For schools and districts

Student Privacy & Security

Last reviewed October 21, 2026

Bookroo Classroom is a reading program for K-12 classes. The school owns and controls its students' data, and we use it only to provide Bookroo to the school. Under FERPA we act as a school official. Under COPPA, students under 13 use Bookroo only through a class their teacher creates, with the school's consent.

Our commitments

We never sell student data
Not to anyone, for any price.
No third-party marketing
Student data is never shared for marketing, and we never market to students or their families.
No ads for students
Students never see ads on Bookroo, targeted or otherwise: ads never load on the pages students use for class, or on any page while a student is signed in.
No third-party tracking
Analytics and advertising tags never load on the pages where students sign in or work, or on any page while a student is signed in.
No tracking across apps or sites
We don't follow students to other websites or apps, and we don't let anyone else do it through Bookroo.
No commercial profiling
Reading data is used only to run Bookroo for the class. Book recommendations are part of the reading program, not advertising.

Student data we collect

Category	What
Name	First name and last name or initial, as the teacher or roster provides it
Sign-in	Class code, a short class passcode, a roster ID from Clever or Google, and a one-way hash of the school email (never the email itself)
Enrollment	Class, grade level, teacher and school
Reading	Books read, pages, minutes, dates, reading level and teacher notes
Quizzes	Answers, scores, points, badges and challenge progress
Student writing	Quiz questions and reviews a student chooses to write about a book
Level Check	Answers, timing and the reading level it gives, Star Reading scores a teacher enters, and, only if the teacher chooses to, which students get extended time (for example under an IEP or 504 plan)
Reading survey	Answers to the reading motivation check a teacher opens, and the reader type it gives
Technical	IP address, browser and device type, and error reports keyed to a numeric ID

We don't collect a student's email address, home address, phone number, date of birth, photos, voice, location, or demographic, health, discipline or attendance information. The only disability-related information is the Level Check extended-time list above, which a teacher adds only if they want to.

A class's sign-in page lists its students by first name and last initial so they can pick themselves. It opens with the class link, the class code or the teacher's email, and each student then enters their own passcode.

Who receives student data

Only these service providers, and only what they need to run Bookroo. We share student data with no one else unless the school directs us to or the law requires it.

Provider	What it does	What it receives
DigitalOcean	Application servers and database	All student data, encrypted in transit and at rest
Amazon Web Services	Database backups	Encrypted copies of the database
Vercel	Website hosting, and Marian's conversations and AI Gateway	Page requests, including names shown on screen. Marian conversations and her reads of reading motivation checks, with students as numeric IDs
Anthropic	Marian's AI model, through Vercel's AI Gateway	Marian conversations and her reads of reading motivation checks, with students as numeric IDs, under zero data retention
Cloudflare	Network security and audio storage	Requests passing through, and audio of quiz questions
AppSignal	Server error monitoring	Numeric IDs and request details, with passwords, passcodes, tokens and emails filtered out
Sentry	Website error reporting	Numeric IDs and error details
Clever	Rostering and sign-in, when the school uses it	Sign-in requests; we receive the roster from Clever
Google	Google Classroom rostering and sign-in, when the school uses it	Sign-in requests; we receive the roster from Google

Stripe (payments), Loops (email) and Zendesk (support) receive teacher information only, never student data.

Marian, the teacher assistant

Marian is an AI assistant for teachers and school administrators. Students never talk to her.
Student personal data is anonymized. Marian never sees a student's name, passcode or email, and her answers show names only on the teacher's own screen.
On a school's dashboard, only administrators can ask her, and she sees classes and grades, never students. A student's name an administrator types there is not anonymized, in her answer or in our log.
She sees only what the teacher can already see in Bookroo, and never anything a student writes, such as a book review or a note on a reward.
Her AI model is Anthropic's Claude, under zero data retention: the model provider keeps nothing once it answers.
We keep a log of Marian's conversations in our own database, with students anonymized, so we can check and improve her answers.
Marian can't browse the web or reach any other service.

How long we keep it

A teacher removes a student	The seat is deleted at once; the student's remaining records go in our weekly cleanup, unless they're in another class
A teacher deletes a class	The teacher can restore it for 30 days. Then the class and its students' records are permanently deleted
A class goes unused for 12 months	We email the teacher. If it's still unused 30 days later, the class is deleted as above
A school asks us to delete its data	Deleted within 30 days of a written request to schools@bookroo.com
Database backups	Encrypted nightly copies are kept 30 days, then deleted. We never restore one without first re-applying deletions made since it was taken
A Marian conversation	Vercel holds it while it's open, at most 12 hours, and deletes it within 96 days after it ends. We clear the words from our own log after 90 days, keeping only Marian's note of any request she couldn't help with, and delete the log with its class

Teachers can view, edit and delete their students' data at any time. Parents who want to review or delete a student's data should contact the school, and we'll help the school respond.

Security

Every connection is encrypted with TLS, including the one to our database.
Sign-in cookies are sent only over HTTPS and carry an ID, never a student's name.
Student sign-ins and passcode guesses are rate limited, per student and per class.
Teacher passwords are hashed with Argon2, and database backups are encrypted.
Staff access to student data is limited to those who need it, and every staff sign-in as another user is logged.
If student data is ever breached, we notify the affected schools within 72 hours.

Agreements and documents

We've signed student data privacy agreements with districts in Arkansas, California, Illinois, Kentucky, Massachusetts, Ohio, and Utah.

In California, Illinois, Massachusetts, Ohio, and Utah, that's the Student Data Privacy Consortium's National Data Privacy Agreement, so your district can adopt it by signing Exhibit E, the General Offer of Privacy Terms. Email us and we'll send it pre-filled.

Data privacy agreement (SDPC National Data Privacy Agreement or your state's standard DPA)
Anywhere else, we'll sign your state's standard agreement. Send it to schools@bookroo.com.
Security questionnaire (CoSN K-12CVAT)
Not published yet. We'll answer your district's questionnaire.
Accessibility conformance report (VPAT)
Not published yet.

Contact

Questions, agreements and data requests: schools@bookroo.com. Our full privacy policy has the legal detail.

Bookroo (Vermilion Labs LLC), 971 S University Dr #1020, Provo, UT 84601