Privacy & Security

Nonprofit Uses Halloween Run-Up to Showcase ‘Scary’ Privacy Issues in Learning Apps

By Alyson Klein — October 20, 2023 4 min read
Glowing laptop with generic apps in the background with flying bats and ghosts and floating pumpkins.
  • Save to favorites
  • Print

If a lack of data privacy in apps aimed at K-12 students has you cowering under the covers, Learn21, a nonprofit organization that works with schools on education technology, has just the Halloween tribute for you.

The organization asked educators to nominate apps whose privacy policies seemed particularly ghoulish.

Then, Stacy Hawthorne, Learn21’s chief academic officer, took a close look at each of their privacy policies, flagging some of the most popular apps that, in her view, had especially frightening privacy problems. She’s now rolling them out, one by one, on social media during October, which Learn21 has dubbed “Scary App Month.”

And despite the cute graphics of black bats and full moons accompanying each review, Hawthorne sees this as serious business. School districts accessed an average of 2,591 distinct ed-tech tools during the 2022-23 school year, according to a report from Instructure’s LearnPlatform.

“There’s no way that somebody [in each district] vetted 2,500 privacy policies,” Hawthorne said. “These are teachers saying ‘oh, I’m going to drop this app in.’ So we’re reading these privacy policies and saying ‘hey, here’s something that’s scary! Do you know this if you use this app?’”

But Roy King, the executive director of XtraMath, a math fluency platform Learn21 highlighted, wishes that the organization had reached out for an explanation before deeming his app “scary.”

“I have no problem picking on companies that share personal info,” he said. “They should be called out for it. But we’re in a different space.” (See below for Learn21’s critique of Xtra-Math and King’s response.)

Hawthorne explained the impetus behind the campaign and the organization’s methodology for choosing apps in a post on LinkedIn and a mass email to people who had signed up to be notified about Scary Apps. She wrote:

Scary apps is our student privacy awareness campaign. Our team reads each of the privacy policies that we post. If, in our judgment, we believe there’s anything in the privacy policy that would give us pause before using an app with students, the app is eligible for Scary Apps. If we choose to post an app, we generally quote from the privacy policy to be as accurate as possible. In some cases, it’s difficult to do that in a short and spooky way to fit the format of Scary Apps.
The goal of Scary Apps is for districts to have internal conversations and make their own well informed decisions about which apps are best for their students. Some of the apps we post are ones that we use everyday, but we’re adults. There’s another level of responsibility that comes from making decisions about which apps to require students to use.
We’ve had folks, including app owners, question our methodology. Since we believe that the best privacy policies are transparent, we wanted to share our methodology with you publicly. There is no financial motive for Scary Apps. In fact, we’ve put in extra hours to make this happen since our team was already working on other projects. We believe in education and providing educators with the knowledge they need to protect their students. We hope you’ve enjoyed Scary Apps and, more than anything, we hope that Scary Apps sparked a conversation or two in your district.

Here’s a look at some of the apps Learn21 has been highlighting during “Scary” App Month. Education Week reached out to each company and included their response to Learn21’s critique:


This app is designed to “improve math fact fluency but the privacy policy specifically states that it’s not intended for use by students under 13" and therefore subject to certain privacy laws, according to the Learn21 critique. That’s puzzling, Hawthorne wrote, given that “math fluency typically develops between kindergarten and 4th grade, where students are under age 13.”

The response: XtraMath is, for its part, troubled by Learn21’s reading of its privacy policy. It’s clear that a parent or teacher can create accounts for students under the age of 13, King explained. The app doesn’t share data with third parties, or advertise. It complies with all privacy laws. And it’s a nonprofit, King said.


This presentation app is a “creative fave” but it could “end up being more of a trick than a treat for K-12,” says the Learn21 app critique. "[Its] privacy policy allows personal info to be used for targeted marketing and it can’t guarantee that a user’s data will remain in the United States. They do require parental consent for anyone under 16 but they don’t appear to track consent.”

Response: SlidesCarnival is owned by Canva, but it’s a separate platform meant for the general public, and can be used without providing personal information. The company encourages teachers and students to choose Canva for Education instead, which has many free features and is specifically designed for classrooms.

American Heritage Dictionary

“The word of the day is ‘frightful’ if you create an account on,” the Learn21 critique says. “They use personal information to create targeted ads and will share your information with third parties.”

Response: Education Week did not receive a response.

To be clear, Hawthorne and Learn21 aren’t necessarily saying that these apps don’t have merit. In fact, they describe some on the list as favorites. They’re simply trying to flag privacy problems.

In some cases, Hawthorne has explained how to use an otherwise scary app safely. For instance, Learn21 admits to being “huge fans” of the graphic design app Canva and notes that the company has signed on to the National Data Privacy Agreement. But Canva allows students to share what they’ve created with people—including adults—outside the school.

In fact, one student shared their work with an adult outside the school who might have had “malicious intent and their subsequent communications resulted in police involvement,” Hawthorne said. But districts can avoid this problem by emailing and asking to have external sharing disabled.

Scary Apps has been so popular that Hawthorne is considering bringing it back next October—and maybe finding other monthly themes to highlight problematic or useful ed tech.

The only downside for Hawthorne, a former teacher, principal, and ed-tech director? Just how much she personally has been identified with the project.

“I’ve done really meaningful work in education and I’m forever going to go down as the Scary Apps Lady,” she joked.


This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Student Well-Being Webinar
Attend to the Whole Child: Non-Academic Factors within MTSS
Learn strategies for proactively identifying and addressing non-academic barriers to student success within an MTSS framework.
Content provided by Renaissance
Classroom Technology K-12 Essentials Forum How to Teach Digital & Media Literacy in the Age of AI
Join this free event to dig into crucial questions about how to help students build a foundation of digital literacy.

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Privacy & Security Quiz
Quiz Yourself: How Much Do You Know About Cybersecurity For Schools And Districts?
Answer 6 questions about actionable cybersecurity solutions.
Content provided by FlexPoint Education Cloud
Privacy & Security What Schools Need to Know About These Federal Data-Privacy Bills
Congress is considering at least three data-privacy bills that could have big implications for schools.
5 min read
Photo illustration of a key on a digital background of zeros and ones.
Privacy & Security A New Federal Taskforce Targets Cybersecurity in Schools
The “government coordinating council" aims to provide training, policies, and best practices.
3 min read
Illustration of computer and lock.
iStock / Getty Images Plus
Privacy & Security Q&A Why One Tech Leader Prioritizes Explaining Student Data Privacy to Teachers
Jun Kim, the director of technology for an Oklahoma school district, helped build a statewide database of vetted learning platforms.
3 min read
Jun Kim, Director of Technology for Moore Public Schools, poses for a portrait outside the Center for Technology on Dec. 13, 2023 in Moore, Okla.
Jun Kim, is the director of technology for the Moore school district in Moore, Okla., He has made securing student data a priority for the district and the state.
Brett Deering for Education Week