Student data privacy

Last updated: 8 November 2026

This page sets out what RunCode Inc ("we"), which runs The Skill Site, commits to every school, college, university and other organisation that teaches students with it (the "institution"), under the US Family Educational Rights and Privacy Act (FERPA) and Children's Online Privacy Protection Act (COPPA), and the UK GDPR and the Information Commissioner's Age Appropriate Design Code (the Children's code). It adds to our Terms of Service and Data Processing Agreement, which every institution accepts when it signs up; where this page protects students more, it applies.

The institution controls student data

Student records in The Skill Site belong to the institution that put them there. We process them only to provide the service, on the institution's instructions, as its processor under the Data Processing Agreement. We never own them, and we never use them for anything of our own.

FERPA

  • For an institution that FERPA covers, we act as a school official with a legitimate educational interest, under the institution's direct control of how we use and keep education records (34 CFR 99.31(a)(1)(i)(B)).
  • We use education records only to provide the service the institution uses. We disclose them to no one else, except the sub-processors in the Data Processing Agreement's Schedule 3 doing that work for us, under contracts no weaker than ours, or where the law requires it; then we tell the institution first unless the law forbids it.
  • Parents and eligible students ask the institution to see or correct their records. Its staff can show and export a student's work, grades, attendance and reports, and we help with anything they cannot do themselves.
  • When the institution's subscription or free plan ends, its staff can export everything for 60 days; then we delete its students' records and files, and backup copies within a further 14 days.

COPPA

  • A school that uses The Skill Site with pupils under 13 may consent for their parents, for the school's educational purpose only, as the Federal Trade Commission's guidance allows. We use what we collect from those pupils for that purpose alone: never for advertising, never to build a commercial profile, and never sold.
  • The school can ask us at any time to delete a pupil's records, and a parent can ask the school to review them or stop their use.
  • Where an organisation teaches children outside school, such as a music teacher or tutor, the parent consents themselves before anything about the child is kept, as our Privacy Policy describes; the child uses the parent's account, and the parent can withdraw consent, which erases the child's records once no organisation holds it.

The UK GDPR and the Children's code

  • The institution is the controller and we are its processor, under the Data Processing Agreement and, for data that leaves the UK, the ICO's International Data Transfer Agreement it includes.
  • We follow the Children's code's standards for every learner: privacy by default, no profiling except for the teaching the institution provides, no location tracking and no nudges to give up more data. What would send a student's work outside The Skill Site (AI hints, an LMS, a learning record store) is off until the institution turns it on, and children taught under a parent's consent never get AI hints.

What we commit to

  • We never sell student data, and never share it for anyone's marketing.
  • No advertising in The Skill Site, targeted or otherwise. Google Analytics never loads for anyone signed in; it runs only on our public pages, for visitors who have not opted out.
  • AI hints, where the institution turns them on, are written by Anthropic from the question, the student's code and its output, with no names or email addresses; Anthropic does not train its models on them. Each student gets at most 100 a month, and staff see every hint. AI never decides a grade.
  • Students' code runs on our code runner in Finland, which receives no names or email addresses. Everything else is held in Amazon Web Services in the United States (N. Virginia), and our staff reach it from India.
  • Data is encrypted in transit and stored files at rest; each institution's records are kept apart, and an automated test checks on every change that no institution can reach another's. The Data Processing Agreement's Schedule 2 lists the security measures.
  • We tell the institution of a personal data breach affecting its students within 48 hours of becoming aware of it.
  • We give the institution 30 days' notice by email before adding a sub-processor, and before any change to these terms that reduces students' protection.

Signing your agreement

We review and sign a school district's, school's or university's own student data privacy agreement, such as the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) or a state's data privacy agreement. Send it to hello@theskillsite.com, and we answer with a signed copy or the changes we need.

Contact

Questions about students' data, or a signed copy of our Data Processing Agreement: hello@theskillsite.com