Everything you need to review before adopting Runestone Academy — our privacy, security, accessibility, and terms documentation, in one place. These pages are public and their URLs are stable, so they are safe to cite in an RFP, adoption review, or data privacy agreement.
What data we collect, how we use and protect it, and your rights (FERPA,COPPA, GDPR, CCPA, data retention and deletion).
Last updated: July 2026The terms and conditions governing your use of Runestone Academy, including licensing, content rules, and liability.
Last updated: August 16, 2019Our administrative, technical, and operational safeguards for protecting data, incident response, and alignment with the NIST Cybersecurity Framework.
Last updated: August 2025Our commitment to accessibility and our WCAG 2.1 AA Voluntary Product Accessibility Template (VPAT/ACR).
Last updated: January 2026Runestone does not provide a HECVAT as it is intended for much larger organizations.
We already signed the NDPA in many states! Please check with your state alliance to see if your state already has a signed NDPA.
The NDPA version 2 has been developed by the 28 state Alliances addressing common obligations across the U.S. as well as their specific state needs. Version 2 incorporates feedback from Alliance leaders and Vendor Community Members, and has been reviewed by legal representatives through A4L Community Member Review. It is designed to address common student data privacy concerns and streamline the educational application contracting processes for schools/districts who do not have the legal or fiscal resources and vendors who previously had to sign “one off” contracts with each of the over 13,000 US school districts.
Related: About Advertising. State-specific addenda to the Terms of Service are linked from the Terms of Service. For security or compliance questions, contact [email protected].