State student privacy laws

Our commitments · Last updated September 22, 2026

The short version

Most state student-privacy laws ask an education service to promise the same handful of things. We keep all of them, and not because a contract says so — the product is built so that it cannot do otherwise. Each commitment below says what in the product makes it true.

What we commit to

• No targeted advertising. There is no advertising in the product at all, and no advertising vendor behind it.
• No selling student information. We do not sell, rent, license or trade any personal information, student or otherwise, and we do not share it for anyone's marketing.
• No profiling. Nothing a student does is used to build a profile of them for any purpose other than keeping their own work together under their nickname.
• Use limited to the educational purpose. Student data is used only to run the product for the school that directed its use: build the apps they ask for, show the school its own work, and let a teacher restore a student's nickname on a new device.
• Data minimisation. A student is a nickname. There is no field for a name, email address, birthday, photograph or location, and no roster import.
• Deletion on request. Apps and notes delete in the product; students, classes and schools are removed when the school asks. See FERPA for what a record contains and how deletion works.
• Security. Passwords are stored as bcrypt hashes, verification links are single-use and stored only as hashes, screenshots are served through signed expiring links, traffic is HTTPS, and personal information is kept out of server logs.
• Subprocessors disclosed. Anthropic (building apps), Stripe (billing), our email provider (staff email only), our hosting provider, and Google Fonts (the typeface). That is the complete list, and it is the same list on every page here.
• Breach notification.[Commit to a notification timeline to affected schools once agreed - many state laws set one.]
• Records stay the school's. A school can see everything it holds here, and we act on its instructions about it.

Laws we are most often asked about

[For counsel: confirm which of these apply to the schools we serve and whether any require a specific agreement or registration. The commitments above are written to satisfy the common requirements of each; the list itself is not a claim of compliance until reviewed.]

• California — SOPIPA (Student Online Personal Information Protection Act) and AB 1584: no targeted ads, no profiling, no sale, deletion on request, security, and the district's ownership and control of pupil records.
• New York — Education Law §2-d and its Parents' Bill of Rights for Data Privacy and Security: a signed data privacy agreement with each educational agency, security aligned to the NIST Cybersecurity Framework, and breach notification. [A §2-d agreement is a document the district supplies; expect to sign one before a New York school can use the product.]
• Illinois — SOPPA (Student Online Personal Protection Act): a written agreement with the school, public posting of subprocessors and data elements, and breach notification within a set period.
• Connecticut, Colorado, Texas, Utah, Washington and a growing number of other states have statutes built on the same commitments — no advertising, no sale, deletion, security, disclosure of who sees what.

Agreements

Where a state or a district requires a data privacy agreement, we will sign one that reflects the commitments above. Several districts use a common template (for example the Student Data Privacy Consortium's National Data Privacy Agreement); we are happy to work from those. Write to [privacy contact address].

See also: Privacy Policy · FERPA · COPPA · AI ethics and data