School authorization for student use

This page is for school and district administrators. Before a teacher can add students by name to TaleTykes, an administrator of that school reads this notice and confirms the authorization at the end, and someone at TaleTykes checks with the school that the person confirming is an administrator there. A district that signs a data privacy agreement, or connects a roster through Clever, ClassLink or another OneRoster provider, gives the same authorization in that agreement.

It is part of our School terms. If a signed data privacy agreement says something different, the agreement wins.

Why we ask

The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before an online service collects personal information from a child under 13. Federal Trade Commission guidance lets a school give that consent in place of parents, but only when the information is collected for the school's own educational purpose and for no other commercial purpose. That guidance is not in the text of the COPPA Rule, so we ask an administrator to confirm it in writing rather than relying on a teacher's sign-up.

A teacher can use TaleTykes before the school authorizes it, but students then join only from home, with a family code and a parent's own consent.

Who we are

TaleTykes, Inc., a Delaware corporation, runs TaleTykes, a reading service for Pre-K through grade 8. Contact schools@taletykes.com about this page, or privacy@taletykes.com about personal information. Our postal address is available on request.

What we collect about students

Only what teaching reading needs:

• From the school: first name and last initial, grade, class, and, for rostered schools, the school's own student id. We never ask for a full surname, date of birth, address, photo, disability status or demographic information.
• Set by a teacher, if they choose: reading supports such as larger text or a different font, stored encrypted; a tier and aim line for intervention planning; short notes shared with a linked parent.
• From the student's use: books opened, pages read, words tapped for help, answers to questions, lessons and skill checks, tile-built writing, and the reading level and skills we estimate from them.
• Read-aloud scores, only if the school allows read-aloud: words correct per minute and errors, scored on the device. The recording itself is never uploaded.
• Device information: a random id for each device a teacher trusted for class use, and when it was last used.

Students never type to a model, never have an email address or password, and never see ads. Their inputs are pictures, word tiles and choices.

How we use it

Only to provide TaleTykes to the school:

• to choose and make the next books at each student's level
• to show teachers, administrators and linked parents how reading is going
• to keep the service safe, including a person reviewing writing that may show a student is at risk
• to keep the service working and secure

We never sell student information, never use it for targeted advertising or to build profiles for any purpose other than the school's, never use it to market to families, and never use it to train AI models. We may use information with all identifiers removed to improve our books and lessons; we do not try to re-identify it.

Who receives it

The companies that run parts of TaleTykes for us, under contracts that limit them to that work. Our Subprocessors page lists each one and what it receives. No AI vendor ever receives a student's name or any other identifier. We tell schools 30 days before adding a company that would receive student information.

We may also disclose information when the law requires it, or to protect a student's safety.

How long we keep it

For as long as the school's agreement lasts. When the agreement or a Classroom plan ends, or the school asks, we delete student records within 30 days, after an export window if the school wants one. A student withdrawn from a district roster is deleted after the district's chosen period, 365 days unless it sets another. Our Data retention schedule has the details.

Parents' rights

Parents can ask the school to review their child's information, correct it, or have it deleted, and to stop further collection. The school decides; we act on its instruction within 30 days. A parent who contacts us directly is referred to the school, and we help the school answer.

Withdrawing the authorization

An administrator can withdraw this authorization at any time by emailing schools@taletykes.com. Teachers can then no longer add students by name, and we delete the school's student records as section 13 of the School terms describes.

What the administrator confirms

By confirming, the administrator states that:

1. They are authorized by the school to give this authorization.
2. The school authorizes TaleTykes to collect the student information described above from students under 13, solely for the school's educational purpose and for no other commercial purpose.
3. The school has given, or will give, parents notice of TaleTykes as its policies require, and will refer parents' requests to review or delete information as described above.
4. The school designates TaleTykes as a school official under FERPA for this service, as section 3.1 of the School terms describes.

We record the administrator's name, title, the date, the version of this page they saw, and a one-way hash of the network address they confirmed from. We then check with the school, through its website, its office or its district's directory, that the person confirming is one of its administrators, and we note how we checked. The authorization takes effect only after that check. The teacher's school email and the administrator's email must be on the same school domain.