FlashEDU Trust Center

Student privacy, in plain language

Teachers, administrators and parents put students in our hands. This page explains, without legal language, what FlashEDU and FlashClass collect about students, why, who handles it, and how to get it deleted. It summarizes the binding documents — the Student Data Privacy Agreement a district signs, the Education Privacy Policy and the Education Terms, all published in this library. Where this page and those documents differ, the documents control.

Our commitments

1. No ads. No selling data. We never sell personal information, never show advertising to students, and never build advertising profiles.
2. Schools stay in control. The school or district decides who uses the service and directs how its students' records are used. It can export its data and ask for it to be deleted.
3. We collect what teaching needs. A student account a teacher creates needs only a name or identifier — no student email address, home address or phone number.
4. Covered actions leave a record. Sign-ins and administrative actions are written to an audit trail that the database protects from being changed or deleted, and district administrators can review and export their district's history.

How student data is protected

1. Encrypted in transit and at rest. Student data travels between browsers and our servers, and between our application servers and their main databases, over encrypted connections. The storage and the backups that hold it are encrypted, and the most sensitive fields — student passwords, sign-in and single sign-on secrets — carry an additional layer of encryption.
2. Each district's most sensitive records are kept apart. A district-managed student's real name and accommodation details are stored in a separate, district-specific part of the database; elsewhere the system refers to the student by a generated username. If the system cannot confirm which district a request belongs to, it refuses the request rather than guessing.
3. Need-to-know access. A teacher sees their own classes and, unless the district turns this off, can view — but not change — the other classes at the same school. A school administrator sees their own schools — including only those schools' roster imports, stored student passwords and audit events. A district administrator sees the district. These limits are enforced on our servers and in the database, not just hidden on screen.
4. Our staff use multi-factor authentication. FlashMath staff sign in to the FlashEDU Console with multi-factor authentication, and their actions there are written to a tamper-evident log.
5. Deletion runs on a clock. When a district's agreement ends, or when the district asks — for one student or for all of them — student data is deleted or de-identified within 90 days. The clock starts automatically when the agreement ends; it does not wait for someone to remember. For a request a district administrator makes in the district console, it starts when the request is made; for a written request sent to us, it starts when we confirm it.

What we keep after deletion

1. The audit trail. FlashMath keeps a tamper-evident audit trail of sign-ins and administrative actions in FlashEDU and FlashClass. It contains internal account identifiers, sign-in network data such as IP addresses, and the text recorded with each administrative action, which may include a student's name where staff typed one — for example in a stated reason or a note. FlashMath does not remove those identifiers or that text when the corresponding student data is deleted, and the audit trail has no scheduled deletion date; FlashMath uses it only for security, integrity and legal-compliance purposes. A second copy of a district's audit trail, kept with the district's other student data, is de-identified when all of the district's student data is deleted.
2. Backups. Backup copies are encrypted and are not altered when student data is deleted; they expire on their own schedule. Nightly backups kept on the servers that host a district's data are deleted within 16 days, database-log archives there are deleted 14 days after they are copied off-site, and the encrypted off-site copies are deleted once they are more than 90 days old — so every backup copy made before a deletion is gone within 91 days of it. The deletion certificate FlashMath issues when the district's student data is deleted states the dates.
3. Billing records. Invoices and payment records, which do not describe individual students, are kept as accounting law requires.

FERPA and COPPA

FERPA: where student data counts as an education record, FlashMath operates as a "school official" with a legitimate educational interest under the school's direct control. The school should confirm that role, its configuration, and any state or local requirements through its own review.

COPPA: for students under 13, the school may consent on behalf of parents for a limited educational use under FTC guidance. A student under 13 cannot register with an email address and password; the school or teacher creates the student's account. The school remains responsible for confirming that its planned use fits that model and for giving any notices or obtaining any consents its law or policy requires.

What we collect, and what we do not

We collect:

1. A name or identifier chosen by the teacher or school, a username, grade level and class membership.
2. Practice activity: problems attempted, accuracy, speed, progression, assignments and benchmark results.
3. Game results and in-app achievements.
4. For a student who registers with an email address and password (refused under 13), that email address and a date of birth.
5. Accommodation flags a school enters, such as untimed or read-aloud practice.
6. Where a teacher turns it on (and, for a district's students, the district allows it), short chat messages. Only the latest 100 in each chat are kept, and they are deleted one hour after the chat's most recent message.
7. Safety reports and support requests users submit.
8. Technical basics needed to run the service: IP address, browser and device type, and server logs.

The Education Privacy Policy lists every category in full.

We do not collect:

1. Student email addresses, home addresses or phone numbers for teacher-created accounts.
2. Precise location.
3. Advertising identifiers, or data for third-party advertising, analytics or crash-reporting services.
4. Social Security numbers, health or medical records, or biometric identifiers.
5. Anything for sale or rental — personal information is never sold.

How AI features handle student data

1. Coach Flash is a district opt-in. AI coaching for students is off by default for any district whose account was created on or after September 25, 2026. A district created earlier keeps the setting it had, and can turn Coach Flash off at any time.
2. Tools for educators have their own switch. AI tools for teachers and administrators — reports, class digests, data questions, practice-problem generation, attention explanations, parent summaries, roster mapping and the staff voice assistant — follow their own district setting, which the district's administrators control and which is off by default for any district whose account is created on or after the effective date shown on this page; a district created earlier keeps the state its educator tools were already in. Turning Coach Flash on or off does not change them. For a teacher using FlashClass without a district, these tools are covered by the FlashClass Teacher Agreement the teacher accepts.
3. What is sent. Depending on the tool, an AI provider can receive student names or usernames, school and class names, teacher names and practice results. Roster mapping sends only the file's column headings and a small sample of values with sensitive fields removed. The staff voice assistant sends the speaker's audio straight from the browser to the provider; we do not record it.
4. No training. We do not permit AI providers to train their general-purpose models on student data, and we do not keep the text of Coach Flash conversations.

Who processes student data for us

These are the companies that receive student data in the normal operation of FlashEDU and FlashClass, what they do for us, and what they receive:

A student's problem report stays with the student's teacher or school and never reaches our support staff. Requests from teachers and administrators go to our support tracker, which LanIT IT Services hosts (see the table above), and refer to a student only by an anonymous account identifier. Encrypted off-site copies of our database logs are held by an object-storage provider named in the Subprocessor and Security Overview; they are encrypted before they leave our servers. The overview, available from education@flashmath.io, is the complete list. We give districts at least 30 days' notice before adding a company that would process student data.

Independent assurance status

1. Student Data Privacy Consortium National Data Privacy Agreement — not published. Our DPA follows the NDPA's structure, but we do not represent an executed national or state NDPA here. Ask for the current contracting path for your state.
2. SOC 2 — no report published. No completed SOC 2 report is available. Request current security evidence directly.
3. Accessibility Conformance Report (VPAT) — not published. No current ACR or VPAT is available. Schools should test the student and staff workflows they plan to use and ask for the current accessibility status.

What a district can request

A serious review needs more than this summary. Send the requirements your privacy, security, curriculum, accessibility and procurement teams use, and we will say which documents are available now, which items need a written response, and which evidence is not yet available. Typical requests:

1. The current data fields and the Subprocessor and Security Overview.
2. The retention, export and deletion workflow.
3. A walkthrough of rostering, single sign-on, roles and policy controls.
4. A security and incident-response questionnaire.
5. An accessibility workflow review.
6. A state standards crosswalk.

To start a review, use the request form at edu.flashmath.io/buy or write to education@flashmath.io.

Accessibility is a workflow review

FlashEDU should not be treated as broadly accessible because a web page says so. Ask for the current testing status, known limitations, keyboard and screen-reader behavior, and the exact student and staff workflows your district plans to use, and include assistive-technology users and staff who understand local accommodations in the evaluation.

Deletion requests and questions

A district can ask for its students' data to be deleted at any time. It can export that data while its service is active and, after its agreement ends, until the deletion begins. A request to delete the whole district ends the service, and export with it, as soon as we confirm it, so export first. Parents should start with their child's school, which controls the account; if a parent writes to us directly, we pass the request to the school. Write to education@flashmath.io with the subject line "Data request". Security researchers can report vulnerabilities to the same address.