Kibu and Schools — FERPA and Student Privacy

1. Our position

FERPA does not currently apply to Kibu.

FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) binds educational agencies and institutions that receive US Department of Education funding. It reaches a company like ours only through the 'school official' exception at 34 CFR § 99.31(a)(1)(i)(B), where a school outsources an institutional function and keeps direct control of the data.

None of that describes Kibu. We contract directly with parents, who pay for their own subscription. No school selects, purchases, deploys or administers Kibu. No school has access to any child's data. We hold no education records — no grades, no attendance, no assessments, no disciplinary records, no records maintained by an educational institution.

2. US state student-privacy laws

Laws such as California SOPIPA, New York Education Law § 2-d, and Illinois SOPPA attach to operators of services designed and marketed for K-12 school purposes. Kibu is designed and marketed for families, sold through consumer app stores, and paid for by parents.

We are aware Kibu includes 'academic' mission categories, and that homework-shaped features can look like school software. The distinction that matters is who the customer is and who controls the data. For Kibu, both are the parent.

3. What we commit to

• We do not sell student or child data. We do not sell any personal data.
• We do not serve advertising, targeted or otherwise, to any user.
• We do not build advertising or marketing profiles of children.
• We do not accept registrations authenticated by a school-issued domain or district single sign-on.
• We do not offer any account type that gives a teacher or school administrator visibility into a child's data.
• We do not rely on the COPPA school-consent mechanism. Consent comes from a parent, always.

4. What would change this

Any one of the following would make FERPA or a state student-privacy law potentially applicable, and none of them may proceed without legal review first. We publish this list so that a customer, a partner or a member of our own team can hold us to it.

• A school, district, camp, nursery or after-school programme purchases or distributes Kibu — including a single unpaid pilot.
• A teacher, school administrator or counsellor is given any account with visibility into children's data.
• Kibu markets to schools, exhibits at an education conference, or launches an educators' tier.
• A school-issued email domain or district single sign-on becomes a registration route.
• Kibu adds curriculum-aligned content, gradebook integration, or homework tied to a specific school's assignments.
• Any school purports to consent on parents' behalf.
• Kibu accepts a data feed from, or sends one to, a school information system.
• A clinical, therapeutic or diagnostic use is proposed, which raises health-privacy questions as well.

5. If you are a school and want to use Kibu

Please contact us at [email protected] before recommending Kibu to families as part of a school activity. We are not currently set up to be a school vendor, and we would rather tell you that than have families sign up under a misunderstanding about who holds their child's data.

Nothing stops an individual teacher recommending Kibu to parents as a personal suggestion, in the way they might recommend any consumer app. What matters is that the school does not select it, administer it, or receive data from it.