Trust and privacy
What Backpack keeps about a child, and who can see it.
Written for the people who approve software for a district: what Backpack stores, who can see it, how it is deleted, and the documents your compliance review will ask for.
Version 2026.4, September 28, 2026. This page, the three downloads below and the board packet read from the same source files.
Real screen from our demo district. Names are fictional.
Downloads for your review
In plain words
Our promises.
We do not sell student data.
Not to anyone, not for any reason. It is never rented or traded either.
We do not track students for advertising.
Backpack shows no ads and tracks nothing for advertising. Videos play in the video host's own embedded player, which may show a short ad before some videos. Backpack does not choose those ads.
We collect only what the lesson needs.
Class rosters (first name, last initial, grade, class) so the tablet can show a child their teacher's backpack, and viewing records (which video, for how long, whether it finished) so the teacher and the family can see them. No photos, no birth dates, no home addresses.
We delete on the district's schedule.
The district sets how long viewing records are kept, and can export or delete its data. When a district leaves, its data is deleted and a certificate says so.
Data
What we collect about a child.
A child in Backpack is a tile on a shared class tablet. There is no child account, no profile and no password. Students in grades 6 to 12 join with a class code and pick their name.
Real screen, demo district. Names are fictional.
- NameFirst name and last initial. Nothing more of a child's name is shown on the tablet.
- ColourA colour for their tile, so a child who cannot read yet can find their own.
- ClassTheir grade, school and the class they are in, so the tablet shows only their teacher's backpack.
- What they watchedWhich of their teacher's videos they opened, when, for how long, and whether they finished.
- PhotosNone, ever. There is no photo field for a child anywhere in Backpack, so there is nowhere to put one.
What we never collect
- Date of birth
- Home address
- Photographs of any student
- Free-text student input
- Search queries
- Location data
- Biometric data
- Disciplinary or special-education records
- Assessment scores
A view
Who sees what a child watched.
Each view is recorded and shown on two screens: the teacher's, for their class, and that child's parent's. No principal or district screen shows viewing records, and there is no aggregate report of them. The teacher sees it for their class. The parent sees it for their own child.
Viewing records leave those two screens only in the district's data export: a district admin can download it from the district console, and Backpack staff produce it when a district closes. Every export is recorded in the district's own audit log.
The teacher · What they watched
The parent · What Jaylen watched
The district's audit log
Every change, with who made it and when.
The district's Record lists every change in the district, who made it and when. Entries cannot be edited or deleted.
Sign-in
How people sign in.
No one in Backpack has a password. Children tap their tile on a classroom tablet the teacher opens. Parents use a single-use link emailed to them.
- Google WorkspaceStaff sign in with their school Google account once the district has verified its email domain. Only managed Workspace accounts on a verified domain with an existing staff account are accepted; personal Google accounts and Gmail addresses are not. No account is created by signing in, and a district can turn Google sign-in off.
- Emailed sign-in linkA one-time link sent to a staff member's school email, valid for 30 minutes. Where the district has verified its email domain, only addresses on it can sign in. There are no passwords.
Retention and deletion
How long we keep data.
Student data is disposed of at the earliest of the district's written direction, 60 days after a student's roster record becomes inactive, or 90 days after the end of the term (shorter on the district's election). Backpack staff carry out the deletion; when a whole district is deleted, a certificate of deletion listing what was deleted is emailed to its admins. The database's restore history is at most 30 days, so a deletion is gone from it within 30 days.
Retention period set in the district console. A district admin sets how long viewing records are kept (30 days to three years; default 365). Viewing records older than that are purged nightly, and each change and each purge is written to the district's audit log. The setting covers viewing records only; student, staff and family records are not purged by it.
District export. A district admin downloads the district's data as a ZIP of CSV files: people, schools, classes, students (first name and last initial), families, catalog decisions, viewing records within the retention period, and the audit log. Each export is written to the audit log.
Deletion certificate. A Backpack operator deletes a closed district by hand, after its data has been exported and after typing the district's name. A certificate is then stored listing how many records of each kind were deleted, what was retained and why, the operator who deleted it and the reason, with a SHA-256 of the certificate text. It is emailed to the district's admins and kept by Backpack.
When a student record is deleted, that child's viewing history is deleted with it. Sandbox demo districts, and everything in them, are deleted when the sandbox expires.
State agreements
State privacy agreements.
No pilot starts before your state's student data privacy agreement is signed. Where we have checked the details, they are below.
California
Before any pilot, we sign the California Student Data Privacy Agreement (CA-NDPA).
California Education Code section 49073.1 requires a contract with a digital education provider to state that pupil records remain the property and under the control of the district, and to describe how a parent can review and correct them.
Source: California Education Code section 49073.1, checked 23 September 2026.
Illinois
Before any pilot, we sign the Illinois National Data Privacy Agreement (IL-NDPA V1.0a).
The Illinois Student Online Personal Protection Act (SOPPA, 105 ILCS 85) requires a district to sign a data privacy agreement with an operator before sharing student data, and to post it.
The IL-NDPA is signed once by the operator at registry level and can then be adopted by any Illinois district.
Source: Student Data Privacy Consortium, Illinois agreement information, checked 22 September 2026.
Indiana
Before any pilot, we sign the Indiana standard data privacy agreement offered through the SDPC Indiana Alliance.
Indiana's educational service centers run an SDPC Indiana Alliance that gives schools a standard data privacy agreement and a shared register of vendors.
Source: Central Indiana Educational Service Center, launch of the Indiana Student Data Privacy Consortium, checked 23 September 2026.
New York
Before any pilot, we sign a data privacy agreement that includes the district's Parents' Bill of Rights for Data Privacy and Security and a data security and privacy plan.
New York Education Law section 2-d requires every contract under which a third party receives student data to include a data security and privacy plan and a signed copy of the district's Parents' Bill of Rights for Data Privacy and Security.
Source: New York State Senate, Education Law section 2-d, checked 23 September 2026.
Every other state: We will sign your state's standard student data privacy agreement before any pilot; no pilot without it.
Closing
If Backpack closes.
If Backpack stops offering Backpack Education, every district gets at least 90 days' written notice, sent to its Data Steward.
Within 30 days of that notice, or sooner if the district asks, Backpack delivers a complete export of the district's data: schools, classes, staff, students, class enrollments, the catalog, class backpacks, requests, viewing records and the district's audit record, in a machine-readable file. A district admin can also download the district's export from the district console at any time.
30 days after the export is delivered, unless the district directs a different date, a Backpack operator deletes the district's data and a certificate of deletion is emailed to the district's admins. The database's restore history is at most 30 days, so the data is gone from it within 30 days after that.
The same steps apply when a single district leaves: export first, then deletion on the date the district sets, at most 90 days out.
Our published deletion terms, under How long we keep data, above, apply in full.
Ownership
If Backpack is ever sold.
- The buyer is bound by every promise on this page, for all data we hold.
- We tell each district before any transfer.
- Any district can export or delete its data first.
Commitments
What we will not do with data.
No advertising to students
No targeted advertising to students, on any screen, ever. It is a term of our Data Processing Agreement and of every state student data privacy agreement we sign. Backpack shows no ads and tracks nothing for advertising. Videos play in the video host's own embedded player, which may show a short ad before some videos. Backpack does not choose those ads.
No profiling
No behavioral profile of a student built or used except in direct furtherance of the K–12 purposes in the schedule of data above.
No sale of data
Student data is never sold, rented, or traded. Not to anyone, not for any reason.
No model training
Student data is never used to train machine-learning models, ours or anyone else's.
Breach notice
The district's Data Steward is notified of a breach of covered information within 72 hours as our target, and no later than 30 calendar days after Backpack determines a breach occurred, with the information the district needs to meet its own notice obligations to families.
Isolation between districts
Every district-scoped table carries an organization identifier, enforced by PostgreSQL row-level security. One district's staff cannot read another district's rows.
For your compliance review
Subprocessors.
The third parties that may receive or process covered information on our behalf. We give a district's Data Steward 30 days' written notice before adding one.
| Subprocessor | Function | Data | Location |
|---|---|---|---|
| Vercel, Inc. | Application hosting, edge network, scheduled jobs | All application data in transit; request and function logs kept for Vercel's standard log retention period | United States |
| Neon, Inc. | Managed PostgreSQL database | All data in the schedule of data, encrypted at rest and in transit | United States (Amazon Web Services, us-east-2) |
| Resend, Inc. | Delivery of sign-in links, invitations and family connection emails | Recipient email address and message content: a staff member's name and role in an invitation; a child's first name and school in a family confirmation email | United States |
| Google LLC, YouTube | Video metadata lookup and privacy-enhanced playback embed | Video identifiers only. No student identity is sent. Playback uses youtube-nocookie.com | United States |
| Google LLC, Google sign-in | Staff sign-in with the district's Google Workspace accounts, for districts that use it | A staff member's school email address and Workspace domain, in the sign-in response Google returns; Google sees that the staff member signed in to Backpack | United States |
| Google LLC, Workspace | Backpack's internal email and document storage for contract administration | Contract documents and district contact details; no student data | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, only while it is switched on for the Education deployment | Error reports with the page address and technical detail, without cookies or form values; for one browser error in ten, a session replay with all text masked and all media blocked | United States |
No analytics, advertising or AI-model training service receives covered information. The only session recording is the masked error replay described for Sentry above. Backpack's consumer product also uses a subscription platform; Backpack Education runs as a separate deployment with its own settings and its own database, and no Education page calls that platform.
Security reports: security@ghz.company. Product and data requests: support@education.backpack.kids. Questions a document does not answer: Contact us
Check every claim yourself in a demo district.
Sign in as a teacher, a classroom tablet or a parent and see exactly what each of them can see.