US School Data Privacy Compliance
Executive Overview for US School Districts, Superintendents, IT Directors & Physical Education Departments
Architectural Overview: Privacy-First & Offline-First
Designed specifically for K-12 Gym Environments
Unlike conventional cloud-based educational software that stores unencrypted student records on remote servers, SportZens employs Client-Side Zero-Knowledge Encryption (E2EE).
Student names, assessment rubrics, and attendance records are encrypted directly on the teacher's device (iPad, Android, or laptop) using modern cryptography before any transmission or local storage takes place.
SportZens servers have NO access to decryption keys and cannot read, parse, or index student names or PII.
No student profiles are created, monetized, or shared with third-party advertising networks.
Operates seamlessly in gymnasiums without Wi-Fi. Data remains encrypted on-device.
1. Zero-Knowledge Cryptographic Architecture
Client-Side LibSodium / TweetNaCl Encryption
┌────────────────────────────────────────────────────────┐
│ TEACHER'S DEVICE (Client-Side) │
│ │
│ [Student Names, Rosters, Grades, Medical Notes] │
│ │ │
│ ▼ │
│ [LibSodium / TweetNaCl Encryption] │
│ (Key derived from Teacher PIN) │
│ │ │
│ ▼ │
│ [Ciphertext / Encrypted Blobs] │
└─────────────────────────┬──────────────────────────────┘
│ (Only Encrypted Data via TLS 1.3)
▼
┌────────────────────────────────────────────────────────┐
│ CLOUD SERVER / DATABASE │
│ │
│ • Has NO access to decryption keys │
│ • Cannot read, parse, or index student names/PII │
│ • Compliant with FERPA "School Official" Exception │
└────────────────────────────────────────────────────────┘
Because keys never leave the teacher's authorized hardware, unauthorized database access yields only mathematically indecipherable ciphertext.
2. FERPA Compliance Assessment
Family Educational Rights and Privacy Act (34 CFR Part 99)
Under FERPA, educational agencies may disclose Personally Identifiable Information (PII) from education records without prior parental consent to third-party contractors under the "School Official Exception" (34 CFR § 99.31(a)(1)(i)):
- Direct Control: The school and teacher maintain exclusive control over education records. Teachers can delete, modify, or export student data at any time.
- Legitimate Educational Interest: SportZens is utilized exclusively to manage Physical Education curriculum standards, fitness assessments (e.g. PACER / FitnessGram), attendance, and rubrics.
- Re-disclosure Restrictions: Student data is never re-disclosed or shared with external parties. Because data is end-to-end encrypted, even SportZens engineers cannot view student identities.
3. COPPA Compliance Assessment
Children’s Online Privacy Protection Act (16 CFR Part 312)
COPPA regulates the collection of personal information from children under 13:
- No Student Accounts Required: K-12 students are not required to create accounts, supply email addresses, or provide passwords.
- Optional Homework/Workout (WOW) Access: Students join teacher-assigned workouts or rules quizzes via ephemeral 4-digit PINs or temporary QR codes. No PII is collected during student sessions.
- School Consent Provision: Under FTC COPPA guidance, schools may act as the agent for parents to consent to the collection of student information solely in the educational context.
4. State-Level Data Privacy Acts & Vendor Inquiries
California SOPIPA, NY State Ed Law 2-D & District Agreements
SportZens meets the strict criteria established by state-level student privacy laws, including the Student Online Personal Information Protection Act (California SOPIPA) and New York State Education Law § 2-D.
School District Inquiries & Data Privacy Agreements (DPA)
Need a customized district Data Privacy Agreement (DPA), Student Privacy Pledge addendum, or vendor review submission?