← Back

FERPA Statement

Last updated: April 10, 2026

What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a U.S. federal law that protects the privacy of student education records. It gives parents (and eligible students over 18) the right to access and control disclosure of those records.

Our role

When a school or teacher uses Gitit, we function as a "school official" with a "legitimate educational interest" under FERPA § 99.31(a)(1). The teacher invites students into a class, and students write within that class context. We process student data solely to provide the writing-process verification service the teacher signed up for.

What student records we handle

• Student name and email (from the identity provider at sign-in)
• Class enrolment (which classes the student has joined)
• Assignment submissions and the associated keystroke event stream
• Derived metrics: active editing time, keystroke count, paste events

How we protect student records

• Access control — students see only their own work. Teachers see only submissions within their classes. Gitit staff access is limited to support and debugging.
• No re-disclosure — we do not share, sell, or license student data to any third party.
• No advertising — student data is never used for marketing, profiling, or ad targeting.
• Encryption — data is encrypted in transit (TLS) and at rest (encrypted backups).
• Minimal collection — we collect only what the product requires. We do not fingerprint devices, track across sites, or collect location data.

Parental and student rights

Under FERPA, parents (or eligible students) have the right to:

• Inspect the student's records — contact us to request an export
• Request correction of inaccurate records
• Request deletion of the student's data

We will process these requests within 30 days. We are building self-service tools to make this faster.

Data retention and deletion

Student submission data is retained for the school year or the life of the teacher's account. When a teacher archives a class, enrolment records are soft-deleted. A full deletion request removes all associated keystroke events, submissions, and account data.

What this statement is NOT

This is a good-faith description of how we handle student data under FERPA. It is not a legal certification. Schools requiring a formal Data Processing Agreement (DPA) or a full FERPA compliance audit should contact us — we are happy to work through your procurement process.