Student Data Privacy and Security Overview

1. Summary

• We collect the minimum needed to teach: a student's first name, grade, class, a cartoon picture they chose, and their learning data. No student emails, home addresses, birth dates, photos or location.
• Student data is used only to provide the service to the school. No advertising, no selling of data, no profiling for any purpose other than teaching the student, no third-party trackers in the app.
• A student's learning data is readable only by the class's teachers and the parents the school links. Administrators see aggregates (groups of 10 or more) and a roster of names.
• The district owns the records. We are a school official under FERPA and act on the school's consent under COPPA. We sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) with the state exhibit.
• Read-along books listen to the child on the device. No audio is recorded or transmitted.
• Data is encrypted in transit and at rest, hosted in the United States (AWS us-east, through Supabase), with row-level access control enforced in the database itself.
• At the end of a contract the school receives an export on request and all student records are erased within 90 days, with written confirmation.

2. Data inventory

Not collected: student email, phone, home address, date of birth, photographs, audio or video recordings, precise location, biometrics, social-media identifiers, free-text about the student other than teacher–parent notes. Writing lessons keep the text a student types for grading on the device; optional "Advanced Polish" feedback sends the text to a language model and keeps no copy — it is off by default for school students.

3. Who can see what

These rules are enforced by row-level security in the database, not only in the app: a request that is not the class's teacher or a linked parent cannot read a student row, whatever client made it.

4. COPPA, FERPA, PPRA and state laws

COPPA (Children's Online Privacy Protection Act)

We collect personal information from children under 13 only for the school's educational purpose and with the school's consent, as the FTC allows schools to give on parents' behalf. We do not use it for commercial purposes, do not show advertising, do not build profiles beyond the student's own learning record, and delete it when the school asks or the contract ends. Parents can review their child's record in the app once linked, and the school can request its deletion at any time.

FERPA (Family Educational Rights and Privacy Act)

Student records remain the education records of the school. We act as a school official with a legitimate educational interest under the school's direct control, use the records only for the purposes the school specifies, do not re-disclose them, and return or destroy them at the end of the engagement. The DPA sets this out.

PPRA

Lessons contain no surveys or questions about the protected areas (political beliefs, religion, family income, sexual behaviour and the rest). Story problems use a fixed cast of fictional animals.

State student-privacy laws

• California (SOPIPA, AB 1584): no targeted advertising, no profiling, no sale, deletion on request, the contract terms AB 1584 requires — all in the DPA's California exhibit.
• New York (Education Law §2-d): the Parents' Bill of Rights for Data Privacy and Security, the supplemental information for the contract, encryption and the breach-notification timeline in the New York exhibit.
• Other states: we sign the state exhibit of the NDPA (Illinois SOPPA, Texas, Colorado, Connecticut and others). Where a state has its own required form, we complete it.

Outside the United States

For schools in the EU/UK we can sign a GDPR data processing agreement with the standard contractual clauses; for other countries we meet the local requirements for consent, purpose limitation and deletion with the same measures, and the agreement states that data is hosted in the United States.

5. The Data Privacy Agreement

We sign the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement, version 1.0 or later, with the exhibit for your state, before any student data is entered. If your district has already signed the NDPA with another provider, our signature joins through the General Offer of Privacy Terms (Exhibit E), which most districts prefer because it needs no new negotiation. Where a district requires its own agreement, we review it.

The NDPA sets out: that the district owns the data; our use only for the specified purpose; no sale, advertising or profiling; the security standards; breach notification; the return or destruction of data at the end of the agreement; and parents' right to review and correct. Our product terms for families (steadylearners.com/terms) do not apply to student data held for a school; the DPA does.

6. Security

• Encryption: TLS 1.2+ in transit; AES-256 at rest (database, backups, file storage).
• Access control: row-level security in the database for every student record; staff access to production needs named credentials and multi-factor authentication and is logged; no shared accounts.
• Authentication: teachers and admins sign in with email + password (8+ characters), Google or Apple; a 6-digit PIN protects grown-up pages on a shared device; wrong PINs lock the keypad with growing delays.
• Students never authenticate and have no credentials to lose.
• Hosting: Supabase (PostgreSQL on AWS, us-east-1), SOC 2 Type II; Cloudflare for the website and web app. Daily backups, retained 7 days, in the same region.
• Software: dependencies updated with each release; the app is reviewed by Apple before each store release; problem reports (no personal data) are reviewed daily.
• No audio leaves the device: read-along listening uses on-device speech recognition (Apple's on iOS, an open-source model in the browser).
• Minimal staff: a small team; every person with production access is listed in the DPA's contact exhibit.

7. Where the data lives: subprocessors

No analytics or advertising SDKs are in the app. Changes to this list are announced to signed districts 30 days in advance.

8. Retention, export and deletion

• During the contract: a student's record is kept while they are active. A teacher archives a student who leaves; the record is erased 90 days later (a school can ask for immediate erasure).
• Export: on request, the school receives its data — per student: the record (lessons, mastery dates, sessions) as JSON and a CSV summary; per school: the aggregates — within 10 business days, through a secure link. A self-serve export in the school overview is planned.
• End of contract: 30 days after the plan's end date, student records are archived; 90 days after that they are erased from the database and, within the backup window, from backups. We confirm the erasure in writing.
• A child who came from a family's own account (a parent linked a child they already had) is handed back to the parent with their progress when the school archives the record — the school's copy is erased.
• Deletion on request: a school may ask for any student's or the whole school's data to be deleted at any time; done within 10 business days.

9. Parent and student rights

A parent linked by the school sees their child's full record in their own app at any time. Requests to correct a record (a misspelled name, a wrong grade) go to the teacher, who can change it. Requests to review or delete records go to the school, which instructs us; we never act on a parent's request against the school's instructions for a school-managed record. Parents may unlink their account from the child at any time without affecting the school's record.

10. Incidents and breach notification

If we learn of unauthorized access to student data, we notify the district's named contact within 72 hours of confirming it (sooner where state law requires, e.g. New York's 7-day rule is met), with what happened, what data was involved, what we have done, and what we recommend; we assist the district with any notifications it must make, at our cost. We keep an incident log available to signed districts on request.

11. Accessibility

Lessons are built for children who cannot yet read: every question is read aloud, every action has a picture, and state is never shown by colour alone. The grown-up pages carry screen-reader labels throughout. A VPAT (WCAG 2.1 AA) for the Teacher Portal and the web app is in preparation and will be provided to districts that ask.

12. Contact

Privacy and security questions, DPA requests, deletion and export requests: [email protected]. Steady Learners, United States. Our general Privacy Policy covers family accounts; for school-managed student data, the DPA governs.