Privacy & FERPA

The short version

• We collect the minimum data needed to run the workspace. Name, email, school name, class roster, and the work students do inside the product.
• We do not sell student data. Ever. No exceptions.
• Student work is not training data. Not for us. Not for any third party.
• No third-party trackers in student-facing flows. No ad networks. No behavioral profiling.
• FERPA-aware by design. Schools that use Boomerang Projects can do so under the School Official exception when a written agreement is in place.
• Teachers control their classrooms. Student work is visible to the assigned teacher and the student. It is not public, and it is not exposed to other classes.

What we collect, and why

We collect three categories of information, and only what each category requires:

Account information

• Name and school email (for sign-in and contact)
• Role (teacher, coordinator, admin, student)
• School or district name

Classroom information

• Class period, section, and roster the teacher imports
• Assignment timelines the teacher configures
• Rubric milestones the teacher selects

Student work

• The student’s IRR drafts, annotated bibliography, TMP planning, and related notes
• Teacher comments attached to that work
• Timestamps necessary to show progress against rubric milestones

What we do not collect

• Location data or GPS
• Biometric data
• Personal demographic data beyond what a school provides
• Cross-site behavioral profiles

How student work is used

Student work inside Boomerang Projects is used for one purpose: to run the workspace for the student and the assigned teacher. It is not used to train models. It is not shared with third parties for marketing. It is not used to build advertising audiences.

FERPA & the School Official exception

FERPA permits schools to share student records with a third-party service that performs an institutional function under the School Official exception, provided that the service is under the direct control of the school with respect to the use and maintenance of those records and that the service does not use the data for any other purpose.

Boomerang Projects is designed to operate under that exception. Schools and districts who pilot the product sign a Data Processing Addendum that documents:

• The school’s direct control over its students’ records
• Our obligation to use the data only for the educational service the school has engaged us to provide
• Our obligation to maintain reasonable security safeguards
• Deletion timelines and data return on contract end

If your district counsel needs a copy of the DPA or wants to discuss terms before the beta, write directly to drewsnow@boomerangprojects.com.

Security

• HTTPS-only across every Boomerang Projects surface
• Access controls scoped to classroom, teacher, and student roles
• Modern authentication; password reset and account-recovery flows that don’t leak account existence
• Server-side encryption at rest for student work
• Regular dependency review during the beta period

Data retention & deletion

Student work is retained for the duration of the school year and is deleted on request from the teacher of record or the school administrator. Teachers can export an individual student’s record at any time. At contract end, all student records associated with the engagement are deleted or returned, per the DPA.

Children under 13

Boomerang Projects is designed for AP Seminar — a course typically offered in grades 10–12. We do not direct the product to students under 13 and do not knowingly collect personal information from students under 13. If a school enrolls students under 13 in AP Seminar, the school is responsible for obtaining parental consent and for working with us to ensure COPPA compliance.

Cookies & tracking

Boomerang Projects uses a small number of strictly necessary cookies for sign-in and session management. We do not use third-party advertising cookies, cross-site trackers, or behavioral analytics inside student-facing flows.

Changes to this page

We will note any meaningful change at the top of this page and, for active beta partners, send a notice to the teacher email on file.

Questions

Write directly to the founder: drewsnow@boomerangprojects.com.