Security & Privacy

FERPA & Data Privacy

Your district decides which tools may hold student records. REDAssist is built to make that decision simple: it runs in your browser, saves to your device, and never sends student information to a FarPoint server. Google backups are optional, and they go to your own account.

The whole picture

Where your work lives

REDAssist data can be in three places. The first is automatic. The other two happen only when you choose them.

Always

This browser, on this device

Your caseload saves automatically to the browser you're using. It stays on that computer, doesn't sync anywhere on its own, and is erased if you clear the browser's site data.

Your choice

Backup files you save

Download a backup whenever you like. It's a .json file, and you decide where it's stored. Restore it on any computer, no account needed.

Optional

Your own Google account

Connect only if you want to. Automatic backups go to a hidden app folder in your Drive, and contact-log entries sync to a Google Sheet there. Docs and Gmail drafts are created in your account only when you click those buttons.

There is no FarPoint server

REDAssist has no database and no server of its own. FarPoint never receives, stores, or sees student information. The website only delivers the app's program files to your browser.

Built in

How REDAssist protects your work

Privacy means little if the work itself can vanish. These safeguards keep your caseload where you put it, and keep it intact.

  • Keeps working offline

    Once it's open, REDAssist runs with no internet connection, and no Google account is required.

  • Saves as you work

    Every change saves to your device automatically. No save button, nothing to remember.

  • Automatic Drive backups, if you connect

    Each caseload keeps a rolling copy, an hourly copy, and a four-hour copy, plus up to three manual backups. They update when you open a caseload, every ten minutes, and when you close the tab.

  • Caseloads never mix

    Each caseload has its own storage and its own backups. Nothing in one can overwrite another.

  • You choose what opens

    Every session starts at the caseload picker. Nothing loads until you pick it.

  • Restores you can undo

    A restore asks first, then keeps a snapshot of your current work. Undo restore brings it back until your next edit.

  • Failures are loud, never silent

    If saving to the device ever fails, a banner stays on screen with a one-click download of your current work.

  • Damaged data is preserved

    If stored data can't be read, REDAssist stops, keeps the original intact, and walks you through restoring from a backup.

  • One editor at a time

    A second tab opens read-only, so two windows can't overwrite each other.

  • Session-only Google sign-in

    The Google connection lives in memory and ends when you refresh or close the page. No sign-in token is saved on the device.

The REDAssist Backup and restore menu: back up caseload, restore from Drive, download caseload to hard drive, restore from local file, Storage Diagnostics, and connect Google Drive.
Every backup and restore option lives in one menu.

What's a .json backup file?

It's a plain-text file that holds your whole caseload, plus your action items, in an organized format that REDAssist can read back in. Any computer can open it; no account is needed.

Because it's plain text, it isn't encrypted. Treat it like any other student record: keep it where your district allows, don't email it, and leave student names out of the file name.

Federal privacy rules, in short

  1. FERPA and IDEA don't ban digital tools. They require schools to protect student records and to share them only in the ways the law allows.
  2. Your district decides which tools and accounts are approved. When an outside company holds student records, it generally has to work under the district's direct control, usually through a contract or data privacy agreement.
  3. REDAssist keeps that decision small. There's no FarPoint server to approve. The data stays on the device you use and, if you connect it, in your district-approved Google account.
More detail: what the regulations say Hide the detail

FERPA (34 CFR Part 99)

Schools may share personally identifiable information from education records without parent consent only under specific exceptions. The one that covers most technology is the school official exception: an outside party can count as a school official if it performs a service the school would otherwise use its own employees for, is under the school's direct control for the use and maintenance of the records, and follows FERPA's limits on reusing and redisclosing them.

Sources: 34 CFR § 99.31(a)(1) · 34 CFR § 99.33(a)

IDEA confidentiality (34 CFR § 300.623)

Each agency must protect the confidentiality of personally identifiable information when it is collected, stored, disclosed, and destroyed. One official is responsible for it, everyone who collects or uses it must be trained, and the agency keeps a list of the employees who may access it.

Source: 34 CFR § 300.623, Safeguards

Cloud services

The U.S. Department of Education's Privacy Technical Assistance Center (PTAC) publishes guidance on using cloud computing while meeting FERPA's privacy and security requirements.

Source: PTAC, Cloud Computing FAQ

What this means for Google Drive

If you connect Google, use the account your district approves for student records. That is usually your district-managed Google Workspace account, not a personal Gmail. District-managed accounts generally come with the district's agreement with Google; personal accounts don't.

State law and district policy

Many states add their own student privacy laws, and districts set their own rules for devices, storage, and approved software. Those apply on top of the federal rules.

This page explains how REDAssist handles data. It isn't legal advice. For a specific situation, check with your district's privacy officer or legal counsel. Last reviewed October 2026.

Questions about privacy or district approval?

I'm happy to walk your team or your privacy officer through how REDAssist handles data.