Privacy policy

Papalotl EDU helps teachers write standards-based report card comments. This policy says what we collect, why, and what we will never do. It is written in plain language. It applies to the app at www.papalotledu.com.

What signing in keeps, on every plan

Opening the app requires signing in, usually with your school Google account. Signing in creates your account and a workspace on our servers, on every plan and before any agreement is signed. The account holds your email and the basic profile Google shares. The workspace is a school record named for you, with you as its administrator, your email on the membership, and a note of when it was made. If you turn on the optional first-party usage measurement, offered under Help improve Papalotl, we also keep a record of when Papalotl was open and in use, which part of it, and counts of steps you finished, under your account. It never includes anything about a student or anything you write, and you can turn it off at any time.

Your students are a separate matter. By default your work about them is not saved anywhere at all. It is gone when you refresh. If you choose to keep it on your device, it stays in your browser and we cannot see it. Clearing it in Settings deletes it for good. Nothing about a student reaches our servers until you choose to save to your school account. Comments are written by the app itself, so nothing about a student is sent to an AI company to write them.

What we keep when you save to your school account

When you save to your school account we keep a random code for each student, grade and pronoun, the reading scores you enter, the comments, with the student's own name removed, plus their earlier versions, and a record of each time data was saved. Your device swaps the name for a code like S-K7MPQ2XW before anything is sent, and the list matching codes to names never leaves your device. The server refuses a student record whose ID is not a code. It cannot check comment text for names, because it never sees your roster. Your device takes the names on your roster out of each comment before sending, and a check warns you if a comment mentions anyone else. One honest note: accounts from before August 30, 2026 synced names the old way. Those records are being deleted before school accounts open. Data is stored in the United States, scrambled both while travelling and while sitting on the server, and the database blocks any school from seeing another school's students. A comment's content can still describe a student, so we treat these records as student records and protect them fully.

What we never do

• Sell or rent any data, student or teacher. Ever.
• Use student information for advertising or profiling.
• Train AI models on student information.
• Run third-party analytics or ad trackers in the app.
• Collect student data beyond what the comment workflow needs (no addresses, photos, family details, or behavioral surveillance).

Education records (FERPA)

When a school uses a school account, the student records belong to the school, not to us. We only do what the school tells us to do, under a signed agreement, in the role FERPA calls a "school official". Schools can export their data from the app at any time and ask us to delete it. A person carries out the deletion in the database and confirms it. Our database provider keeps its own backups on its own schedule, which we do not control, and nothing is deleted on a schedule of ours. Signing in creates an account and a workspace before any agreement is signed. The agreement is what sets the terms for the student records kept there.

The laws that apply

These are the student-privacy laws a California school and its vendors work under. Each line says what the law covers and how this product is built for it. A district may have policies of its own, and those come first.

• FERPA (Family Educational Rights and Privacy Act, federal). Education records belong to the school and family. With a school account we act only as the school directs, as a school official under a signed agreement. The school can export its records at any time and have them deleted on request.
• COPPA (Children's Online Privacy Protection Act, federal). Applies to online services directed to children under 13. Students do not create accounts here. Where a school enables student-facing tools, the school authorizes that use and no student personal information is collected for our own purposes.
• PPRA (Protection of Pupil Rights Amendment, federal). Covers surveys and the collection of certain sensitive information from students. The product runs no student surveys and collects none of the protected categories.
• SOPIPA (Student Online Personal Information Protection Act, California Business and Professions Code section 22584). It applies to K-12 online services, apps and websites. It stops a company from selling student data, serving targeted advertising, or building a profile for anything that is not educational. This product runs no ad trackers, builds no profiles and sells nothing.
• Assembly Bill 1159 (signed September 2026). It extends student privacy protection beyond K-12 to college students, and it prohibits a technology company from using student data to develop or train artificial intelligence models. Papalotl EDU trains no model on anything. The comment engine is deterministic and runs on rules written in this repository, and no student work, score or comment is ever sent to a model provider.
• California Education Code section 49073.1 (AB 1584). A contract between a school and a digital vendor must say that the school owns the records, how a family can review and correct them, how the vendor keeps them secure, what happens on deletion, and that the vendor does not use them for any other purpose. Our school agreement follows that section.
• CCPA and CPRA (California Consumer Privacy Act, as amended). They regulate consumer data privacy, give minors added protection, and give an older student the right to opt out of a sale of their data. Education records covered by FERPA are treated separately. Teacher account information follows the rights those laws give, which are access, deletion and no sale.

A company operating in California works under all of the above at once. The three that decide most of how this product is built are SOPIPA, Education Code section 49073.1 and Assembly Bill 1159, because together they rule out selling data, rule out advertising to a child, put the records in the school's hands, and rule out training a model on a student.

None of this is a claim of certification. It says how the product is designed against each law. A school's own counsel decides what its agreement must contain.

Certification

The product has not yet been certified by a third party. The company intends to apply to the 1EdTech TrustEd Apps program for data privacy. No badge is shown until a certification is granted, and this page will name it when that happens.

Your choices

• Use the free tier and keep your students' work on your device.
• Delete your workspace account and data by emailing support@papalotledu.com. A person carries out the deletion and confirms it to you. We aim to do it within 30 days. Backups kept by our database provider expire on its own schedule.
• Export your data (CSV/XLSX) at any time from the app.

Who else is involved

Other companies help run the service. Here is each one and what it gets.

• Vercel puts the website online, and Supabase stores the data for accounts and runs sign-in. These two hold student records saved to a school account.
• Google signs you in when you use a Google account. Resend sends support email, and Stripe takes card payments, each only when it is set up. These three see teacher details such as your email, never student records.
• Google Classroom, when a teacher connects it, sends your class list to the app, student names included, and receives the comments you post to it. MasterAlp, when a district has it set up, does the same with its own class list. Canva is an optional design tool, and the server refuses to send it report text unless a district allows outside processing, which no district setting allows today.

If we add a company that will handle student records, schools get 30 days' notice. If this policy changes in a way that matters, the date above changes and schools are told directly. More detail at /security.

A district reviewing this product against a data privacy agreement can read the obligations one by one at /compliance, including the rows this product does not meet. How a classroom identifier becomes a token, what is hashed and what somebody holding the server would still learn is written out at /tokenization.

Questions or requests: support@papalotledu.com. If you believe data was handled contrary to this policy, we treat it seriously. We reply within 72 hours, look into exactly what happened, and tell you what we find.