Student Data Protection
How Lit-Levels protects student data — plain language, no surprises.
Our Core Promise
Student data exists for one reason on Lit-Levels: to support learning. It is not for sale, not for advertising, not for profiling, and not for anything that would surprise a parent, teacher, or student.
What We Collect and Why
Every piece of student data we collect has a clear educational purpose. Here is exactly what we store, why, and who can access it.
First Name & Username
Grade Level
Reading Level (Lexile)
Quiz Scores & Answers
Time on Task
Parent/Guardian Email (optional)
Avatar & Preferences
What We Do NOT Collect
How We Protect Student Data
Encrypted in Transit
All data is transmitted over HTTPS. Data is stored with our hosting providers under their security controls. Student passwords are hashed with bcrypt and never stored in readable form.
Role-Based Access Control
Students see only their own data. Teachers see only their assigned students. School admins see only their school. No one sees more than they need.
Session Authentication on Every Request
Every API request verifies the user's identity and permissions server-side. There are no client-side permission shortcuts.
Data Minimization
We collect only what is needed for instruction and reporting. We do not store unnecessary personal information or behavioral data beyond educational purposes.
Right to Delete
Schools and families can request deletion of student data at any time. When a student account is deactivated, their personal information can be removed.
No Third-Party Data Sharing
Student data is never shared with advertisers, data brokers, or any third party for commercial purposes. Our external services are limited to the service providers needed to run the platform, such as the infrastructure and AI providers listed on this page.
Who Can See What
| Data Type | Student | Teacher | School Admin | Parent |
|---|---|---|---|---|
| Own reading progress | ✅ | ✅ | ✅ | ✅ |
| Own quiz scores | ✅ | ✅ | ✅ | ✅ |
| Own avatar & preferences | ✅ | — | — | — |
| Class-level analytics | — | ✅ | ✅ | — |
| Individual student detail | — | ✅ | ✅ | — |
| Other students' data | — | — | — | — |
| Teacher account info | — | — | ✅ | — |
| Platform-wide metrics | — | — | ✅ | — |
Third-Party Services
Lit-Levels uses a minimal set of third-party services needed for core platform operation, including:
Database and file storage are hosted with cloud infrastructure providers, including AWS for file storage. (AWS maintains its own independent security attestations; Lit-Levels does not claim these certifications for itself.)
Used to generate reading content, provide hints, and create personalized stories. We send only the information needed for each request.
Delivers account, invitation, password-reset, and notification emails. Receives the recipient's email address, the message content, and delivery information. Required for these emails.
Optional accessibility feature. When a user chooses read-aloud, the text being read is sent so it can be returned as audio.
Currently unavailable. Student photo upload is disabled, so no student photos are sent to this provider. Standard cartoon avatars are generated within Lit-Levels and do not use this or any other outside avatar service.
See Privacy Policy section 4.2 for the full list of service providers.
What we do NOT use: No third-party analytics trackers, no advertising networks, no social media pixels, no data brokers, no behavioral tracking services.
How We Approach Student-Privacy Laws
Lit-Levels is designed to support schools in meeting their student-data privacy obligations. Lit-Levels does not hold, and does not claim, any FERPA, COPPA, or SOC 2 certification. Schools remain responsible for evaluating their own legal and policy requirements.
Designed to support schools' FERPA-related responsibilities. Student data treated as education records under school control. Parents have right to access and request deletion.
Where COPPA applies, designed to support school-authorized educational use. Accounts created by schools/teachers under school consent. No direct marketing to children. Student photo upload is currently disabled until a verified parent/guardian consent workflow exists.
Our practices are informed by Georgia, North Carolina, and other state student-privacy requirements. Schools should review our practices with their own counsel.
For Schools & Families
If you are a school administrator evaluating Lit-Levels, or a parent who wants to know more about how your child's data is handled, we are happy to answer questions.
Schools can contact us at any time to discuss data privacy terms. We do not currently offer a standard Data Privacy Agreement (DPA) template, but we will review a school's or district's proposed agreement.
Parents can request to see what data we hold about their child, request corrections, or request deletion by contacting their child's teacher or school administrator.
Last updated: October 2026
Lit-Levels is operated by ERM-Educational Services. Questions? Contact your school administrator.