Parents' Bill of Rights for Data Privacy and Security

New York Education Law § 2-d requires every educational agency — and, for a product used in New York schools, the vendor whose contract goes alongside that agency's own bill of rights — to publish a Parents' Bill of Rights for Data Privacy and Security, plus supplemental information specific to that product. This page is PrecisStudy's.

Parents' Bill of Rights

In accordance with New York Education Law § 2-d, parents and eligible students are entitled to the following:

• A student's personally identifiable information (PII) cannot be sold or released for any commercial purpose.
• Parents have the right to inspect and review the complete contents of their child's education record.
• State and federal laws protect the confidentiality of a student's PII, and safeguards associated with industry standards and best practices — including encryption, firewalls, and password protection — must be in place when data is stored or transferred.
• A complete list of all student data elements collected by New York State is available from NYSED, and is subject to change based on state legislation: nysed.gov/data-privacy-security.
• Parents have the right to file a complaint about a possible breach or unauthorized release of PII with the school, the district, or the New York State Education Department.
• Third-party contractors — like PrecisStudy, when used by a New York school — must notify the educational agency of any breach of security resulting in unauthorized release of PII, in the most expedient way possible and without unreasonable delay.

Supplemental information — PrecisStudy specifically

The sections below describe how PrecisStudy, as a third-party contractor/vendor, handles student data. This is written to sit alongside — not replace — the school or district's own Parents' Bill of Rights and any Data Processing Agreement (DPA) it enters into with PrecisStudy.

Exclusive purpose of data collected

Any student PII PrecisStudy receives is used solely to operate the study-guide, quiz, and progress-tracking features described in our Privacy Policy — for example, keeping a student signed in and remembering which quiz questions they've already answered. It is never used for advertising, marketing, or any commercial purpose, and PrecisStudy carries no ad network or analytics tracker of any kind.

What is (and isn't) collected

• If a student signs in with Google or another provider: their name and email address, as provided by that account. PrecisStudy never sees or stores a password.
• A student's own quiz answers, flashcard progress, and (if they choose to connect it) their own Google Classroom coursework and Calendar events — never another student's or a teacher's private data.
• PrecisStudy does not collect Annual Professional Performance Review (APPR) data, health records, disciplinary records, or any data beyond what's needed to run the product features a student actually uses.

Oversight of subcontractors and other parties

PrecisStudy runs entirely on Cloudflare Workers infrastructure; Cloudflare is the only infrastructure subcontractor with any technical access to stored data, and that access is limited to what's necessary to host the service (covered by Cloudflare's own privacy policy). No student data is shared with any other third party. Where a school's contract with PrecisStudy requires it, PrecisStudy will ensure any subcontractor with access to PII is contractually bound to the same Education Law § 2-d obligations.

How to challenge the accuracy of PII

A parent, eligible student, or school may request a correction of inaccurate student PII held by PrecisStudy at any time by emailing us (below). We will review the request and correct or remove inaccurate data promptly; if a correction can't be made, we'll explain why in writing.

Where data is stored, and encryption

Data is stored in Cloudflare's infrastructure (Workers KV). Session identifiers and any Google account tokens are encrypted; connections between a student's browser and PrecisStudy are always encrypted in transit (HTTPS/TLS). Passwords are never handled by PrecisStudy at all — sign-in is delegated entirely to the account provider (e.g., Google).

Retention and deletion

Student data is retained only for as long as a student's account is active. A student (or a parent/school on their behalf) can request deletion at any time by emailing us; we delete the account's stored data as part of that request. If a school's contract with PrecisStudy ends, or is not renewed, PrecisStudy will delete or return all PII covered by that contract within a reasonable time, consistent with the contract's terms.

Breach notification

If PrecisStudy discovers a breach or unauthorized release of student PII, we will notify the affected school or district without unreasonable delay, and no later than required by the applicable Data Processing Agreement or, absent one, within seven calendar days of discovery — consistent with Education Law § 2-d.

Questions or a request to correct/delete data?

Email — a real person (the person who built this) will read it and respond.