What to ask before putting IEP data in an app
Teachers are usually the ones who pick classroom tools, and usually the ones left exposed when a tool turns out to hold more than it should. These are the questions worth asking first, in plain terms.
Where do student names live?
This is the question that decides most of the others. An app that keeps names only on your device cannot leak them from a server, cannot hand them over in response to a request it receives, and cannot lose them in someone else's breach. Ask directly, and ask what is stored in their place.
Is the data used for anything besides serving you?
Specifically: advertising, analytics sold on, or training models. "We take privacy seriously" is not an answer. "We do not sell it, advertise against it, or train on it" is, and it should be in the terms rather than in a blog post.
Can you get everything out, and delete everything?
Export and deletion should be things you can do yourself, from inside the app, without emailing anybody. If deletion requires a support ticket, it is not really a feature.
Does your personal subscription cover the district?
Almost certainly not, and this is where well-meaning teachers get caught. An individual subscription is an agreement between you and a vendor. It does not create the data processing agreement your district needs under FERPA, and it does not carry whatever your state law adds on top. If you are recording data on real students as part of your job, the district needs its own signed agreement.
The practical move is to ask your vendor for their DPA and hand it to whoever owns privacy in your district before you roll anything out beyond yourself.
What happens when you stop paying?
Data held hostage behind a lapsed subscription is a real pattern. Ask whether a downgrade deletes, locks, or merely limits. The acceptable answer is limits.
A short checklist
- Names on device or on a server?
- Sold, advertised against, or used for training? Where is that written?
- Self-serve export and deletion?
- Is there a DPA, and has your district signed it?
- What happens to your data if you cancel?
None of this requires a lawyer to ask. All of it is harder to fix after a year of collection than before the first data point.