FERPA

How Dabbled for Schools handles education records · Last updated September 22, 2026

The short version

We hold very little that could be an education record, and what we hold belongs to the school. A student here is a nickname and the apps made under it — no name, no email, no birthday, no grades, and nothing imported from a student information system. We use that record only to run the product for the school, we act on the school's instructions about it, and we delete it when the school says so.

What could be an education record

• A student's nickname and the class it belongs to. The nickname is chosen by the student or teacher, and the product has no field for a legal name.
• Apps a student makes in a class, attributed to that nickname, including the description they wrote and the app that was built from it.
• Lesson notes a teacher writes about a class — what was covered and how it went. These are private to the teacher who wrote them and can describe a class's progress in general terms.

That is the complete list. There are no assessments, attendance, discipline records, health information, or contact details for students anywhere in the product.

Our role

We act as a service provider to the school. The school decides which students use the product, supervises that use, and directs what happens to the records it produces. We do not use education records for any purpose other than providing the service to that school, and we do not disclose them to anyone else except the subprocessors listed below, who need them to run the service.

[Decide, with counsel, whether we operate under the FERPA "school official" exception, with the school retaining direct control over the use and maintenance of the records. If so, say it here and put the same language in the district agreement; if not, describe the basis on which records are shared with us.]

Who at the school can see what

Access follows the school's own roles. A school administrator can see the school's apps, classes and students. A teacher sees their own classes, their own students' work and their own lesson notes. Nobody outside the school sees a school's records unless the school publishes an app to the public library, and a published app is attributed to the school, never to the student.

Parents and eligible students

A parent's right to inspect and review a student's education records runs through the school, which holds the account and knows which nickname is which child. Ask the school; the school can see everything the product holds about a student and can request a copy or a deletion from us at [privacy contact address].

Deletion

A teacher or administrator can delete apps and lesson notes in the product at any time, and deleting means deleting. A school can ask us to remove a student, a class or the whole school, and we will. Backups roll off on their own schedule, so a deleted item may persist in a backup for [retention window] after it disappears from the product.

Subprocessors

• Anthropic — app descriptions, follow-up answers and existing app content are sent to Anthropic's API to build, revise and tag apps and to answer questions. Content sent through the API is not used to train models. A student's nickname is not part of what is sent.
• Stripe — school billing; no student data.
• Our email provider — staff verification emails; no student data.
• Our hosting provider — everything, in the ordinary sense that the application runs on their machines, in [hosting region].

Security

Passwords are stored as bcrypt hashes. A student's session token and recovery code are the only credentials a student has, and neither identifies them outside the product. Traffic is served over HTTPS. Personal information is kept out of server logs. [Add breach-notification commitments and timelines once agreed.]

Changes

If we change how education records are handled we will update the date at the top and tell schools directly.

See also: Privacy Policy · COPPA · State privacy laws · Questions: [privacy contact address]