Effective Date: October 13, 2026 · Last reviewed: October 13, 2026
Potato Class is operated by Growing Standard LLC (“we,” “our,” or “us”). We are committed to protecting the privacy of children and all users of our educational math and reading application. This policy describes what information we collect, how we use it, and the choices available to parents, guardians, and school administrators.
Users may sign in with Google or Apple to enable cloud sync and classroom features. When signed in, we receive only the name and email address provided by the sign-in service. A rostered student who signs in with a class code, a printed badge card, or a secret number has no email on that path at all.
Using the app without signing in (guest use). A guest’s profile and progress are stored on the device (browser localStorage on the web, the app’s private storage on iPad) and are not synced to our database. Guest use is not the same as nothing leaving the device. On the web, the app creates an anonymous account with our sign-in provider (Google Firebase): a random identifier with no name and no email address, so our servers can tell one browser from another and limit misuse. That anonymous account is not automatically deleted today. On iPad, an anonymous account is created only for the moment needed to send a problem report or to open the class-code door, and is signed out afterwards. On either platform, three things can leave a guest’s device: (1) requests to our server for pre-rendered audio. A request for a greeting carries the display name typed for the potato (a student’s name only when it is a single word; the name as typed for a guest who chooses the parent or teacher role), and when that name is not already in our audio cache our server sends it once to OpenAI to make the clip (see “Voice narration” below); (2) error and crash reports with personal information stripped (see “Sentry” and “Crash diagnostics” below); and (3) a problem report, if the user chooses to send one.
We collect information about a student’s learning activity, including grade level, math skills practiced, questions answered, accuracy rates, stars earned, and assessment results. Math assessment data includes per-domain proficiency across four grade-appropriate math domains, math placement level (grade equivalent), per-domain grade-level placement, assessment response times (for rush detection), testing window history, and reliability metrics. Reading assessment data includes reading level (across Fountas & Pinnell, Lexile, DRA, and Grade Equivalent systems), per-skill reading proficiency across 16 skill areas, assessment response times, and testing window history. For signed-in users, this data is synced to our cloud database (Google Firebase Firestore) to enable cross-device access and classroom features. On the iPad app, a copy of the signed-in profile’s progress data is also stored on the device itself so that practice can continue when the device is offline (see “On-Device Storage and Offline Use” below). For guests, this data is stored only on the device.
For a student whose school holds a license, we also record each session of use: what kind of activity it was (practice, library, games, lessons, an assessment, a class test, or time spent customizing the potato), when it started and ended, the skill, book, or game involved, the class, and, for up to 200 questions in the session, whether each answer was right or wrong and how long it took. We use it for usage reporting to the school and in the pre-registered research on how much practice helps. These records are not written for guests or for accounts without a school license.
Any user, including a guest, can report a problem with a question. A report contains the question as it was shown, the answer that was entered, an optional typed note (up to 1,000 characters), the browser or device type and screen size, the app version, what the potato was wearing and the scene it was in, for a sound problem a list of the lines recently spoken, and the account and profile identifiers of the sender (for a guest, the anonymous identifier). We use reports only to find and fix faulty questions.
Besides answers to questions and the note on a problem report, a student can type or draw in these places, and what they enter is stored with us for signed-in accounts: sticky notes and pen drawings made with the toolbox, and highlights and notes in a book (kept with the student’s profile); a short written reflection in a group activity a teacher runs (seen by the student’s group and the teacher); and a question a student writes in the “make your own question” activity (stored with the student’s display name for the teacher).
Where a teacher uses them, we store the results of short screening and fluency checks: a dyslexia-risk screener (which produces risk bands for phonological skill and naming speed), oral reading fluency records, a phonological profile, and timed math and writing checks. These results are visible to the student’s teacher. We also store a student’s answers to a short survey about attitudes to learning (ratings from 1 to 5) and a score computed from them.
The app shows students in the same class each other’s display name, grade, star count, and potato character. In a group activity, the members of a group see each other’s responses.
We collect information about a student’s reading activity, including current book selection, library browsing history, and reading tool annotations (highlights and notes). For signed-in users, this data is synced to the cloud. For guests, it remains on the device only.
Users create a display name (max 20 characters), select a US state, and customize a potato character. Multiple profiles can be created under a single sign-in for family use, each with their own progress and character. Optional 4-digit PINs protect individual profiles; a profile PIN is stored only as a SHA-256 hash, kept with the profile. For signed-in users, this data (including the PIN hash) is synced to the cloud. For guests, it remains on the device only.
Users may select from 11 supported languages (English, Spanish, Chinese, Arabic, Vietnamese, Ukrainian, Portuguese, French, Hindi, Korean, Japanese). This preference is stored per profile to personalize the interface and voice-assistant language.
We do not collect precise geolocation, photos, contacts, browsing history, device identifiers for advertising, or biometric information. We do not use cookies or tracking pixels. We do not allow third-party advertising. The display-name field and typed-answer fields include automatic on-device filtering to prevent entry of email addresses, phone numbers, and other personally identifiable information; the other places a student can type (notes, reflections, a written question, a problem-report note) are not filtered. The camera is used only to scan the QR code on a class sign-in card; no photo or video is stored or sent.
Reading assessment data is collected up to three times per school year during designated testing windows (Fall, Winter, Spring). This data includes:
Teachers in classrooms can view their students’ reading assessment results, including rush detection indicators, and may initiate retakes of specific skill areas where rushing was detected. Reading tool annotations (highlights, notes) are stored per-profile and per-book, and are not shared externally.
Math assessment data is collected up to three times per school year during designated testing windows (Fall, Winter, Spring). This data includes:
Teachers in classrooms can view their students’ math assessment results, including per-domain proficiency levels and rush detection indicators.
When a student completes a math or reading assessment, a research record is stored in our database for the purpose of building empirical percentile norms. This record contains enrolled grade level, assessed level, per-domain scores, whether rushing was detected, and, for each item, the answer selected, whether it was correct, the response time, the question text or passage identifier, a label for the kind of mistake a wrong answer suggests, and a theoretical (heuristic, not yet empirically calibrated) difficulty estimate, together with a pilot-group label.
This data contains no student names and no email addresses. Each record carries an opaque, account-linked student identifier that is meaningless outside our systems; it exists for exactly two purposes: so that a parent’s, school’s, or district’s deletion request reaches these records too, and for the pre-registered research analyses described in our research documentation. The data is used solely to improve the accuracy of percentile rankings and assessment quality over time. The Firestore security rule on this collection permits reads only by Growing Standard’s platform administrators — no student, teacher, parent, or unauthenticated visitor can retrieve raw records. Records are tombstoned to a non-identifying stub after 3 years (see “Data Retention and Deletion”).
Potato Class is free for students and families at its free floor. The school product has no in-app purchases, no subscription prompts, and no advertising: a student on a school-rostered account, and any child profile, never sees a subscribe button or any payment surface. No payment information of any kind (credit card, bank account, Apple Pay, Google Pay) is ever collected, processed, or accessible to us from a school-managed student device.
Schools and districts that choose to unlock premium classroom features (teacher dashboards, the digital library, teacher-led lessons, the Grow adaptive assessment, multiplayer games) purchase per-student annual licenses from Growing Standard LLC. These institutional purchases are arranged outside the student application: by purchase order or ACH bank transfer through direct invoicing, or, for a renewal or added seats, by a school administrator paying by card or ACH on a Stripe-hosted checkout page opened from the school’s administrator portal. Card and bank details are entered with and held by Stripe; none are collected, processed, or stored by Growing Standard in connection with these licenses.
For families and individual teachers on personal (non-school) accounts, optional Family Plus and Teacher Plus subscriptions are available. Checkout and billing for these are handled entirely by Stripe on Stripe-hosted pages: payment details are entered with and held by Stripe, never by Growing Standard. Our systems store the subscription’s status and dates, whether a free trial has been used, and a record of the payment notices Stripe sends us — no card numbers, bank details, or other payment instruments are ever collected, processed, or stored by us. So that a payment can be matched to the right account, Stripe receives our internal identifiers for the account and for the profile that made the purchase; no name, answer, or learning record of any student is shared with Stripe.
Potato Class does not use runtime LLM or generative-AI services to produce student content. Every math question, reading passage, hint, explanation, and AiPa line a student sees is served from fixed content and deterministic in-code generators that ship with the app bundle — no model runs while students work. That content and code were created with AI tools before release, under the direction and review of Growing Standard’s founder, a licensed classroom teacher; illustrations and background music likewise include AI-generated assets bundled as static files.
Voice narration (AiPa). The “AiPa” assistant character can speak its pre-authored lines using either the device’s built-in text-to-speech engine (Web Speech API on web, AVSpeechSynthesizer on iOS) or, for higher-quality narration, audio synthesized via OpenAI’s text-to-speech API and served from our server-side cache. When the OpenAI path is used, only the pre-scripted instructional phrase (e.g. “Which number is greater, 5 or 3?”) is sent for audio synthesis — never a student’s answers, performance data, or any free-form input. A greeting phrase may include a student’s first name or a signed-in adult account-holder’s (teacher or parent) display name; a student’s surname is never synthesized. Common first names are pre-rendered into the cache; any other greeting name is sent to OpenAI once, on first encounter, with no account identifier attached, and is then served from cache thereafter. For a student, the app sends a name only when it is a single word; a student’s display name of more than one word is not sent, and the greeting is spoken without a name. This applies to a guest’s typed name as well as a signed-in user’s; a guest who chooses the parent or teacher role is treated as an adult account-holder for this purpose. Synthesized audio is cached server-side on Cloudflare R2 by content hash, so phrases are served from cache rather than re-synthesized.
We use Firebase Authentication for sign-in (Google, Apple, the class sign-in cards and class codes described in this policy, and the anonymous account described under “Using the app without signing in”) and Firestore for cloud data storage. Firebase is certified under SOC 1, SOC 2, and SOC 3. All student data is stored in Firestore’s United States region (us-central1, Iowa); no data leaves the United States. Data is encrypted in transit (TLS 1.3) and at rest (AES-256-GCM with Google-managed keys).
We use Cloudflare Workers as our backend edge: the server for roster import and class sign-in cards, the serving layer for our pre-rendered text-to-speech audio cache (Cloudflare R2), the sender of the emails described under “Resend” below, and the hand-off to Stripe-hosted checkout for the consumer subscriptions and school license payments described above. Besides the book artwork our library uses, three kinds of content are stored at Cloudflare (in R2): the audio cache, which includes greeting clips of first names; crash diagnostics from the iPad app (see below); and quote requests sent from the Growing Standard website, which hold what the requester typed (organization, name, role, email address, and the details of the request) together with the sender’s network address and browser type. Cloudflare also keeps operational logs of requests to our server, which we use to diagnose faults. Student records are stored in Firebase, not at Cloudflare.
The web app is hosted on Vercel for static file serving and CDN. Vercel serves the application’s files. By default it also relays some requests to our own server or to our sign-in provider: requests for audio (including a greeting name, as described under “Voice narration”), the quote form, an administrator’s request for access (which carries that adult’s email address), a service-status check, and the sign-in hand-off. The Potato Class app uses no analytics, tracking, or advertising services on either platform. Our public information pages (the Growing Standard website and the privacy, terms, support, security, and school-notice pages) count page views in aggregate with Vercel Web Analytics, which sets no cookies, follows no individual, and keeps no identifier longer than 24 hours. Each view records the page address (never its query string), the referring site, browser, operating system, device type, and an approximate city-level location derived from the connection. It never runs in the student app and never receives student data.
We use Sentry to capture error reports from the web app and from our server code (the Cloudflare Worker) so we can fix bugs that affect students. Sentry is hosted in the United States (Sentry’s US region). Before an error report leaves a student’s device, an on-device privacy filter rebuilds it from a short list of permitted fields. It replaces email addresses, phone numbers, Social Security numbers, street addresses, long runs of digits, record identifiers, anything in double quotation marks, and any other quoted text of more than one word, inside the error message with placeholders, and it leaves out user identity (email, username, IP address), request cookies, the address of the page that linked to ours, and console output. The filter works by pattern: it cannot recognize a name that stands alone, or as a single quoted word, inside an error message. We do not enable Sentry Session Replay or Session Tracking. An error report contains the stack trace, the error message, browser/OS metadata, the URL path of the page where the error occurred (never its query string or fragment), and a short trail of recent activity: how the page was loaded, page paths, the kind of control that was clicked (never its label), the method, host and status of outbound requests (with the path, for requests to our own site), and the reference number of an earlier error report from the same visit. We do not attach student responses, names, or assessment data to it. The browser and our server send error reports only, no performance timings. Before our server sends a report, it removes the request’s contents, headers, cookies and query string, and replaces identifiers and email addresses in the error text. Error reports are sent with Sentry’s collection of personal data turned off and may carry the identifier of the school or district the account belongs to.
The iPad app does not use Sentry. When the app crashes or hangs, it sends Apple’s diagnostic report (call-stack data, app version, operating-system version, and device model) to our own server, where it is stored at Cloudflare. The report carries no profile, account, or answer data, and it is sent whether or not anyone is signed in.
OpenAI’s text-to-speech service makes the voice audio described under “Voice narration” above. Our server, never the student’s device, makes the request. While students use the app, the only text sent to OpenAI is a greeting name that is not already in our audio cache: a student’s first name (never a surname) or a signed-in adult account-holder’s display name, sent once, with no account identifier attached.
We send email through Resend, an email delivery service. Resend receives the recipient’s email address and the content of each message. The messages are: the confirmation a parent receives after giving consent for a child, which states the child’s name as the parent entered it, the parent’s relationship to the child, the date, and the consent text, and is sent to the parent’s sign-in email address; a welcome message to a new adult account-holder; invitations to teachers and school administrators; the signed copy of a school’s agreement; license and billing notices to schools and subscribers; and the notices we ourselves receive when a school requests a quote or an administrator requests access. We do not email students.
Stripe hosts the checkout pages and holds the payment details for the purchases described under “Payment Information” above. Stripe receives the paying adult’s or school’s billing details. No student data is shared with Stripe.
When a teacher chooses to import students from a Google Classroom class they teach, Google asks the teacher to allow Potato Class to see three things, read-only: the list of their Google Classroom classes, the students in the class they pick, and those students’ school email addresses. We use this information for one purpose only: to add those students to the teacher’s Potato Class class, so each student’s work reaches the right teacher. The email address lets a student who signs in with their school Google account be matched to that class.
Potato Class’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google APIs is not used to develop, improve, or train generalized artificial intelligence or machine-learning models.
We do not sell, rent, or share personal information with any third party for marketing, advertising, or profiling purposes.
Potato Class is designed for children in grades K through high school. This section is our Online Notice under the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§6501–6506 and 16 C.F.R. Part 312, §312.4(d)) and supplements the Direct Notice we deliver to a parent at the time we ask for consent (see “Parental Consent for Children Under 13” below).
The operator collecting and maintaining information from children through Potato Class is Growing Standard LLC, PO Box 10882, West McLean, VA 22103, United States; telephone (703) 679-7398. The single point of contact for all COPPA-related questions, consent revocation, and requests to review or delete a child’s information is privacy@potatoclass.com.
The categories of personal information we collect from a child are limited to what is necessary to deliver the educational service. They are: the child’s first name or chosen display name; US state of residence; grade level; preferred language; educational progress data (math and reading skills practiced, questions answered, accuracy, stars earned, assessment results, response times); profile customization choices (potato character appearance, starter item); and reading activity data (book selections, highlights, notes). For a child a school or teacher enrolls, we also hold what the school or teacher provides for the class roster: the child’s first name and last initial when a teacher types the roster, or the child’s full name, grade, school student ID, and school email address when a school imports its roster; and the child’s class sign-in card (a code and a 6-digit secret number). We do not collect precise geolocation, photos, contacts, audio recordings of the child’s voice, device identifiers used for advertising, or biometric information from children.
Information collected from a child is used only to provide the educational service: to personalize the experience, track learning progress aligned with state standards, compute placement and growth metrics, sync progress across devices the child’s parent has authorized, and surface progress reports to the parent or to teachers in a school context. We do not use information collected from children for behavioral advertising or profiling, we do not allow third-party advertising in the application, we do not sell or rent information about children, and we do not use information collected from children to train AI models. The third-party service providers that process child information on our behalf are described in the “Third-Party Services” section above. They are: Google Firebase (sign-in and encrypted cloud storage); Cloudflare (our server edge and audio cache); Vercel (web hosting); Sentry (error monitoring with personal information stripped); OpenAI (text-to-speech for a greeting first name that is not already in our audio cache); and Resend (delivery of the email that confirms a parent’s consent, which contains the child’s name).
Children under 13 cannot sign in to Potato Class directly. Apple Family Sharing and Google Family Link both block third-party-app sign-in for child accounts, and COPPA prohibits us from collecting information from a child under 13 without verifiable parental consent regardless of the platform. To use Potato Class at home, a parent or legal guardian creates a personal Potato Class account, then creates a child profile inside that account. Before any information is collected from the child, we present the parent with a Direct Notice (16 C.F.R. §312.4(c)) describing what we collect, how we use it, and the parent’s rights, and we obtain the parent’s express affirmative consent. The Direct Notice is presented in-app during the “Add child” flow.
Method of verifiable parental consent. We rely on a combination of (a) the parent’s verified online contact information obtained at sign-in through an OAuth provider (Apple or Google), and (b) an in-app affirmative-attestation step in which the parent reviews the Direct Notice, confirms their relationship to the child as parent or legal guardian, and affirms consent. The attestation is recorded to an append-only audit log that captures the parent’s account email, the child’s name as the parent entered it, the parent’s stated relationship to the child, the text and version of the notice shown, a timestamp, the device’s browser or platform information, and, where it can be obtained, a one-way hash of the device’s network address (only the hash is stored, never the address itself). On the iPad app, the network address is obtained by asking a public address-lookup service (ipify), which receives the device’s network address and standard request information, and nothing from us; on the web, our site’s security policy blocks that lookup, so the web app records the address as unavailable. The same applies when a teacher accepts the teacher agreement. We then email the parent a confirmation of the consent (see “Resend” above). This combined method is consistent with the “email plus” method described in 16 C.F.R. §312.5(b)(2)(ii). A parent who later believes the consent was provided by someone other than the actual parent or legal guardian can contact us at privacy@potatoclass.com and we will delete the affected child profile and all associated information.
Where a child uses Potato Class through their school, the school may consent on behalf of the parent for the educational purposes described above, as permitted under COPPA and the FTC’s school-authorization guidance. That consent is given either by the school or district under a signed Student Data Privacy Agreement, or by the teacher who creates the class, who confirms before adding any student that they act for their school and either hold the parent’s consent or are consenting on the parent’s behalf for educational purposes only. A teacher who adds students by name enters only a first name and last initial, never a student email address. Our notice to schools and teachers describes what we collect from a student a school or teacher enrolls. The school or teacher remains responsible for notifying parents of the use of Potato Class and for removing a student whose parent withdraws consent. We will enter into a Student Data Privacy Agreement with the school or district upon request.
A parent who has consented to the collection of information from their child may at any time:
We do not condition a child’s participation in the educational service on disclosure of more information than is reasonably necessary for that activity.
Potato Class supports two account modes: school mode, in which a student signs in through a school-domain Google or Apple account — or with a class code, a printed badge card, or a secret number — and is associated with a teacher’s classroom; and family mode, in which a parent signs in with a personal Apple or Google account and manages one or more child profiles inside their account.
Profile limits. A school-mode student account holds exactly one profile (the student’s) and a school-mode teacher account holds exactly one profile (the teacher’s). A family-mode parent account holds up to eight child profiles by default, with a hard limit of twelve; parents who need additional profiles for legitimate reasons (e.g., a guardian for several children) can contact us at privacy@potatoclass.com.
Second adults in a family. Family mode uses a single parent-managed account: the parent who created the family owns it, holds the COPPA consent for each child, and is responsible for any other adult they allow to help manage it. Only that owner may transfer ownership of the family or delete the family entirely. (Families created under an earlier version of the app could add a second signed-in co-parent account; those legacy families retain their existing members, and the owner may remove a co-parent or transfer ownership at any time.)
Data scope of each profile. Each profile’s data is associated with that profile only. A parent who has consented for one child has not thereby consented for any other child — the consent record we keep names the specific child profile. When a profile is deleted, the data associated with that profile is deleted on the timelines described in “Data Retention and Deletion” below; other profiles in the same family are unaffected.
The iPad app is designed to keep working when the device loses its internet connection — for example, on a road trip or a flight. To support this:
On-device data is protected by the operating system’s built-in encryption and by iOS app sandboxing — other apps cannot read it. Deleting the app from the device removes all of its on-device data. The web app is designed for online use and has no offline mode.
In the event of a confirmed unauthorized access to student data:
We maintain an incident-response runbook and log relevant access events in an append-only audit collection. Security researchers may report vulnerabilities at potatoclass.com/security or via security@growingstandard.com.
Potato Class targets WCAG 2.1 Level AA conformance and ships teacher-togglable accommodations: read-aloud text-to-speech, a printed phonemic-awareness variant for deaf and hard-of-hearing students (grades K–1), and a multilingual-learner glossary language. Accommodation preferences are set by the teacher per student; Potato Class does not import or store a student’s IEP or 504 status. Adaptive assessments are untimed to match iReady and NWEA MAP Growth standards. A Voluntary Product Accessibility Template (VPAT 2.4) is available on request for district procurement review. Full accessibility statement: growingstandard.com/accessibility. Accessibility feedback: partnerships@growingstandard.com with subject “Accessibility:”.
Potato Class is built to meet the data privacy standards required by schools, districts, and families. Here is how our practices meet each of the following:
For data privacy agreements, compliance documentation, or district onboarding, contact privacy@potatoclass.com.
Self-service deletion: Users can delete all their progress data directly from the app at any time via Settings → Data → “Delete All Progress Data.” This removes all progress, stars, accessories, and assessment data from the active account on both the device and cloud storage (if signed in). Deleted data is retained in a recovery state for 30 days, during which users can restore their progress via Settings → Data → “Restore Progress.” After the 30 days, the saved profile is permanently and irreversibly deleted at the next monthly retention run, so between 30 and about 61 days after the deletion. Deleting also files a deletion request with us for the records kept outside the profile (research records, usage sessions, class records); those are removed when we carry out that request, which we do by hand after the restore window ends.
Retention windows. Our retention posture is designed to match the baseline schools expect from peer screening tools (iReady, MAP Growth, Star, DIBELS):
A full collection-by-collection table is maintained in our internal Data Retention Policy and is available to districts on request as part of the DPA process. Retention sweeps run monthly and produce an auditable per-collection report.
Backups and deletion requests. We operate three independent backup lanes for disaster recovery: Firestore Point-in-Time Recovery (7-day window), Firebase-managed daily snapshots (14-day retention), and a project-isolated daily export to a separately-owned Google Cloud Storage destination (30-day retention with a bucket-level retention lock). When a parent or school requests deletion of a student’s data, we remove the data from production within the timelines above. Backups taken before the deletion request retain a snapshot of the data for the duration of each lane’s retention window—up to 30 days—and then age out automatically. Backups taken after the deletion request reflect the post-deletion state. We do not restore deleted data from a backup absent a specific written request. The 30-day retention lock on the project-isolated lane is a load-bearing security control: it prevents an attacker who gains administrative credentials from destroying our recovery surface, but it also means we cannot expedite removal from that lane below 30 days. All backup copies of deleted data age out within 30 days after the deletion from production is complete.
Parent data access (self-serve). When a student has an active school or district license, a signed-in parent or guardian can visit Settings → Data in the app to (a) review the categories of data we store for each of their children’s profiles, (b) queue a machine-readable export request, or (c) queue a deletion request. Verified requests are fulfilled within 30 days and the fulfillment is logged. Parents without an active school or district license can make the same requests by contacting privacy@potatoclass.com.
Signed-in users: Educational progress data (math progress, math assessment history, reading levels, reading assessment history, and reading tool annotations) is retained under the windows above while the account is active. Users or parents may also request deletion of all personal data by contacting us directly. Verified deletion requests are fulfilled within 30 days. Schools may request bulk deletion when students leave the district or when use of Potato Class ends.
School-managed accounts: Students whose accounts are provisioned through a school or district roster cannot self-delete their data while their school enrollment is active. Data deletion for these students is managed by the school administrator or teacher. This ensures district data integrity and compliance with school data-governance policies. After the school enrollment ends, standard self-service deletion is available.
Guest users (no sign-in): Profile and progress data is stored on the device and can be cleared by the user at any time by clearing browser data, deleting the iPad app, or using the in-app delete option. We hold no profile or progress data for a guest. What our systems may hold from a guest session is described under “Using the app without signing in” above: the anonymous account identifier, a cached greeting clip of a first name, sanitized error or crash reports, and any problem report the guest chose to send. To have a problem report deleted, contact us.
When a teacher, school administrator, district administrator, parent, or platform administrator opens a screen of the app that shows an identifiable student record, the app records the read to an append-only audit log with the reader’s role, the category of data viewed, the affected student ID, and a timestamp. Opening a whole class list is recorded once against the class, not once for each student, and repeated identical reads are recorded once. The record is written by the app as the screen opens; the screens where students in a group see each other’s work are not yet recorded. Entries generated while a device is offline are queued on the device and written to the audit collection when connectivity returns, recording both the time of the underlying event and the time of the write. These logs are retained for 3 years and are readable only by platform administrators. They are intended to make the data-access history auditable in line with FERPA §99.32 recordkeeping expectations. Access logs contain no assessment scores, response data, or free-text fields.
For students using Potato Class through a school, the school acts as the parent’s agent for consenting to data collection under COPPA. Parents retain their FERPA rights: to inspect and review their child’s education records and to ask for a correction. A parent may also ask us to delete their child’s data (see “Parental consent for children under 13” and your school’s agreement with us). Contact your child’s school or contact us directly to exercise these rights.
We may update this policy from time to time. Changes will be posted in the app and at potatoclass.com/privacy. Material changes to how we handle children’s data will include prominent notice and any required consent.
If you have questions about this policy or wish to exercise your data rights, contact:
Growing Standard LLC
PO Box 10882, West McLean, VA 22103, United States
Telephone: (703) 679-7398
Email: privacy@potatoclass.com
Website: potatoclass.com