KiteQuad
Sign in

For school administrators

COPPA school notice

Draft — not yet in effect

Draft — under review. This page describes how KiteQuad is built today and is being reviewed by counsel. It isn't a binding policy yet, and the wording may change before launch.

The short version

  • KiteQuad starts every teacher in anonymous mode: nicknames and avatars, no real names and no email.
  • It's built so a school, not an individual teacher, decides when any real student data is collected.
  • Apps run in a sandbox with network access blocked, and the other ways an app might try to send work out are detected and reported.
  • You get a written data agreement, data kept in the United States, and certified deletion when you ask.

Why this notice exists

The Children's Online Privacy Protection Act (COPPA) governs collecting personal information from children under 13 online. The FTC's guidance is that a school or district — not an individual teacher — may stand in for parents in giving consent, and only for educational use. KiteQuad is built around that.

Anonymous mode, by default

Every teacher starts in anonymous mode. In anonymous mode KiteQuad does not collect personal information from students:

  • A student is a nickname and an avatar, chosen or generated by the teacher. No real name and no email address are stored, and the system refuses to save a real name in an anonymous class.
  • Students sign in with a class code and a PIN or picture password, or a QR badge — not a personal email or account.
  • What a student app saves stays inside KiteQuad, under a nickname, and is deleted 30 days after the last change.
  • Each app sees a different per-app identifier for the same student, so a student can't be tracked across apps.

We believe anonymous mode operates within COPPA's "support for the internal operations" of the service and does not require verifiable parental consent. This is the point we are confirming with counsel before launch.

When a school wants more

Real student names, rostered email addresses and saved work submissions are part of authorized mode, which a school's administrator turns on under a written data agreement. In that agreement the school directs KiteQuad as a school official with a legitimate educational interest (FERPA, 34 CFR 99.31), and KiteQuad agrees not to redisclose student data or use it for its own purposes. Authorized mode arrives in a later release; until a school turns it on, no real student data is collected.

How student data is protected

  • No third parties in the student's way. No analytics, no advertising, and no third-party scripts or fonts on any page a student sees.
  • No AI training. Neither KiteQuad nor any vendor trains AI on student data.
  • Sandboxed apps. A published app runs on a separate domain with network access blocked; other ways an app might try to send data out are detected and reported to the teacher.
  • US storage. The database and files are created in Cloudflare's United States jurisdiction; nothing personal is kept in a globally replicated store.
  • Deletion on request, with a certificate of what was removed.

What a school gets

A data privacy agreement (DPA), the subprocessor list, the security overview, this notice, our breach-notification commitments on the trust center, and completed vendor-risk answers you can download there. To request the DPA or ask a question, write to support@kitequad.com.