Privacy Policy

1. Who we are & what this covers

BookIsles (“BookIsles”, “we”, “us”) provides a leveled, read-aloud library of illustrated books used by schools, teachers, and homeschool families to help early readers learn to read. This Privacy Policy explains what information we collect through bookisles.com and the BookIsles service (the “Service”), how we use it, and the choices and rights you have.

Because children use the Service, we hold ourselves to a high standard: we collect the minimum information needed to run an educational reading program, we never sell personal information, and we never show advertising to children.

2. Information we collect

Accounts for adults (teachers, parents, school administrators, staff)

• Name and email address, provided when you sign in with Google or create an account with an email and password (authentication is handled by our provider, Neon Auth).
• Your role (e.g. teacher, parent, school admin) and, for school accounts, your organization.

Students (children)

• A display name and a username, created by the child’s teacher or parent — children do not provide an email address and sign in with a class or family code plus a username and password.
• Reading activity: which books were opened, reading progress and time, and comprehension-quiz results.
• Optional voice recordings: if a child uses the “Record my reading” feature, we capture a short audio recording of them reading a page so it can be scored for reading accuracy and, if enabled, reviewed by their teacher.

Automatically collected

• Basic technical data needed to operate and secure the Service (e.g. log data, device/browser type). We do not use third-party advertising trackers.

3. How we use information

We use personal information only to provide and improve the Service, including to:

• Create and secure accounts and authenticate sign-ins;
• Deliver leveled books, narration, and reading modes to the right reader;
• Show teachers and parents a child’s reading progress and comprehension results;
• Score recorded readings for reading accuracy;
• Provide customer support and keep the Service safe (e.g. moderation of content before it reaches a child);
• Comply with legal obligations.

We do not use student personal information to build advertising profiles, and we do not sell personal information to anyone.

4. Children’s privacy (COPPA)

The Service is designed for use by children under 13 within a school or family setting, and we comply with the U.S. Children’s Online Privacy Protection Act (COPPA).

Children never create their own accounts directly. A child’s account is created by their school or by their parent, and a child signs in with a class or family code rather than an email address.

• School consent: When a school or district uses BookIsles for classroom instruction, the school may provide consent on behalf of parents for the collection of students’ personal information used solely for the educational purpose, consistent with COPPA’s school-consent provisions.
• Parental consent: When a homeschool parent creates a child’s account, the parent provides consent and controls the child’s information directly.
• Data minimization: We collect only what is needed for the reading program — a display name/username, reading progress, quiz results, and (optionally) a reading recording.
• Review and deletion: A parent, or a school on a parent’s behalf, may review the personal information collected from their child, refuse further collection, and request its deletion by contacting us (see “Contact” below).

We do not condition a child’s participation on disclosing more information than is reasonably necessary, and we do not enable children to publicly share personal information.

5. Schools & student education records (FERPA)

When a school or district uses BookIsles, the school controls its students’ data and BookIsles acts as its service provider. To the extent student information constitutes an “education record” under the U.S. Family Educational Rights and Privacy Act (FERPA), BookIsles acts as a “school official” with a legitimate educational interest, under the direct control of the school.

• We use student personal information only to provide the Service to the school and under the school’s direction — not for our own purposes.
• We do not sell student data, use it for advertising, or re-disclose it except as directed by the school or as required by law.
• The school retains ownership of and control over its student records and may request access, correction, export, or deletion at any time.
• A data processing agreement (DPA) is available for schools and districts on request.

6. Service providers we use

We share information with a small set of vetted providers who process it on our behalf to run the Service. They are contractually limited to using it only to provide their service to us:

• Neon — database hosting and authentication (account data).
• Vercel — application hosting and file/blob storage (book and audio files), and transactional email delivery.
• Deepgram — speech-to-text used to score a child’s recorded reading. When the “Record my reading” feature is used, the recording is sent to Deepgram for transcription/scoring.
• ElevenLabs — text-to-speech used to generate book narration (this processes book text, not student personal information).
• AI content providers (e.g. for story and illustration generation) — these process book content we create, not student personal information.

A current list of subprocessors is available to schools on request.

7. How we share information

We do not sell personal information. We share it only: (a) with the service providers above; (b) within a school or family, so that a teacher or parent can see the children they are responsible for; (c) if required by law or to protect the safety of a child or the Service; or (d) in connection with a business transfer, subject to this Policy. Authors and content staff never see student personal information — access is restricted at the system level.

8. Data security

We protect information with industry-standard measures, including encryption in transit (HTTPS), role-based access controls so users only see what they are permitted to, provider credentials kept server-side and never exposed to browsers, and human moderation of content before it is published to children. No method of transmission or storage is 100% secure, but we work to protect your information and continually improve our safeguards.

9. Data retention & deletion

We keep personal information only as long as needed to provide the Service or as required by law. A school or parent may request deletion of a child’s account and associated data at any time; upon a verified request we will delete or de-identify it within a reasonable period, except where retention is legally required.

10. Your choices & rights

Depending on your location, you may have rights to access, correct, export, or delete personal information, and to object to or restrict certain processing. Parents and schools may exercise these rights on behalf of a child. To make a request, contact us using the details below; we will verify your request before acting on it.

11. International users

BookIsles is operated from, and information is processed in, the United States and other locations where our providers operate. If you access the Service from outside these regions, you consent to processing in those locations, with appropriate safeguards where required.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, notify schools and account holders. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact us

For any privacy question or request — including to review or delete a child’s information — contact us at privacy@bookisles.com. Schools may also request our data processing agreement and subprocessor list at this address.