Scratch Foundation
Round 1 · Privacy Triage · Privacy Triage — Round 1 · assessed
🔴 Do Not Approve
Privacy score 94.3% · band Best
Hard no: the vendor explicitly does something disqualifying — Q16 (AI & Model-Training). An explicit gate violation beats the privacy score. Scope note: 1 question(s) in the current rubric were not assessed in this run — Q19 (Data Security). The evidence predates them, so they are excluded from the 94.3% rather than scored as silence. Re-run the extractor to close the gap.
Hard-fail gate(s): Q16 — an explicit disqualifying practice. This beats the privacy score.
Quote check: not run on this record. It was read before the check existed. Re-vet the vendor to run it.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection GATE |
| 100.0% |
| Data Sharing GATE ⚠ |
| 100.0% |
| Data Sold GATE |
| 100.0% |
| Data Rights GATE ⚠ |
| 100.0% |
| Data Safety GATE |
| 100.0% |
| Data Security | n/a | — |
| Ads & Tracking GATE |
| 100.0% |
| Parental Consent |
| 100.0% |
| School Purpose |
| 100.0% |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection/use of information to only data required for the product? GATE
✓ Good
T3
Answer: Yes
“Scratch collects only minimal information from its users, and only uses and discloses information to provide the services and for limited other purposes, such as research, as described in this Privacy Policy.”
Policy explicitly states minimal collection for service provision.
Q2Does the vendor collect PII beyond what's necessary for the stated educational purpose?
✓ Good
T3
Answer: No
“Scratch collects only minimal information from its users, and only uses and discloses information to provide the services and for limited other purposes, such as research, as described in this Privacy Policy.”
Policy states minimal collection, indicating no collection beyond necessary.
Q3Does the vendor collect a user's photo or any other visual likeness?
✓ Good
T3
Answer: No
“When you create an account, we ask you for a username and password, your country, gender, and your email address.”
No mention of image collection in account creation or general data collection sections.
Q4Does the vendor track a user's exact physical location (GPS-precision geolocation)?
✓ Good
T3
Answer: No
“When you use the Scratch Website, we infer your general location information, for example, by using your internet protocol (IP) address.”
Only general location via IP address; not precise geolocation.
Data Sharing
Q5Does the vendor limit data sharing with third parties to the purpose for which it was collected? GATE
✓ Good
T3
Answer: Yes
“We share Personal Information that we collect through the Scratch Website, if you consent to us doing so, in the following circumstances: Service Providers... To third parties who provide services such as website hosting, data analysis, information technology and related infrastructure provisions, customer service, email delivery, artificial intelligence services that provide backend support, and other services.”
Sharing limited to service provision purposes with consent.
Q6Does the vendor impose contractual limits on how third parties use shared personal information? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state contractual limits on third-party use of shared data.
Data Sold
Q7Is users' personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“Scratch does not disclose personal information of students to any third parties except as described in this Privacy Policy.”
Policy explicitly states no disclosure to third parties except as described; no mention of selling or renting data.
Data Rights
Q8Do the student / educator / parent / school retain ownership of data and IP of uploaded content? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly address ownership of uploaded content or IP rights.
Q9Can the user delete all of their PII and personal information from the vendor?
✓ Good
T3
Answer: Yes
“If you want to delete your account, login to Scratch, and then click your username in the top right-hand corner. Select "Account Settings," then click the "I want to delete my account" link at the bottom of the page. Deleting your account hides all Personal Information from public view, but does not remove all of your Personal Information from our servers. If you want to have all of your Personal Information removed from our servers, please contact help@scratch.org for assistance.”
Users can request complete deletion via help@scratch.org.
Q10Does the vendor auto-delete data after a defined period of inactivity (data sunset)?
? Not addressed
T0
Answer: Unclear
Policy does not mention automatic data deletion after inactivity period.
Data Safety
Q11Can students contact or interact with UNKNOWN users (strangers / the general public) in environments NOT supervised by a teacher or school? (Teacher-managed or within-class interaction, and content-only sharing, do NOT count.) GATE
✓ Good
T3
Answer: No
“We moderate content posted to the Scratch Website, including shared and unshared projects, comments, and forum posts to ensure that our Community Guidelines are respected.”
Content moderation and community guidelines suggest supervised/managed interaction; no mention of open contact with strangers.
Ads & Tracking
Q12Does the vendor display behavioral or targeted advertising to students inside the product? (Sending product/marketing emails to account holders does NOT count.) GATE
✓ Good
T3
Answer: No
“Scratch does not collect information from a student's education record, as defined by the Family Educational Rights and Privacy Act (FERPA). Scratch does not disclose personal information of students to any third parties except as described in this Privacy Policy.”
No mention of behavioral or targeted advertising to students; policy emphasizes student privacy protection.
Q13Does the vendor pass student personal information to outside companies for those companies' advertising or ad-targeting purposes? GATE
✓ Good
T3
Answer: No
“Scratch does not disclose personal information of students to any third parties except as described in this Privacy Policy.”
Explicit statement that student information is not disclosed to third parties for advertising.
Parental Consent
Q14For children 13 and under, does the vendor either restrict personal-information collection or first obtain parental/school consent?
✓ Good
T3
Answer: Yes
“Scratch takes children's privacy seriously. Scratch collects only minimal information from its users, and only uses and discloses information to provide the services and for limited other purposes, such as research, as described in this Privacy Policy.”
Policy emphasizes children's privacy and minimal collection; teacher accounts can create student accounts.
School Purpose
Q15Does the vendor state the product is intended for students in preschool or preK-12?
✓ Good
T3
Answer: Yes
“When you create a teacher account, we ask for a username and password, your phone number, birthdate, gender, country of residence, name, and details about your employer. When you create student accounts through your teacher account, we ask for a username, password, birthdate, gender, and country of residence.”
Policy explicitly addresses student accounts and teacher accounts for educational use.
AI & Model-Training
Q16Does the vendor use student/user data — including uploaded content — to train, fine-tune, or improve AI/ML models? GATE
✗ Concern
T3
Answer: Yes
“We use Personal Information that we collect on the Scratch Website, such as your location and your activities, to monitor and analyze usage of the Scratch Website and to enhance your learning experience, including by training AI tools to personalize features or recommendations on the Website.”
Policy states data is used to train AI tools for personalization.
Q17Does the vendor disclose which AI sub-processors/models power its features and any automated decisions affecting students?
? Not addressed
T0
Answer: Unclear
Policy mentions AI tools and automated technologies but does not disclose specific AI sub-processors, models, or automated decision-making details.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy regimes it complies with?
✓ Good
T3
Answer: Yes
“We may transfer your Personal Information to countries other than the country where you are located, including to the U.S. (where Scratch servers are located) or any other country in which we or our service providers maintain facilities. If you are located in the European Economic Area, the United Kingdom or Switzerland, or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer your Personal Information to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. Where we do so, we will comply with applicable data protection laws. In particular we will rely on (i) an EU Commission, UK or Swiss government adequacy decision, (ii) contractual protections for the transfer of your Personal Data, or (iii) another valid data transfer mechanism.”
Storage location and compliance regimes disclosed.
Data Security
Q19Does the vendor disclose baseline security safeguards — encryption of data in transit and at rest — and commit to notifying the school of a data breach?
? Not addressed
T0
Answer: not assessed
Jurisdiction & residency — your footprint
Vendor named 1 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“Scratch servers are located in the U.S. (where Scratch servers are located) or any other country in which we or our service providers maintain facilities. If you are located in the European Economic Area, the United Kingdom or Switzerland... we will comply with applicable data protection laws. In particular we will rely on (i) an EU Commission, UK or Swiss government adequacy decision, (ii) contractual protections for the transfer of your Personal Data, or (iii) another valid data transfer mechanism. Scratch does not collect information from a student's education record, as defined by the Family Educational Rights and Privacy Act (FERPA).”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ✓ Named |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |