Safe for students, simple to approve
Everything a district’s privacy, security, accessibility and purchasing review asks for, in one place.
At a glance
- No ads to students, and student data is never sold; it goes only to the service providers listed under Subprocessors
- Students never need an email address; a school or parent makes their account
- Student records encrypted at rest (AES-256-GCM) and in transit (HTTPS with HSTS)
- Passwords, sign-in codes and security answers stored only as salted hashes
- Clever and ClassLink single sign-on; Google and Microsoft for adults
- Deletion on request, and teachers can remove a student at any time
- Data privacy agreements on the SDPC National Data Privacy Agreement
- Automated WCAG checks (axe-core) on the main screens before each release
Explore
Security
Encryption in transit and at rest, hashed passwords and codes, lockouts, monitoring and backups.
Student privacy laws
COPPA, FERPA, PPRA, SOPIPA, SOPPA, NY Ed Law 2-d and the National Data Privacy Agreement.
Subprocessors
Every service that handles data for us, what it gets and when it is used.
Student data inventory
Exactly what we keep about a student, why, where and who sees it; ready for NDPA Exhibit B.
Data retention and deletion
What we keep, for how long, and how schools and families delete it.
Incident response
How we handle a security incident and when schools hear from us.
Accessibility
Our WCAG 2.2 AA target, the features for every learner, how we test and the known limitations.
Data retention and deletion
| Data | How long we keep it |
|---|---|
| Student records (name or nickname, grade, progress, scores, reflections) | While the school or family uses the account. Deleted from our server as soon as a teacher or parent removes the student or the account is deleted. |
| Adult accounts (name, email, school) | Until the account is deleted by its owner or an administrator. |
| Sign-in activity (no student names) | Kept only to protect accounts, for up to one year, then deleted automatically. |
| Latest sign-in device and place | Device type and approximate place (adults: city; students: state and country only). Replaced at each sign-in; deleted with the account. |
| Device check for new-device emails | A hashed device number, up to 400 days. |
| Quote, trial and subscribe requests, messages and documents requests (adults only) | While we are in touch with the school, then deleted on request. That a school already had a free trial is kept so the one-trial rule works. |
| A school’s class data when its license ends (rosters and progress saved on our server) | Kept for 30 days so the school can renew or download a backup, then deleted automatically (sooner if a signed data privacy agreement says so). |
| IP addresses | Not saved with any account or record; used only in rate-limit counters that expire within an hour. |
Teachers remove students in Admin Console → Users or Students; administrators can remove every student in Admin Console → Data & Backup → Danger zone.
Incident response
Detect
Sign-ins, failed sign-ins and changes are logged for the administrator, repeated wrong passwords lock the account, and browser errors are reported without names.
Contain and assess
We stop the cause, rotate any keys involved and work out which schools, accounts and records were affected.
Notify
Affected schools hear from us within the time set in their signed data privacy agreement (for example 72 hours under NDPA v2.2), with what happened and what we did.
Help and follow up
We help the school notify families as the law requires, and we write up what changed so it does not happen again.
Report a security problem
Found a weakness? Email [email protected] with the steps to reproduce it. Please do not view or change other people’s data, do not degrade the service, and give us reasonable time to fix it before you share it. We will not take legal action against good-faith research that follows these rules. Our security.txt lists the same contact.
Documents for your review
| Document | How to get it |
|---|---|
| Data privacy agreement (SDPC NDPA with your state’s exhibit) | Request it |
| Accessibility Conformance Report (VPAT 2.5, WCAG edition) | Request it |
| Security questionnaire (HECVAT Lite, SIG Lite or your district’s form) | Request it |
| NY Ed Law 2-d supplemental information and data security plan | Request it |
| W-9 and a numbered quote for a purchase order | Request it |
| Privacy policy and terms of use | Read them in the app |
Request documents
Choose what your review needs. The request goes straight to our team, and we email the documents, usually within two business days.
Updated 2026-11-14. This page is a plain-language summary; the signed agreement and the privacy policy govern.