Parents’ Bill of Rights for Data Privacy and Security

New York Education Law §2-d gives parents rights about their children’s data. Here is how those rights apply to Mighty Mathletes, plus the information schools need from us.

Last updated October 19, 2026

Your rights

A student’s personally identifiable information (PII) cannot be sold or released for any commercial or marketing purpose.
Parents have the right to inspect and review the complete contents of their child’s education record, including any student data stored or maintained by their school or district. Ask your child’s school, or contact us and we will help the school provide it.
State and federal laws, such as New York Education Law §2-d and the Family Educational Rights and Privacy Act (FERPA), protect the confidentiality of students’ PII. Safeguards that meet industry standards and best practices, including encryption, firewalls and password protection, must be in place when data is stored or transferred.
A complete list of all student data elements collected by New York State is available for public review at nysed.gov, or by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234.
Parents have the right to have complaints about possible breaches or unauthorized disclosures of student data addressed. Complaints can be made to your school or district, or to the NYSED Chief Privacy Officer using the online complaint form. You can also contact us directly.
Parents have the right to be notified, as the law requires, if there is a breach or unauthorized release of their child’s PII.
Everyone at Mighty Mathletes who handles student PII receives training on the laws, policies and safeguards that protect it.

Supplemental information about Mighty Mathletes

As a third-party contractor to schools, we provide the following information, which is also included in our data privacy agreements. How we protect the data is described in full in our Data Security and Privacy Plan.

Exclusive purposes: Student data is used only to provide Mighty Mathletes to the school: sign-in, math practice and games, lessons, progress reports for teachers and parents, and keeping the service secure. It is never sold, never used for advertising and never used for any other purpose.
Subcontractors: We use Supabase (database and sign-in), Netlify (website hosting), and, if the school chooses, ClassLink (sign-in). Each is bound by written terms to protect the data, use it only to provide its service to us, and meet security requirements at least as strict as ours.
When the agreement ends: Our agreement with a school lasts for the term in the school’s contract. When it ends, we delete all of the school’s student data within 30 days, or return it to the school first if it asks. Backups are erased as they roll off within 30 days. We confirm deletion in writing on request.
Challenging the data: A parent, student, eligible student, teacher or principal may challenge the accuracy of student data by contacting the school, which can correct it in its Mighty Mathletes dashboard, or by contacting us.
Where data is stored and how it’s protected: Student data is stored in secure, access-controlled data centers operated by our database provider. It is encrypted in transit (HTTPS/TLS) and at rest. Each school’s data is separated from every other school’s, and every request is checked by our server.
Breach notification: We will notify the school within 7 calendar days of discovering any breach or unauthorized release of its student data, and cooperate fully with the school.
How long data is kept: Activity logs are cleared every week. Accounts unused for a year are deleted with all their data. A school can delete any student at any time from its dashboard.