Full privacy evaluation | See all
Thumbnail
Updated February 20, 2019

Achieve3000 Literacy Solutions

  • Privacy polices do indicate a version or effective date.
  • Data are not sold or rented to third parties.
  • Unclear whether data are shared for advertising and/or marketing.
  • Unclear whether this product displays behavioral or contextual advertising.
  • Data are collected by third-party advertising or tracking services.
  • Unclear whether this product uses data to track and target advertisements on other third-party websites or services.
  • Unclear whether this product allows third parties to use data to create ad profiles, data enhancement, and/or targeted advertisements.
The criteria for "Use with Caution" are narrowly focused around data uses related to creating profiles that aren't related to any educational purpose, and using data to target ads. We include both first party (ie, the vendor that builds the service) and third party (any company given access by the vendor) data use. It's worth highlighting that using data to profile students violates multiple state laws, and in some cases also violates federal law.

A service can be designated "Use with Caution" for either a lack of transparency around data use -- which creates the potential for profiling and behavioral targeting -- or for clearly stating that they use data to target advertisements and/or create profiles. As with any application being considered for use within schools, school and/or district staff should review the privacy policies and terms of service to ensure that they meet the legal and practical requirements of their state laws and school policies.

As with the "Not Recommended" criteria, a "Use with Caution" designation is NOT a sign that a vendor is necessarily doing anything unethical or illegal. It is a sign that, based on publicly available policies,  we do not have adequate guarantees that data will not be used by first or third parties to create non-educational profiles or to target behavioral ads.
Use with Caution
Full evaluation
48
Overall Scoreinfo-bubble

This overall score represents how the service addressed all our evaluation questions. A higher score (up to 100) means the service provides more transparent and comprehensive policies.

Overview

Achieve3000 provides a cloud-based service for nonfiction reading and writing that maps student work to that student's reading level. The terms of Achieve3000 specify that users can access "interactive services" that include chat rooms and online bulletin boards. The terms also specify that Achieve3000 does not rent or sell data to third parties. In addition, Achieve3000 may work with business partners to improve their services and that these business partners may receive aggregate or anonymized data. Achieve3000 makes reasonable efforts that include physical, administrative, and technical safeguards to keep data secure. In addition, the terms state personal information is protected by the most current version of Transport Layer Security (TLS) encryption and data are stored in encrypted file systems with the encryption keys stored and maintained in separate secured systems. As noted in the Security section and in the terms, accounts are only available via participating schools, districts, or educational agencies. The terms also specify that schools and districts often sign a "School District Agreement" that contains additional provisions governing the use of the service.

Achieve3000 can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Use accessed for this evaluation can be found on Achieve3000’s website, iOS App Store, and the Google Play Store. Additionally, other policies used for this evaluation include: Data Processing Addendum, and Technical and Organizational Measures. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Read the Common Sense standard privacy report (SPR)arrow
The standard privacy report (SPR) displays the most important privacy practices from a product’s polices in a single easy-to-read outline. The report displays an alert when a particular privacy practice is risky, unclear, or not evaluated. This alert indicates more time should be focused on these particular details prior to use.
SafetyPromoting responsible use
arrow
Evaluating safety takes into consideration best practices that protect a user's physical and emotional health. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to safety.
21

The terms of Achieve3000 specify that users can access "interactive services" that include chat rooms and online bulletin boards. Use of these interactive services is governed by a code of conduct that is included in the terms. Achieve3000 is not obligated to monitor any social interactions, but may monitor interactions at their discretion. The terms also specify that the code of conduct is based on state and federal laws, and Achieve3000 states that they have "the right at all times to disclose information it deems necessary to satisfy any applicable law."

PrivacyProtecting collected information
arrow
Evaluating privacy takes into consideration best practices that protect the disclosure of a user's personal information. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to privacy.
41

The terms specify that Achieve3000 does not rent or sell data to third parties. The terms also state that Achieve3000 can work with business partners to improve their services and that these business partners can also receive aggregate or anonymized data. However, the terms do not specify limits placed on partners receiving this data.

The terms also state that the service can be connected with third party providers such as Facebook or Google, and that Achieve3000 can receive information from these services. However, the terms do not provide details about what information could be collected from these services. The terms also state that Achieve3000 may allow third-party service providers to place and read their own cookies, web beacons, and similar technologies to track users and collect information.

SecurityProtecting against unauthorized access
arrow
Evaluating security takes into consideration best practices that protect the integrity and confidentiality of a user's data. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to security.
88

Achieve3000's terms specify that student data should be provided in an "electronic form (.CSV comma separated values or .XLS Excel format) regarding each student who will utilize each Service." The pre-set sample rosters used to generate these lists include fields for student IDs, student first and last name, email address, password, gender, and grade level.

The terms also state that Achieve3000 makes reasonable efforts that include physical, administrative, and technical safeguards to keep data secure. In addition, the terms state personal information is protected by the most current version of Transport Layer Security (TLS) encryption and data are stored in encrypted file systems with the encryption keys stored and maintained in separate secured systems. The terms contain detailed information about regular security audits additional security protections. Lastly, the terms contain an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incident, and notification of users without undue delay after becoming aware of the security breach.

ComplianceFollowing statutory laws and regulations
arrow
Evaluating compliance takes into consideration best practices of companies that collect personal information from children or students and the legal obligations for the privacy and security of that information. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to compliance.
48

As noted in the Security section and in the terms, accounts are only available via participating schools, districts, or educational agencies. The terms also specify that schools and districts often sign a "School District Agreement" that contains additional provisions governing the use of the service. The contents of different School District Agreements are outside the scope of this evaluation as they are not publicly available, and can vary between districts. Ideally, these agreements would be publicly available, consistent across districts, and address requirements and responsibilities under FERPA and COPPA. However, Achieve3000 does include a Data Processing Addendum (“DPA”) as part of its Terms of Service.

About Privacy Evaluations

The privacy evaluations have been designed with the help and support of a consortium of schools and districts across the United States. These evaluations are designed to streamline making an informed decision about the potential privacy implications of educational technology used to support teaching and learning.

Our core evaluation criteria are freely available and will remain freely available. People are encouraged to read the questions we use and the information security primer we released. Vendors are encouraged to use our questions and the information security primer to self-evaluate. You can also learn more about our evaluation process.

Please be in touch with any questions or feedback.