knovli
← Back to the app
Privacy Policy
Knovli, a product of Harborframe Labs LLC, is committed to protecting user and student privacy.
1. Children's Privacy (COPPA)
- We do not knowingly collect personal information from children under 13.
- The Service is not directed to children under 13.
- Account registration requires a date-of-birth screen; users under 13 cannot register an individual account.
- Schools and districts may onboard students under 13 only under a written Data Privacy Agreement (see §5) and only as agents of the school for educational purposes (see §4).
- Parents may contact us to request review or deletion of their child's data at support@harborframelabs.com.
2. Information We Collect
A. Information You Provide
- Name (optional)
- Username
- Date of birth (used for the COPPA age screen; year retained, full DOB not displayed)
- School affiliation (if provided)
- Avatar image (if uploaded)
B. Automatically Collected
- Device type and browser
- IP address (used for security, regional content, and abuse prevention)
- Usage data (features used, session timing)
- Learning activity and performance records
- Advertising identifiers (non-school accounts only — disabled for any account flagged as a student)
- Visit analytics data — referral source, campaign tags, and first page viewed, recorded via a random browser identifier (see §2C below)
C. Visit Analytics
When you visit Knovli, we record how you arrived — for example, the website or social platform that linked to us, and any campaign tags in that link — along with the first page you viewed. We use a random identifier stored in your browser for this purpose, not your name or email, and we do not store your IP address for visit analytics.
If you create an account, we link where you first came from to that account so we can understand which ways of finding Knovli help people most. We use this information only to improve how we reach new users.
We never collect visit analytics data for accounts belonging to children under 13 or for accounts created through a school.
If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we do not record any visit analytics for that session.
3. How We Use Information
We use data to:
- Operate and improve the Service
- Provide core learning and knowledge features
- Maintain security and prevent abuse
- Deliver advertisements (non-school accounts only)
- Understand how users discover Knovli, so we can reach more learners (non-school, non-under-13 accounts only; see §2C)
- Comply with legal obligations
4. Student Data Protections (FERPA + State Student Privacy Laws)
When a school or district designates Knovli as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (34 CFR § 99.31(a)(1)(i)(B)), Knovli is bound by FERPA's restrictions on the use and re-disclosure of student education records. Designation is established by the Data Privacy Agreement described in §5; absent that designation, Knovli does not assume FERPA "school official" status unilaterally.
For accounts onboarded by a school, Knovli commits that:
- Student data is processed only for the educational purposes authorized by the school.
- Ownership of student data remains with the school or district.
- We do not sell student personal information.
- We do not use student data for targeted or behavioral advertising.
- We do not build non-educational profiles of students.
- We do not collect visit analytics data on school accounts (see §2C).
- We delete student data within 45 days of a verified school request, or on contract termination, whichever is sooner.
5. Data Privacy Agreements (DPA) for Schools
Schools and districts may request a written Data Privacy Agreement before adopting Knovli. We respond to DPA requests, including:
- Student Data Privacy Consortium (SDPC) National DPA-style templates,
- State-specific supplements (e.g., New York Education Law § 2-d Parents' Bill of Rights, Illinois SOPPA Exhibit, California AB 1584 addenda),
- District-supplied DPA templates.
To request a DPA or supplemental information, email support@harborframelabs.com.
6. SOPIPA Compliance (California)
For California K-12 users:
- No targeted advertising using student data.
- No sale of student information.
- No non-educational profiling.
- No visit analytics collection on school accounts.
- Data deletion upon school request.
7. Multi-State Student Privacy Compliance
Knovli complies with applicable student data privacy statutes in states including but not limited to:
- California (SOPIPA, AB 1584)
- Colorado (HB 16-1423)
- Connecticut (Public Act 16-189)
- Virginia
- Utah (Student Data Protection Act)
- Texas (TX Ed Code § 32.151)
- Illinois (SOPPA, 105 ILCS 85)
- New York (Education Law § 2-d)
Where required by state law, we:
- Limit data use to educational purposes
- Prohibit sale of student data
- Implement reasonable security safeguards
- Honor deletion requests
8. U.S. State Consumer Privacy Rights
Residents of certain states (including California, Virginia, Colorado, Connecticut, and Utah) may have rights to:
- Access personal data
- Request deletion
- Request correction
- Opt out of targeted advertising and the sale or sharing of personal information
- Opt out of visit analytics linking (where applicable under your state's law)
To exercise these rights, including the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising under the California CPRA, submit a request to support@harborframelabs.com or use the Do Not Sell or Share My Personal Information link in our footer.
We do not sell personal information for monetary consideration. We may share limited identifiers with advertising partners on non-school accounts; you may opt out using the link above. Sending a Global Privacy Control signal from your browser will also automatically stop visit analytics collection for that session.
9. GDPR (EEA & UK Users)
If you are located in the EEA or UK, our legal bases for processing are:
- Contractual necessity
- Legitimate interest (including visit analytics for non-school, non-under-13 users, where we rely on a minimal-data approach using a random browser identifier with no IP storage)
- Consent (where required)
You may:
- Access your data
- Request deletion
- Object to processing
- Request portability
10. Sub-Processors & Third Parties
We rely on the following sub-processors to operate the Service. Schools may request the most current sub-processor list at any time.
- Google Cloud / Firebase (USA) — authentication, Firestore database, Cloud Functions, Cloud Storage, Hosting, push notifications.
- Google AdSense and AdMob (USA) — advertising on non-school accounts only. Disabled for any account marked as a student via entitlements.
- Cloudflare, Inc. (USA) — bot/abuse protection and email-address obfuscation on public pages.
Note to drafter: The visit analytics feature described in §2C uses a random browser identifier. Please verify which specific analytics tool or service (if any, beyond first-party logging) processes this data, and add it to the sub-processor list above if applicable.
We do not control third-party privacy practices. Users may manage ad preferences through device settings or Google Ad Settings.
11. Data Security
We implement reasonable administrative, technical, and physical safeguards including:
- Encrypted transmission (HTTPS/TLS)
- Secure authentication (Firebase Authentication, optional 2FA)
- Role-based access controls
- Restricted database permissions (Firestore Security Rules)
12. Accessibility
Knovli aims to conform to WCAG 2.1 Level AA and supports school accessibility requirements under Section 504 of the Rehabilitation Act and Title II of the Americans with Disabilities Act (ADA). We continue to improve keyboard navigation, color contrast, and screen-reader support throughout the Service.
If you encounter an accessibility barrier or need an accommodation, contact support@harborframelabs.com with the page URL and a description of the issue. We respond within 5 business days.
13. Data Retention
We retain data only as long as necessary for:
- Account functionality
- Legal compliance
- Security and dispute resolution
Visit analytics referral data linked to an account is retained only as long as the account is active and is deleted along with the account upon a verified deletion request. The random browser identifier used for pre-account visit analytics is not retained beyond the session in which an account is created; if no account is created, it is not stored on our servers.
Users may request deletion. Student records are deleted within 45 days of a verified school request or on contract termination.
14. Data Breach Notification
In the event of a data breach involving personal data or student information, we will notify affected schools and users without undue delay and as required by applicable law (including state-specific timelines).
15. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be announced via the Service.
Continued use constitutes acceptance.
16. Contact Information
Harborframe Labs LLC
2108 N St #4103
Sacramento, CA 95816
USA
626-692-5926