Security & Privacy

FERPA & COPPA alignment

We act as a school official with legitimate educational interest under FERPA. For users under 13 we operate under verified school-granted parental consent in accordance with COPPA. We never sell student data, never serve advertising, never train AI models on student data, and never build behavioral profiles outside of authorized educational purposes. Schools own the data — export, audit, or delete at any time via API or admin console.

CIPA + AI tool firewall

Six CIPA categories — adult content, violence, gambling, hate speech, illegal activity, AI tools — filtered with keyword + domain + regex rules, audit-logged. Trusted SSO domains (accounts.google.com, login.microsoftonline.com, login.live.com, appleid.apple.com, clever.com, launchpad.classlink.com, sso.classlink.com) are explicitly allowlisted so logins never false-positive.

Beyond CIPA, BobbyBrowser ships a dedicated AI tool firewall that blocks ChatGPT, Gemini, Claude, Perplexity, Copilot, Quillbot, Grammarly, Grok, Poe, Character.ai, Bing, Writesonic, Jasper, Copy.ai, Hugging Face, Mistral, Groq — plus the proxy bypass routes (translate.google.com, archive.org, web.archive.org, webcache.googleusercontent.com, croxyproxy.com). We also hide Gemini affordances inside Gmail / Google Workspace / YouTube and force Google Search into web-only mode (udm=14).

Academic-integrity & safety monitoring

Bobby's tutor detects and flags AI-tool usage, plagiarism, prompt-injection and jailbreak attempts, requests to write essays or hand over direct answers, off-topic drift, and inappropriate content such as offensive language or harassment. Each signal carries a severity score: higher-severity events surface to teachers in real time, while lower-severity signals are batched for review.

Data retention & deletion

Educational records are retained for 7 years, consistent with FERPA § 99.32. Messages and AI chat conversations are retained for 90 days, after which they are anonymized. System and application logs are retained for 90 days, and backups for 35 days. Account data is retained until a deletion request is processed. Schools, teachers, and parents can request export or deletion of student data at any time, handled through our data-export and data-deletion endpoints and the admin console, and we action verified requests within 30 days, subject to legal retention obligations. The full schedule is in our Privacy Policy.

Security practices

• Breach notification: within 72 hours of confirmation.
• Frequent internal security reviews of code, dependencies, and access.