Your students' data stays yours.

The short version

Backpack Education is a video tool for K-5 classrooms. A district or school decides which videos are approved, teachers pack a class backpack from that list, children watch on a classroom tablet, and a parent can see what their own child watched.

The district or school is in charge of its students' information. We hold it for them, use it only to run the service for them, and delete it when they tell us to or when the agreement says so. We do not sell it, we do not show ads, we do not build profiles of children, and we do not train models on it. A child has no account, no password, no email address and no photo in Backpack.

Who is responsible for the data

Backpack Education is provided by Gigahertz Company LLC of Plainfield, Illinois ("Backpack", "we"). Our customer is a school district or a school ("the district").

The district controls the data. Under the Family Educational Rights and Privacy Act (FERPA), student records stay the district's records. We act as a school official with a legitimate educational interest: we perform a service the district would otherwise do itself, under the district's direct control of how the records are used and kept, and we use the records only for that service. We act on the district's instructions as its service provider, not on our own account.

The signed agreement comes first. Before any real student data enters Backpack, the district and Backpack sign a student data privacy agreement (in Illinois, the Illinois Student Data Privacy Agreement, NDPA Standard Version 1.0) and an order form. Where that agreement and this page differ, the agreement wins. Our standard terms are published as the Data Processing Agreement (version 2026.4).

This page covers Backpack Education only. The Backpack parent app at backpack.kids has its own consumer privacy policy; nothing in a family's consumer account crosses into a school's Backpack, or the other way.

Children under 13 and parent notice

Most children using Backpack Education are under 13, so the Children's Online Privacy Protection Act (COPPA) applies. Under the Federal Trade Commission's guidance, a school may give consent on behalf of parents when a service collects children's information solely for the school's educational purpose and for no commercial purpose. Backpack relies on that school authorization. We collect only what the classroom needs, listed below, and use it for nothing else.

The district tells families. The district sends its own notice to parents about Backpack. The district console includes a "Write your parent notice" step with guidance and a starting draft the district edits and sends its usual way. Backpack does not send that notice, and does not store the letter.

A parent who wants to review what the school has shared, or ask for it to be corrected or deleted, asks the school. The school can ask us for anything it needs to answer; see Children and families.

What we collect

District and school staff

• Name, work email address, role (for example district admin, principal, tech director, teacher), and the school or classes they are assigned to.
• What they do in the console, recorded in the district's own audit log (for example packing a class backpack, approving a video request, approving a family connection).
• Staff sign in with a one-time link sent to their work email. A link works once, for 30 minutes. We store no staff passwords.

Students

• The student identifier from the district's roster file, first name and last initial, grade, school, and the classes they are enrolled in.
• A colour for their tile on the classroom tablet, so a child who cannot read yet can find their own.
• If a roster file includes a full surname in the last-initial column, only the first letter is kept. A roster file with any photo or image column is refused whole.
• There is no photo field for a student anywhere in Backpack, no student email address, and no student password. A child signs in by tapping their tile on a classroom tablet that their teacher has opened.

Families

• The email address a parent or guardian types when they connect with the family code on a letter from school, which child the connection is for, and whether the school approved, declined or removed it. We use the email to send the sign-in link and, once approved, to let them see what their own child watched.

Viewing records

• Which video from the district's approved list a child opened, which child, which class, which classroom tablet session (and the teacher who opened it), when it started, how many seconds were watched, and whether the video was finished.
• The teacher sees these for their class. A connected parent sees them for their own child only. No principal or district screen shows them; they leave those two screens only in the district's data export, which is recorded in the district's audit log.

Email we send

• A copy of each email Backpack sends for a district (invitations, sign-in links, family connection notices), with any sign-in link removed. District and school admins can read these in the Communications tab of their audit area.

People who contact us or open a demo district

• Name, work email, role, district, state and your message when you use the contact form, open a demo district or build a board packet. We use it to reply and to follow up about Backpack Education.
• A demo district contains only fictional schools, staff and children. It is deleted, with everything in it, when it expires.

What we never collect

These are not collected from students, and there is no field in Backpack to hold them:

• Date of birth
• Home address
• Photographs of any student
• Free-text student input
• Search queries
• Location data
• Biometric data
• Disciplinary or special-education records
• Assessment scores
• Student email addresses or passwords

Backpack Education pages load no advertising, analytics or social-media trackers.

How we use it, and what we will not do

We use the information above only to provide Backpack Education to the district: signing people in, showing each teacher their class and each parent their own child, routing video requests to the people the school chose, sending the emails the service needs, keeping the district's audit log, and keeping the service secure and working.

• No advertising. No targeted advertising to students, on any screen, ever. It is a term of our Data Processing Agreement and of every state student data privacy agreement we sign.
• No sale of data. Student data is never sold, rented, or traded. Not to anyone, not for any reason.
• No profiling. No behavioral profile of a student built or used except in direct furtherance of the K–12 purposes in the schedule of data above.
• No model training. Student data is never used to train machine-learning models, ours or anyone else's.

We disclose student information only to the district, to the subprocessors listed below for the purpose described, or where the law requires it.

Who can see what

• Teachers see the children in their own classes and what they watched.
• Principals and school admins see their school; district admins see the district. Both have an audit area with Activity, Communications and Family connections, each exportable as CSV.
• Parents and guardians, once the school approves their connection, see what their own child watched. Nothing about other children.
• A classroom tablet shows the children in the class its teacher opened, by first name and last initial, and only that teacher's backpack.
• Backpack staff reach a district only through our operations console. Every action there requires a typed reason and is written to the district's own audit log as "Backpack support". A support view of district screens lasts 30 minutes, is read-only, and does not include family or child pages.

One district can never read another district's data. Every district table carries the district's identifier, and PostgreSQL row-level security enforces it on every query.

Subprocessors

These companies process data on our behalf to run Backpack Education. We give a district's Data Steward 30 days' written notice before adding a subprocessor that receives student data. The contractual list is the Subprocessor List.

Videos play in YouTube's embedded player, and Google handles what that player collects under the Google Privacy Policy.

Backpack Education does not use the video hosting service used by the Backpack parent app, or any advertising, analytics or session-recording service other than Sentry's masked error replays described above.

How long we keep it

Under our standard agreement, student data is disposed of at the earliest of:

• the district's written direction;
• 60 days after a student's roster record becomes inactive; or
• 90 days after the end of the term, or a shorter period the district chooses.

Disposal means deletion from our database; the database's restore history is at most 30 days, so a deletion is gone from it within 30 days. Hosting request logs are kept for our hosting provider's standard log retention period.

When a student record is deleted, that child's viewing records, family code and family connections are deleted with it. When a district is closed, we first give the district an export of its data, then delete the district on the date it directs (30 days after closing unless it asks otherwise, at most 90).

Retention. A district admin sets how long viewing records are kept (30 days to three years; default 365). Viewing records older than that are purged nightly, and each change and each purge is written to the district's audit log. The setting covers viewing records only; student, staff and family records are not purged by it.

Certificate of deletion. A Backpack operator deletes a closed district by hand, after its data has been exported and after typing the district's name. A certificate is then stored listing how many records of each kind were deleted, what was retained and why, the operator who deleted it and the reason, with a SHA-256 of the certificate text. It is emailed to the district's admins and kept by Provider.

Other disposals (a student record after it becomes inactive, or at the end of a term) are carried out by Backpack staff on the district's direction. To direct one, write to support@education.backpack.kids.

Other time limits: sign-in links expire after 30 minutes, staff invitations after 72 hours, and a demo district after 14 days unless extended. We store only a hash of every link, code and invitation, never the link itself.

The district's rights and tools

• Audit log. District admins and principals have an audit area in the console: who did what and when, every email sent, and every family connection, with a CSV export of each tab. Opening a message or connection there is itself recorded.
• Correction. Backpack never writes to the district's roster. Correct a record in the student information system, then upload the roster file again; records are matched on the roster identifier and updated. Staff can approve, decline or remove any family connection in the console.
• Export. A district admin downloads the district's data as a ZIP of CSV files: people, schools, classes, students (first name and last initial), families, catalog decisions, viewing records within the retention period, and the audit log. Each export is written to the audit log.
• Deletion. On request to support@education.backpack.kids, as described under How long we keep it.
• Subprocessor changes. 30 days' written notice to the district's Data Steward before a new subprocessor receives student data.

Children and families

Parents and eligible students have rights under FERPA and state law to inspect and review a child's education records, to ask for corrections, and in some cases to ask for deletion. Because the district controls these records, a parent makes these requests to the child's school or district. The school has the tools above, and we help it respond within its legal deadline.

If a parent writes to us directly, we pass the request to the district and tell the parent we have done so. We do not act on it ourselves without the district's direction, because we cannot verify who is a child's parent; the school can.

A connected parent can see what their own child watched at any time in Backpack. A parent who no longer wants that connection can ask the school to remove it.

Security

In summary:

• Row-level security in the database keeps each district's rows to that district, and an automated test suite attempts cross-district reads on each district route.
• Data is encrypted in transit (TLS) and at rest in the database.
• Sign-in links, invitations, family codes and tablet sessions are stored only as hashes.
• Students have no passwords; staff have no passwords with us.

The Security Summary describes our controls for a district's review. Report a vulnerability to security@ghz.company.

If there is a breach

The district's Data Steward is notified of a breach of covered information within 72 hours as our target, and no later than 30 calendar days after Backpack determines a breach occurred, with the information the district needs to meet its own notice obligations to families. Our target is to notify within 72 hours. The district then notifies families as its own law requires, and we help it do so.

Changes to this policy

If we change this policy in a way that affects how student data is used, we tell each district's administrators before the change takes effect. A change never weakens a signed agreement: that agreement keeps governing until the district signs a new one.

Contact

Questions about this policy or a privacy request: privacy@backpack.kids.

Help with the product, exports, deletion and retention requests: support@education.backpack.kids.

Gigahertz Company LLC, Plainfield, Illinois. Postal address on request.

See also the Terms of Service and the Trust page.