Student Data Privacy, Written for the People It Protects

This notice is written for:

• Students using READTYCH through an educational institution.
• Parents and legal guardians.
• Educators and school administrators.
• School districts and charter networks.
• Universities and research institutions.
• Government agencies and education departments.
• Organizations evaluating or participating in a READTYCH pilot.

It covers student information handled through the READTYCH Digital Book, education platform, institutional portals, and related learning services.

The public READTYCH website follows the broader practices described in our Privacy Policy and Cookie Policy.

When a school or another educational institution provides READTYCH to students, the institution usually decides why the technology will be used, which students will participate, what information will be provided, and which features will be enabled.

READTYCH provides the technology and processes student information to deliver the services requested by that institution.

Depending on the law and the arrangement involved, the institution may be described as the data controller, educational agency, or owner of the education records. READTYCH may be described as a service provider, processor, contractor, or school official performing an institutional service.

The terminology can change, but the practical principle remains the same:

Student information provided through an institution should be used to deliver and support the authorized educational service.

READTYCH does not gain independent ownership of a student’s education records simply because the information passes through our technology.

The information handled by READTYCH will depend on the institution, the educational setting, the features being used, and the stage of product development or pilot participation.

Not every institution will use every feature or provide every category of information.

Student information may be provided:

• Directly by a school, district, educator, or authorized administrator.
• By a student while using the Digital Book or platform.
• Through an approved institutional integration.
• Through a school-authorized educational application.
• Automatically through the use of the device or platform.
• Through a support request.
• During an approved pilot, research, or evaluation program.

The institution controls which students participate and which authorized systems are connected, subject to its agreement with READTYCH.

READTYCH may use student information to provide the educational services authorized by the institution.

That can include using information to:

• Create and maintain student accounts.
• Connect students with the correct school, class, educator, and course.
• Provide assigned books and learning materials.
• Save and organize notes, annotations, and student work.
• Deliver assignments and assessments.
• Return educator feedback.
• Show students their own learning activity and progress.
• Help educators view and respond to student work.
• Support role-based school and district functions.
• Operate approved educational applications and integrations.
• Maintain, secure, and troubleshoot the Digital Book and platform.
• Provide technical and user support.
• Prevent unauthorized access, misuse, or fraud.
• Meet contractual and legal responsibilities.
• Evaluate product performance during an approved pilot.
• Improve the reliability, usability, accessibility, and educational value of the service where permitted by the institution and applicable law.

READTYCH will not require a student to provide more personal information than is reasonably needed to take part in the authorized educational activity.

READTYCH is developing AI-assisted capabilities that may help educators organize information, recognize handwriting, review student work, identify learning patterns, prepare feedback, or find relevant educational resources.

Student information should not become a shortcut to an automatic conclusion about a child.

A pattern may suggest that an educator should look more closely. It should not permanently label a student.

A grading suggestion may help reduce repetitive work. It should not make the final academic decision.

A resource recommendation may help a student practice. It should not determine the limits of what that student can achieve.

READTYCH’s principle is clear:

AI assists. Educators decide.

Where AI-assisted features process student information, READTYCH intends to:

• Connect the feature to an authorized educational purpose.
• Limit the information used to what the feature reasonably needs.
• Give institutions appropriate information about how the feature works.
• Keep educators involved in meaningful academic decisions.
• Apply role-based access to AI-generated suggestions or insights.
• Allow institutions to evaluate whether an AI-assisted feature is suitable for their environment.
• Review the feature for privacy, security, fairness, and educational relevance.

READTYCH will not use student information to train a general-purpose commercial AI model unless the institution has expressly authorized that use and the practice is permitted by applicable law.

Where deidentified or aggregated information is used to improve a system, READTYCH will take steps designed to prevent the information from being connected back to an identifiable student.

Handwriting can be deeply personal. It can also form an important part of how a student thinks, solves problems, and communicates understanding.

READTYCH may process handwritten notes, annotations, diagrams, calculations, and assignment responses to provide educational functions such as saving work, organizing notes, recognizing written content, or allowing an educator to review a response.

READTYCH does not intend to use student handwriting to establish or verify a student’s identity through biometric recognition unless that use is separately disclosed, specifically authorized, and permitted by applicable law.

Handwriting recognition is intended to help make written educational content more usable. It is not intended to create a hidden identity profile.

READTYCH will not use student information to:

• Deliver behaviorally targeted advertising to students.
• Build commercial advertising profiles about students.
• Sell student information in exchange for money.
• Use education records for an unrelated commercial purpose.
• Make a student’s personal information publicly available.
• Allow unauthorized users to view student work or learning records.
• Make a final academic decision solely through artificial intelligence.
• Keep identifiable student information indefinitely without an educational, contractual, security, or legal reason.
• Require a student to surrender unnecessary personal information simply to participate in an educational activity.

Student information should support the learning experience for which it was provided.

It should not quietly become a different product.

READTYCH does not make student information available to outside organizations simply because it may be commercially useful.

Information may be shared in limited circumstances.

READTYCH may create information that has been combined across users or altered so that it is no longer reasonably linked to an identifiable student.

This information may help us understand technical performance, improve accessibility, evaluate feature use, study general learning workflows, or plan future product development.

When READTYCH treats information as deidentified, we will not attempt to reconnect it with an individual student except where reasonably necessary to test whether the deidentification process is effective or where otherwise permitted by law.

Deidentified information should not be released in a form that could reasonably identify a student.

No digital service can promise that a security incident will never occur.

What READTYCH can promise is that student information will be treated as information worth protecting.

Our security approach may include administrative, technical, and physical safeguards designed around the nature of the information and the risks involved.

These safeguards may include:

• Access controls based on a user’s role.
• Authentication and account protections.
• Encryption where appropriate.
• Secure development and testing practices.
• Monitoring for suspicious activity.
• Vulnerability management.
• Backups and service recovery planning.
• Staff confidentiality and security responsibilities.
• Service provider review.
• Incident response procedures.

Security will continue to develop alongside the product, the platform, institutional requirements, and the risks facing education technology.

If READTYCH becomes aware of unauthorized access to student information, we will investigate the situation, work to contain it, and take steps appropriate to the nature of the incident.

Where required by law or an institutional agreement, READTYCH will notify the affected institution and provide available information that can help it respond.

The institution may be responsible for communicating with students, families, regulators, or other affected parties, depending on the circumstances and applicable law.

Our response will focus on understanding what happened, protecting affected information, restoring secure operations, and reducing the chance of the same issue happening again.

Student information should not remain in a system simply because deleting it is inconvenient.

READTYCH will retain identifiable student information only for as long as it is reasonably needed to:

• Provide the service requested by the institution.
• Maintain an active student or institutional account.
• Meet the requirements of an institutional agreement.
• Support an authorized pilot or research activity.
• Protect the security and integrity of the service.
• Resolve a dispute or support request.
• Meet a legal obligation.

Retention periods may differ depending on the type of information, the institution’s instructions, backup practices, and applicable law.

When an institutional relationship ends, READTYCH will return, delete, or deidentify student information according to the agreement, the institution’s instructions, and legal requirements.

Information stored temporarily in backups may remain for a limited period until those backups are securely overwritten or expire through the normal backup cycle.

Rights concerning education records often need to be exercised through the school or institution responsible for those records.

Depending on applicable law, institutional policy, and the student’s age, a parent, guardian, or eligible student may have the right to:

• Ask what student information is being collected.
• Review education records.
• Request correction of inaccurate information.
• Request deletion where the law allows it.
• Ask how information is being used or shared.
• Withdraw consent where processing depends on consent.
• Ask that further collection or use stop in certain circumstances.
• Raise a concern about the handling of student information.

If READTYCH receives a request concerning institution-controlled student information, we may direct the request to the institution or work with the institution to respond.

This helps ensure that information is not released, changed, or deleted without appropriate authorization.

Subject to the applicable agreement and law, an institution may be able to:

• Review the categories of student information processed by READTYCH.
• Configure roles, permissions, and enabled features.
• Request access to student information under its control.
• Correct or update institutional account information.
• Request deletion or return of student information.
• Review relevant service providers and data practices.
• Assess integrations before enabling them.
• Receive information about material security incidents.
• Establish institution-specific retention and implementation requirements.

READTYCH intends to provide institutions with enough information to evaluate the service responsibly.

Privacy responsibility should not be pushed onto an individual teacher through a hidden clause or an unclear process.

The Children’s Online Privacy Protection Act, commonly known as COPPA, applies to certain online collection of personal information from children under 13.

When READTYCH is used through a school for an authorized educational purpose, the school may be permitted to provide consent on behalf of a parent in circumstances allowed by COPPA.

That authority is limited to the educational context. It does not permit student information to be used for unrelated commercial purposes.

READTYCH remains responsible for meeting the obligations that apply to it as the operator of the service. We do not place sole responsibility for READTYCH’s COPPA compliance on teachers, schools, or families.

Where parental consent is required directly, READTYCH will seek that consent before collecting covered personal information.

Parents or schools may contact READTYCH to ask about information collected from a child, review that information where applicable, request deletion, or prevent further collection when the law provides that right.

The Family Educational Rights and Privacy Act, or FERPA, protects the privacy of student education records maintained by many US educational institutions.

When READTYCH receives education records from an institution under the FERPA school official exception, the arrangement must satisfy the requirements that apply to that exception.

READTYCH would use the information for the purpose for which the institution provided it, remain subject to the institution’s control regarding the use and maintenance of the records, and avoid unauthorized redisclosure.

FERPA rights are generally exercised through the school or educational institution.

READTYCH may also be subject to state student privacy laws, contractual requirements, and other rules depending on the location and type of institution involved.

This notice does not replace the institution’s own FERPA notice or student privacy policy.

READTYCH may work with schools, universities, researchers, or education organizations to evaluate the Digital Book and connected platform.

A pilot may examine usability, educator adoption, classroom workflow, device performance, accessibility, learning activity, or readiness for wider deployment.

Before student information is used for research or evaluation, the participating organizations should define:

• What is being studied.
• Which information is needed.
• Who may access it.
• How long it will be retained.
• Whether information will be identifiable, coded, or deidentified.
• What notices, permissions, or approvals are required.

Participation in a pilot does not give READTYCH unrestricted permission to use student information for unrelated research.

Where possible, evaluation should use aggregated or deidentified information.

READTYCH may update this Student Data Privacy Notice as the product develops, institutional features change, or privacy requirements evolve.

The “Last Updated” date will show when the notice was most recently revised.

If a change materially affects how student information is collected, used, or shared, READTYCH will provide additional notice to participating institutions and request consent or authorization where required.

We will not quietly apply a materially broader use of student information simply by changing words on a webpage.

Students and families deserve understandable answers about educational technology.

If you have a question about information controlled by your school, the school or district may be the best place to begin. It can explain why READTYCH is being used, which features have been enabled, and how local student privacy rights are handled.

You may also contact READTYCH through our Contact page.

Please include “Student Data Privacy” in your message so it can be directed appropriately.

Ask a Student Privacy Question →

Schools, districts, education departments, universities, and pilot partners may contact READTYCH to discuss student information practices, security, legal requirements, retention, deletion, integrations, AI-assisted features, or contractual safeguards.

Contact the READTYCH Privacy Team →

A submission is not merely a file.

A missed question is not merely a percentage.

A handwritten note is not merely training material.

Behind every record is a student learning, trying, changing, and becoming more capable over time.

READTYCH is being built to help educators understand that journey more clearly.

The information created along the way deserves limits, protection, and human judgment.

Student data should serve learning.

It should never cost a student their privacy.