinical record. Don't enter real names, birth dates, diagnoses, or other identifiers.
Security
We use reasonable security measures to protect your data. No system is completely secure. Share a code only with the learner's team. If someone has a code they shouldn't have, choose Reset code.
Do Not Track and other websites
Handy ABA Tools doesn't track you over time or across other websites or apps. So it works the same way whether or not your browser sends Do Not Track or Global Privacy Control. No other company collects data about your activity across websites through Handy ABA Tools.
Changes to this policy
When we change this policy, we post the new version on this page and in the app, with a new effective date. If a change affects what we collect from learners or how we use it, we'll also give any notice the law requires.
Contact
Questions about this policy or your data? Email privacy@aba-tools.com.