Student Data and FERPA Notice
Effective: TBD
This notice explains how Peaks Education handles content that may
qualify as an "education record" under the Family Educational Rights
and Privacy Act of 1974 ("FERPA").
For background, see also our internal compliance plan at
docs/ferpa-compliance-plan.md. This page is the user-facingsummary.
What student-data content we hold
When you use Peaks we may store, depending on what you choose to
upload:
- Your course schedule for a term (extracted from a NAU LOUIE export
or similar).
- Course syllabi, including the canonical syllabus shared by your
instructor and any version you upload yourself.
- Notes, study materials, exam-related content you upload to your
library or share communally.
- Your study activity: sessions, mastery, quiz attempts, AI tutoring
conversations.
Some of this is personally identifiable information from education
records. We treat it as student data even where FERPA's narrow legal
definitions might not strictly apply.
How we handle it
- Access controls: only you (and admin staff at your school where
authorized) can read your account-scoped content.
- Encryption: data is encrypted in transit (TLS) and at rest in
Cloud SQL / Cloud Storage.
- Sub-processors: we use Anthropic and Google for AI processing
under contracts that prohibit using your data to train their
general-purpose models. See AI Disclosure.
- Retention: while your account is active, plus 30 days after
closure. Backups are kept for up to 30 days. Audit logs are kept
18 months.
- Sharing with your school: where your institution has signed a
Data Processing Agreement (DPA) with us, we may act as a "school
official" under FERPA's exception. We disclose to your school only
what the DPA permits and what is necessary for them to fulfill
their educational role.
- No advertising sale: we do not sell student data and do not
use it for cross-context behavioral advertising.
Your rights as a student
You have the right to:
- Inspect your own data via in-app surfaces and the data export at
/settings/security.
- Request correction of inaccurate data.
- Request deletion of your account and associated data.
- Withdraw any content you have shared communally.
To exercise these rights, email support@peakseducation.com. We respond
within 30 days.
If you are a parent or guardian of a student under 18: please contact
support@peakseducation.com to discuss FERPA-eligible access procedures.
Communal content and academic integrity
When you mark content as "communal" so other students at your school
can see it, you take responsibility for ensuring you have the right to
share it. We remove communal content that infringes copyright, that
contains instructor-only material posted without permission, or that
violates academic-integrity rules.
If you believe communal content was posted improperly, email
support@peakseducation.com or use in-app reporting.
Schools
If you administer or work for a school considering Peaks for
deployment, see docs/legal/school-dpa.md for our DPA template.
Contact support@peakseducation.com to start a conversation.
Changes
Material changes are posted with a new effective date.