Student data deserves the same care as students.
Plain-English answers to the questions schools and families ask us. Last updated July 2026.
Our commitments
- We never sell student data. Not to advertisers, not to brokers, not to anyone. Student data exists in SproutMap for one purpose: helping educators and families understand growth.
- Student data is never used to train AI models. SproutMap's AI features run on Anthropic's Claude via API; API inputs and outputs are not used to train models.
- Your data is yours. Schools can request a complete export of their data at any time, and self-serve exports are on our roadmap. If you leave SproutMap, your students' growth records leave with you.
- AI assists educators — it never replaces their judgment. There is no student-facing chatbot. AI reads only what educators have actually observed and drafts analysis a teacher reviews and decides on.
Tenant isolation, enforced at the database
Every school's data is isolated with row-level security (RLS) policies enforced inside the database itself — not just in the application layer. A query from one school's account physically cannot return another school's rows, even if application code has a bug.
Sensitive records go further: an incident report involving multiple students is automatically redacted per viewer, so a family member only ever sees their own child — again enforced at the database, not just the screen.
FERPA & COPPA
SproutMap is built to support schools' obligations under FERPA. We operate as a service provider acting at the direction of the school (the "school official" model): the school controls its student records, decides who can see what, and can instruct us to correct or delete data at any time.
Student information enters SproutMap only on behalf of and at the direction of a school — we never collect personal information directly from children for our own purposes, consistent with COPPA's school-consent framework.
Privacy practices
- Role-scoped access. Educators see their learners; families see only their own children, and only the dimensions the school chooses to share; school admins control both.
- No advertising, no tracking for profit. There are no ads in SproutMap and no third-party advertising trackers.
- Minimal collection. We store what the assessment work requires — observations, competencies, notes, and roster basics — nothing more.
- Audit trail. Logins and administrative activity are logged so schools can see who accessed what, and when.
Infrastructure
- Hosted on Supabase (database, authentication) and Netlify (application delivery), in United States data centers.
- All data is encrypted in transit (TLS) and at rest.
- Access to production systems is limited and credentialed; there is no shared login.
How the AI works
When an educator asks for a class analysis, learning suggestions, or a family support guide, SproutMap sends the relevant observed evidence — scores, growth history, and non-confidential notes — to Anthropic's Claude API and returns the result to the educator. Results are cached so identical requests aren't re-sent. Anthropic does not use API data to train its models. AI output is labeled as AI-generated and is always subject to educator review.
Questions?
We'd rather over-answer than under-answer. Write to hello@sproutmap.org and a human who works on the product will reply.