PUBLISHED 23 AUG 2026 · UPDATED 31 OCT 2026 · THE DPA IS A TEMPLATE — FOR REVIEW BY DISTRICT COUNSEL BEFORE ANY USE
🛡️ AcornSmarts District Privacy Evidence Pack
Prepared 22 Aug 2026 · Updated 31 Oct 2026 (2,500 characters for every grades 9–12 Writing Coach prompt, essays and stories; 19 Oct: settings sent from your account: the request — including the i-Ready word per section and the replace flag — and each device's per-subject counts; 18 Oct: welcome emails: first two weeks, not first week; 17 Oct: password-reset email and its rate-limit records; website analytics wording, page count and fonts; the student's full name on ESA paperwork; every way data reaches the server, now seven) · AcornSmarts (a Black Swan Media Solutions product) · acornsmarts.com · The claims changed on 16 Sep 2026 were checked against the live code that day (app v2.174.0): the app and server code, the deployed server functions and the live sites. Rows that cite an earlier date were not re-tested then. §2 says how each answer was checked, and §7 says which checks are automated; most were checked by hand. Statute references were checked against the official published sources cited at the end. This pack is informational and is not legal advice; the DPA template is a starting point for district counsel.
What changed on 05 Oct 2026. Two terms in the DPA template are now set, and this page and our longer NDPA-style DPA draft say the same thing. Breach notice: we notify the District and affected account holders within 72 hours of confirming a breach of personally identifiable student data (this page had said 30 days). Kansas law asks for faster notice: K.S.A. 72-6318 requires immediate notice to each affected student or parent, so district counsel should compare the two. End of a license: District-linked class data is deleted within 60 days after the license ends, or sooner on the District’s written instruction (the DPA draft had said only “on the District’s instruction”). See §2 and §6. Both documents remain templates for review by district counsel.
What changed on 04 Oct 2026. A Writing Coach answer to one of the three grades 9–12 essays may now be up to 2,500 characters, so a several-paragraph essay fits. Every other prompt and every math explanation stays at 700. It is the same server function, the same Anthropic model, the same no-storage rule and the same retention. If the safety label is set on one of those essays, the note saved on that device keeps the same words the check read (up to 2,500 characters), so a parent sees the passage that set the label. No school partner had a grades 9–12 class with Writing Coach on when this changed. Checked against the deployed server function (version 23) and the app code on 04 Oct 2026.
What changed on 26 Sep 2026. The same Writing Coach check now also grades short written math explanations (“explain why…”) that grades 6–12 math skills occasionally ask for. It is the same server function, the same Anthropic model and the same no-storage rule, with five more human-reviewed coaching lines (20 in all). These items appear only for a child who has Writing Coach — a paid plan or a live school sponsorship, with the district switch on — and never in “just practicing” rounds, on paper, in placement or in duels. Checked against the code on 26 Sep 2026.
What changed on 16 Sep 2026. We re-checked this pack against the live app (v2.174.0) and corrected it:
- §1 now covers every way data reaches our servers, not only signed-in cloud sync. Class-code students sync without anyone signing in. Writing Coach sends answers without sign-in. Every app launch checks whether Writing Coach is available.
- Writing Coach: §1 now names Anthropic, says what is sent, and gives Anthropic's published retention. The earlier wording about discarding answers was true only of our own servers.
- §1 now describes Writing Coach's safety label ("pii" / "distress") in full: what it does, what is saved, and who can see it.
- Names: the class-code join and the teacher roster ask for a first name. The earlier wording about real names is gone.
- Enrollment happens three ways, not only through the family.
- Voice: say-it-aloud items and spoken answers use the browser's speech recognition, which may send audio to the browser maker. Only Reading Buddy is limited to on-device recognition.
- §2 now lists all nine service providers, plus the browser makers' services a device can use. The earlier list left out Vercel, Google (the website and two-device play), ImprovMX and Microsoft 365, the contact form, and browser services. It also said Resend emails only adults; the weekly family summary includes each child's nickname and practice numbers.
- Kansas: the biometric and emotional-state section is K.S.A. 72-6315 (this pack cited 72-6314). §2 and §5 now state facts only and ask districts to review Writing Coach with counsel.
- Writing Coach rate limits: the request counts are keyed by a hash of the network IP address salted with a server-side secret (a hash without a secret salt can be reversed), and a daily job deletes counts untouched for two days.
- The in-app receipt's test does not check this page. §1 and §7 now say what that test covers.
1 · The data map — checked against the code
How this map was checked: each row was checked by hand against the app code, the deployed server functions and the live site on 16 Sep 2026 (app v2.174.0). The app also has its own privacy receipt ("Where your child's data lives"). An automated test (privacyReceipt.test.ts) locks that receipt's cloud-sync list against the family session and reading sync code. That test does not read this page, and it does not cover the class-code or Writing Coach paths.
What can reach our servers — and when
Data reaches our database provider (Supabase) in seven ways: (1) a family or teacher signs in and uses cloud sync, which is opt-in; (2) a student joins a class with a class code, which needs no sign-in; (3) a child taps "Check my writing" in Writing Coach, which needs no sign-in; (4) every app launch on an online device checks whether Writing Coach is available; (5) a grown-up taps "Forgot password?" on the log-in screen, which sends the email address they type, with no sign-in (the server keeps only keyed hashes of that address and the request's IP address, for one hour of rate limiting, and deletes them after a day); (6) a grown-up signs up for the tip sheet on the website or in the app, which sends the email address and language, with no sign-in; (7) a family taps "Let us know" in the app's ESA help, which sends only the two-letter program code, the screen and the language — no account, email or child data.
| Data | Contents, precisely |
|---|
| Grown-up account | The adult's email and display name (a parent or teacher account) — the adult's, never the child's. |
| Child identifier | Nickname or first name, grade, avatar emoji. No child's full name is needed to use the app; the name box asks for a nickname or first name. The class-code join and the teacher roster ask for a first name. A class-code student's name, grade and avatar reach our database without anyone signing in. |
| Practice results | Skill id, level, right/answered counts, seconds, a timestamp, and per-question-TYPE tallies (an internal type name plus seen/missed counts — never question text, never a child's answers). Class-code sync sends the same results without the type tallies. |
| Progress numbers | Per-skill level/score/attempts, plus placement levels if the child runs find-my-level; acorn counts (acorns on hand and lifetime acorns earned), day streak, self-check count, weekly goal; awards list (badge name + emoji). |
| Reading totals | Counts and minutes only — never a single book title. |
| Comfort settings | Practice and reading targets, the predictable-mode and body-break toggles, and accessibility display prefs (easy-read, reading-friendly font, text size, high contrast), so a second device is pre-set. |
| Class membership and rosters | Which class a child joined by code, plus a last-practiced timestamp (the time only). A teacher account also stores each class's name, its join code, and any first names the teacher adds to the roster. |
| Settings sent from your account (only when a family asks) | One request per child: the grade and Below / On / Above per subject (math, reading, science); the i-Ready word per section (Needs Improvement / Approaching / At Grade Level / Above Grade Level, for the K-8 math and reading sections); and an optional yes to replacing untouched starting levels (“Find my level”, a Backpack code, earlier starting levels — never practice, tested-out or server-earned skills). Each device that applies it adds a random code for that account on that device and per-subject counts of starting levels set, kept, or replaceable (subject and sections together, each skill once) — no names, no skill ids, no answers. Guardian-only (never a teacher or a class-code device), cleared when the request changes, deleted 30 days after it was made. |
| Reminder sign-up (opt-in, signed-in parents) | The browser's push address and keys, so we can send a reminder. The notification itself is empty. |
| Writing Coach answers (any paid plan, and students in a class with a live school sponsorship) | Writing Coach shows from kindergarten up, is not offered in kiosk/guest mode, and needs internet. When a child taps "Check my writing," the app sends the answer as typed, the prompt id and the language to our server function (writing-judge). No sign-in is needed, so this happens whether or not the family uses cloud sync. Nothing is sent in rounds marked "just practicing": Writing Coach and written explanations are not offered there.
The function passes the answer (capped at 700 characters, or 2,500 for the grades 9–12 Writing Coach prompts — essays and stories), the prompt text and the rubric to Anthropic (model: Claude Haiku 4.5). It adds no account, student, nickname or device ID, and it does not pass on the IP address. The answer itself can contain any name or detail the child typed.
It gets back: pass or not yet, 1–3 ids from 20 human-reviewed coaching lines, and a safety label (below). The child sees only those pre-written coaching lines, never the model's own words.
AcornSmarts does not store the answer. The function logs only the HTTP status. To limit abuse, it keeps per-minute and per-day request counts, keyed by a short SHA-256 hash of the network IP address, salted with a server-side secret; a daily job deletes counts untouched for two days.
Anthropic's published policy for API customers: it deletes API inputs and outputs within 30 days. It keeps them up to 2 years (safety classification scores up to 7 years) if its automated safety systems flag a request, and longer where the law requires. It does not use API data to train models by default. |
| Writing Coach availability check | Every app launch on an online device asks our server whether Writing Coach is available. The request carries no child data. Our database provider's platform logs still record it (§2, item 1). |
Writing Coach's safety label
- What it is: along with the score, the model returns a label: "none", "pii" or "distress". It is told to set "pii" only for an address, phone number, email, or a full name or school name that goes beyond what the prompt invited. It is told to set "distress" only for first-person, real-world signs of harm, abuse, self-harm, or serious fear or sadness about the child's actual life — never for fictional characters. When unsure, it is told to answer "none". The model is also told the label must not change the grading.
- What the child sees: for "pii", the app always adds the coaching line "Great writing keeps private things private — leave out real names, addresses, and phone numbers." For "distress", the app adds nothing, but the model is told to choose only gentle or encouraging coaching lines. No screen tells the child a label was set.
- What is saved: the date, the prompt (up to 400 characters), the child's words (up to 700 characters, or 2,500 for a grades 9–12 Writing Coach essay or story — the same words the check read) and the label, in that device's own storage. The newest 3 notes of each label are kept. Notes do not expire by date.
- Where notes go: never to our servers, a school or any teacher screen. They are left out of exported backup files, Backpack codes, cloud sync and class sync. The device's own recovery snapshots (Safe Reset and corrupt-data backups) can still contain them.
- Who sees them: only the paid parent dashboard on that device, in each child's "Print & paperwork" section, and only after the grown-ups gate. That gate is the family PIN if one is set. Otherwise it is a spelled-out multiplication question, which cannot keep out an older student. On a shared or class device, anyone who passes the gate sees every profile's notes. On a free-plan device, notes are saved but no screen shows them.
- Off switch: a school or district can ask us to turn Writing Coach off for its classes (we set it; teachers and parents cannot). The safety label itself has no off switch — wherever Writing Coach runs, the label runs.
- Districts should review Writing Coach with their counsel before students use it; that review may call for parental-consent language.
What never leaves the device
- A separate real-name field, if a profile has one. It stays in that device's profile and is left out of backup files. (Whatever is typed in the nickname box does sync — see above.)
- Book titles, kid-made quiz questions, and the Almanac's day-by-day history (only the per-round results listed above sync).
- The family PIN (deliberately never synced and never in a backup).
- Writing Coach safety notes (details and limits above).
- Butterfly Box: if a child's own predictions are consistently below their results (a signal worked out on the device), the app may offer an optional "worry box" screen. What the child types there is not saved or sent; only the date it was offered is kept, on the device.
Voice, camera and handwriting
- Voice: the app never records or stores audio (there is no MediaRecorder use anywhere in the source). Voice input is off by default. Settings opens without the grown-ups gate, but its Voice input switch asks the grown-ups question or the family PIN before turning voice input on (since 17 Sep 2026; since 23 Oct 2026 restoring a backup keeps this device's own voice setting, so a restore cannot turn it on). When it is on, spoken number answers, spoken multiple-choice answers (Pre-K–2) and say-it-aloud items use the browser's built-in speech recognition. In many browsers that service may send the audio to the browser maker (for example Google). Reading Buddy runs only when the browser supports on-device recognition.
- Read-aloud (on by default) uses the device's text-to-speech voices. Some voices the app prefers (Google or Microsoft "Natural" voices) can be online voices run by the browser maker. A few celebration lines speak the child's nickname and acorn count.
- Camera: used only to scan an Acorn Card's printed code (kiosk continuity), with
audio: false; frames are processed on the device to read the code and are never stored or transmitted.
- Handwriting: tracing is scored on the device; strokes are not stored or sent.
2 · Architecture facts a technology director will ask about
| Question | Answer | How it's verified |
|---|
| Advertising? | None, ever. No ad SDKs, no behavioral advertising, no sale of data. | Full dependency list is 7 functional libraries (React, Supabase client, animation, QR, icons). Source audit: zero analytics/tracker/social SDKs. |
| Third-party trackers / analytics? | In the app children use: none. No analytics, no pixels, no ad SDKs, no cookies, and the fonts are self-hosted. The app's enforced security policy (CSP) allows connections only to the app's own site and our database provider (Supabase). Two-device play also uses Google's public STUN server to connect the devices; that server sees each device's IP address and no student data. Voice input and online read-aloud voices can involve the browser maker (§1). The adult-facing website (acornsmarts.com) uses Google Analytics 4 on 18 pages and no Google Fonts (our fonts are self-hosted) — never in the app, and not on the standards reports, the privacy policy page, the founder dashboard, this page or the for-reviewers page (GA4 came off the privacy page and founder dashboard 17 Sep 2026). | Source, markup and live-page check, 16 Sep 2026 (app v2.174.0); page count and fonts re-checked against the site source 17 Oct 2026 (18 pages carry the tag; none loads Google Fonts). |
| Works offline? | Yes — the app is local-first. Once it is installed, and once a paid subject has downloaded, every question and printable works with no connection. Cloud sync, class-code sync, two-device play, Writing Coach and a paid subject's first download need one. | Shipped PWA design; the in-app receipt invites families to test in airplane mode. |
| Student enrollment | Three ways: (1) a family adds the child from its own account; (2) a student joins on a device with the class code, a first name, grade and avatar, with no account; (3) a teacher adds first names to the class roster. No child's full name is needed to use the app (ESA and scholarship paperwork is the one place we ask a parent for it: see Stripe in §2). Teachers see the nickname or first name that was entered. | Family, class-code and roster flows in the code; no sync or form has a full-name field (checked 16 Sep 2026). |
| Biometrics? Emotional state? | Facts for your review, not a legal conclusion: handwriting tracing is scored on the device; strokes are not stored or sent. The camera only reads an Acorn Card's QR code, with audio off; frames are not stored or sent. The app records no audio; opt-in voice answers use the browser's speech recognition (§1). Writing Coach returns a safety label that can mark an answer as showing possible distress, and saves a note on the device for the parent dashboard (§1). The optional Butterfly Box screen can appear from an on-device signal; what the child types there is not saved or sent (§1). Districts should review Writing Coach with their counsel before students use it; that review may call for parental-consent language. | Source check, 16 Sep 2026. See K.S.A. 72-6315 and the definition of biometric data in 72-6313(b) (§5). |
| Deletion | A parent can delete the account in-app; that removes the cloud account and its children's synced data from our database. Our providers' request logs are not tied to an account and are not removed. A student who joined with a class code has no account: the teacher or district can email info@acornsmarts.com to delete that student's data (DPA §6). When a school or district license ends, its class data is deleted within 60 days after the end date, or sooner on the district's written instruction (DPA §6). Redemption/audit ledgers retain no personal link after deletion. | delete-account function; deletion path exercised in testing 22 Aug 2026. End-of-license deletion: a commitment set 05 Oct 2026, done by hand under an internal procedure; not yet run on a real license. |
| Breach notification | Commitment: the District and affected account holders are notified without unreasonable delay, and no later than 72 hours after we confirm a breach of personally identifiable student data (see DPA §6). | Policy commitment in this pack (set 05 Oct 2026). K.S.A. 72-6318 requires immediate notice to affected students or parents; counsel should compare the two. |
| Data location / service providers |
- Supabase (database, sign-in and server functions; US East region). Stores the cloud data in §1. Receives class-code students' name, grade, avatar and progress without anyone signing in. Passes Writing Coach answers to Anthropic without storing them. Receives the launch-time Writing Coach check from every online device. Stores reminder sign-ups (push address and keys). For password-reset requests it keeps, for one hour of rate limiting, only keyed hashes (HMAC) of the email address and IP address asked from, never the address itself, and an hourly job deletes them after a day. Its platform logs record each request's IP address, browser, approximate location (city, postal code) and network operator; request bodies are not logged.
- Vercel (hosts app.acornsmarts.com and acornsmarts.com). Serves static files only. Receives ordinary request details: IP address, browser, and the page address, which can include a class code in a join link. No student records. Vercel Web Analytics is not turned on.
- Anthropic (Claude Haiku 4.5; the Writing Coach check only — which also grades the short written math explanations in grades 6–12). Receives each Writing Coach answer, the prompt text and the rubric (§1).
- Resend (email delivery; Resend sends through Amazon SES). Receives each recipient's email address and the email content: the weekly family summary (Sundays, to every parent account whose child practiced that week; there is one-click unsubscribe in every one of these emails since v2.182.0, plus a toggle in the app’s account panel), with each child's nickname, days practiced, questions answered and correct, minutes, acorns and hardest question type; a one-time note to a free-plan family whose child stopped practicing, with the child's nickname (also in the subject line), days practiced and question count (this note respects the marketing opt-out); waitlist tips (email and language only); three welcome emails in a new parent account's first two weeks (how to get started, a check-in a few days later and a first-week note sent on day 7 to 12), with each child's nickname, days practiced, questions answered and correct, and minutes, never in the subject line (these respect the marketing opt-out, and each one has a one-click unsubscribe); a password-reset email with a one-time link, sent only when someone asks for one on the app's log-in screen and only if that address has an account; and internal alerts to AcornSmarts with class names, join codes, roster counts and class practice counts, plus each one-time ESA/IEA order (the license, the student's name the parent typed and the payer's email).
- Stripe (payments). Receives the paying adult's email (when no Stripe customer exists yet), our account ID and the plan, plus the card details the adult types on Stripe's own checkout page. No child data, though the plan name "High School" can hint that a household has a teen, with one exception: the one-time ESA/IEA checkout (paid with a state program card) also asks for the student's first and last name, because the program's paperwork needs it.
- ImprovMX (email forwarding for @acornsmarts.com) and Microsoft 365 (the mailbox it forwards to, which also receives our internal alerts). Receive email people send to @acornsmarts.com addresses.
- Google, on the acornsmarts.com website only (never in the app): Google Analytics 4 on 18 website pages (our fonts are self-hosted; no Google Fonts). It is not on the standards reports, the privacy policy page, the founder dashboard, this page or the for-reviewers page. Analytics events carry only an event name, the part of the page, and — where it applies — the skill, plan or checkout clicked, the subject line of an email link, the topic picked on our contact form, or the language of a printed tip sheet; never a name, an email address or a message. Google Analytics also records, as standard, the page address and title, the page a visitor came from, and browser and device details, and it can record its own scroll, outbound-link, site-search, video, file-download and form-interaction events. It sets first-party cookies (_ga) holding a random visitor ID, and Google uses the visitor's IP address to estimate an approximate location (country, region, city); Google says Google Analytics 4 does not log or store IP addresses. The app sets no such cookies.
- Google's public STUN server (stun.l.google.com), used only when two devices connect for two-device play. It sees each device's IP address. No student data.
- Contact form on acornsmarts.com (home page, English and Spanish): the adult's name, email, role, topic and message go to Black Swan Media Solutions' own business system (hosted on Vercel), which emails them to us.
- Browser makers' services, depending on settings and browser (not our vendors): speech recognition for opt-in voice input; online read-aloud voices; and, for signed-in parents who turn on reminders, the browser's push service, which delivers an empty notification.
| Checked 16 Sep 2026 against the app and server code, the deployed server functions and the live sites. |
3 · COPPA position (Children's Online Privacy Protection Act)
Primary path: direct parental relationship. Family accounts are created by the parent, for the parent, and the parent adds each child. The app requests no contact information from a child (a Writing Coach answer can still contain whatever the child types; see §1). Where a state ESA program pays for a family plan, enrollment still runs through the family. When a district uses classes, a student can join on a device with a class code (a first name, grade and avatar, with no account), or a teacher can add first names to a roster. No parent account is involved in those two paths; for them, AcornSmarts relies on the school's authorization, described next.
Where a school authorizes use instead (the FTC's school-authorization pathway), AcornSmarts' standing notice is: (1) it collects the limited child data listed in §1 under the school's authorization; (2) that data is used for the school-authorized educational purpose and no other purpose — no commercial use of any kind; (3) the school may review the information collected and request deletion at any time. The FTC's COPPA guidance for schools describes notice elements for operators that rely on school authorization; district counsel should compare them with this notice.
4 · FERPA position (Family Educational Rights and Privacy Act)
When a district designates AcornSmarts a "school official" under 34 C.F.R. §99.31(a)(1), AcornSmarts acts under the district's direct control for the limited records involved: the teacher controls the class code and roster, the district may review everything the dashboard holds, and the district may end access at any time. The design keeps the FERPA surface deliberately small. The school product never asks for students' full names, addresses or demographic data; the vendor side holds nicknames or first names and practice counts, no assessment answers, and no free-text student work stored server-side. Writing Coach answers pass through our server to Anthropic for scoring and are not stored by us (§1). The DPA template below binds AcornSmarts to use-limitation, non-redisclosure, and deletion-on-request; district counsel can compare these with the district's own requirements.
5 · State law mapping — Kansas and Missouri
| Requirement | What AcornSmarts does (facts for your review) |
|---|
Kansas Student Data Privacy Act, K.S.A. 72-6312 through 72-6320 (2014)
K.S.A. 72-6314 sets rules for disclosing student data. K.S.A. 72-6315 says no school district shall collect biometric data from a student, or use any device or mechanism to assess a student's physiological or emotional state, without written consent (a parent's or guardian's, for a minor). K.S.A. 72-6313(b) defines biometric data; its examples include voiceprints, facial characteristics and handwriting. K.S.A. 72-6318 requires immediate notice of a breach. |
The service providers that receive student data, and what each receives, are listed in §2; Writing Coach answers go to Anthropic for scoring (§1). Handwriting tracing is scored on the device and not stored or sent. The camera reads only an Acorn Card's QR code, with audio off. The app records no audio; opt-in voice answers use the browser's speech recognition (§1). Writing Coach returns a safety label that can mark possible distress, and saves a note for the parent dashboard on that device (§1). Breach-notification commitment: DPA §6. Districts should review Writing Coach with their counsel before students use it; that review may call for parental-consent language. |
Missouri HB 1490 (2014), §161.096 RSMo — Student Data Accessibility, Transparency & Accountability
Requires a public data inventory, FERPA-consistent policies, and privacy/security requirements reflected in vendor contracts; violations by vendors carry civil penalties; Attorney General enforces. |
The §1 data map is our own public list of the student data AcornSmarts handles, checked against the code on 16 Sep 2026. The DPA template below offers contract terms of the kind §161.096 describes: privacy and security safeguards, no sale of student data, and no use of it for advertising. |
6 · Data Privacy Agreement — TEMPLATE for review by district counsel
⚠️ TEMPLATE — for review by district counsel before execution. Provided so procurement has a starting point on day one; AcornSmarts will also review and sign a district's own standard DPA (e.g. an SDPC/NDPA form).
Student Data Privacy Agreement between __________________________ School District ("District") and Black Swan Media Solutions LLC d/b/a AcornSmarts ("Provider").
- Scope of data. Provider receives only the data enumerated in the attached Data Map (§1 of the Privacy Evidence Pack, incorporated by reference): student nickname or first name, grade, avatar, practice-progress counts, and Writing Coach answers sent for scoring and not stored. Provider will not request full names, contact information or demographic data, and will not store free-text student work.
- Use limitation. Student data is used solely to provide the AcornSmarts service to the District and families — never for advertising, marketing, profile-building beyond the educational service, or sale in any form.
- Non-redisclosure. Provider will not disclose student data to any party except the District and its authorized users, the student's family account holders, and the service providers listed in §2 of the Pack, for the purposes described there.
- FERPA. Where the District designates Provider a school official, Provider acts under the District's direct control with respect to student data, and the District may review all data held and direct its deletion.
- Deletion. Provider deletes a student's cloud data upon the family's in-app request or the District's written request, within 30 days.
- Breach notification. Provider notifies the District and affected account holders without unreasonable delay, and in no event later than 72 hours, after confirming a breach of personally identifiable student data. Kansas law asks for faster notice: K.S.A. 72-6318 requires a school district, or a third party given access to student data, to notify each affected student (if an adult) or the student's parent or guardian (if a minor) immediately. District counsel should compare the 72-hour limit with that statute (Kansas districts) and with §161.096 RSMo (Missouri districts).
- Term & survival. Use-limitation, non-redisclosure, and deletion obligations survive termination. When the license ends (by expiration or termination), remaining District-linked class data is deleted within 60 days after the end date, or sooner on the District's written instruction; family-owned accounts remain the family's own.
District: ______________________ Date: ________ Provider: ______________________ Date: ________
7 · Verification appendix — how each claim stays true
- In-app receipt:
privacyReceipt.test.ts fails the build if the family session or reading sync code gains a field the in-app receipt does not list. It does not read this page and does not cover the class-code or Writing Coach paths. §1 of this page was checked against the code by hand on 16 Sep 2026.
- Names: no sync or form has a full-name field. The name box asks for a nickname or first name; the class-code join and the teacher roster ask for a first name.
- Writing text not stored by us: the grading function returns pass or not yet, coaching-line ids and the safety label, and stores no answer text (it logs only the HTTP status). Checked against the deployed function on 16 Sep 2026. Anthropic's retention is described in §1.
- No trackers in the app or on this page: the app's enforced security policy allows connections only to its own site and Supabase, and its 7 runtime libraries include none for analytics or ads (checked 16 Sep 2026). This page loads no analytics and no outside fonts.
- Claims-vs-reality guards: the release gate (tests, accessibility scan and the unison claims guard) runs in
scripts/ship.sh before each deploy; there is no separate CI server. The unison guard checks the public standards reports, and a check in the same gate blocks this page's retired privacy wording from coming back. Those checks catch known wrong wording; they do not prove every sentence matches the code.
Sources checked 22 Aug 2026; Kansas and Missouri statutes and Anthropic's policy pages re-checked 16 Sep 2026:
K.S.A. 72-6312 (ksrevisor.gov; overview via Justia and the Kansas Attorney General) ·
K.S.A. 72-6313 (ksrevisor.gov) ·
K.S.A. 72-6315 (ksrevisor.gov) ·
K.S.A. 72-6318 (ksrevisor.gov) ·
§161.096 RSMo / HB 1490 (revisor.mo.gov; bill text at house.mo.gov) ·
FTC COPPA school-authorization guidance (ftc.gov) ·
FERPA school-official exception, 34 C.F.R. §99.31(a)(1) ·
Anthropic API data retention (privacy.claude.com, dated 1 Jul 2026) and Commercial Terms.