Student Data Privacy

RealQuest acts as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). We perform functions the school would otherwise perform itself, remain under the school's direct control regarding the use of education records, and use student data only for the educational purposes the school authorizes. We do not re-disclose education records except as the school directs or the law permits.

For students under 13, we rely on the school's consent in the educational context, as permitted under the Children's Online Privacy Protection Act (COPPA): the school consents on behalf of parents for the collection of student data used solely for the school's educational purposes. We limit collection to what the service needs, honor deletion, and — for any student to take a project into a public or commercial setting — require a separate, deliberate parent/guardian action.

We honor state student-privacy laws (including SOPIPA-style requirements): we do not sell student data, do not use it for targeted advertising, do not build non-educational profiles, maintain reasonable security, and delete student data at the school's request. We're glad to sign state-specific exhibits.

We collect the minimum needed to run the service. Students in a class start in a school-safe mode — public publishing and real payments are off until a teacher (or, for commercial use, a parent) turns them on.

We use a small set of vetted service providers to run RealQuest. Each is bound to protect data and use it only to provide their service to us.

Data is encrypted in transit (TLS) and at rest. Access is restricted to authorized personnel on a need-to-know basis, protected by authentication and least-privilege controls. We are pursuing SOC 2 and will share our current security documentation on request.

RealQuest runs in a standard browser and works on managed Chromebooks and iPads. If your network filters traffic, allowlist these domains so students can build and sign in:

• realquest.ai and *.realquest.ai (the app + student sites)
• *.supabase.co (sign-in, realtime, storage)
• accounts.google.com (Google sign-in, if used)
• js.stripe.com, checkout.stripe.com (only if a school enables real payments)

No installs, no browser extensions. Content students generate in a class is governed by the school-safe settings the teacher controls.

We keep student data only as long as needed to provide the service or as your agreement specifies. On request — and at the end of our relationship — we delete or return student data. Individual records are deleted promptly when requested by the school. A student's classroom work stays an academic record within the school; a project only leaves that context when a parent deliberately takes it commercial.

We sign data privacy agreements — including the SDPC National Data Privacy Agreement and state-specific exhibits — as part of onboarding a school or district. If your district uses its own DPA template or the Student Data Privacy Consortium's, send it our way and we'll execute it before student data flows.

To request a DPA, our subprocessor list, or security documentation, contact us below or use the demo & quote form.

Questions about student data privacy? Email privacy@realquest.ai. We respond to school and district privacy inquiries promptly.