MagicSchool AI Privacy Guide

MagicSchool AI's privacy score on SafeGradeAI is 88/100, the strongest of its six pillars. This guide summarizes what the vendor documents about data collection, retention, and third-party sharing for MagicStudent, the student-facing product.

What data is collected

MagicSchool's Privacy Policy and Student Data Policy describe collection of account/roster information (typically provided by the school via integration), and the prompts and content students and teachers generate while using the tools. Student access to MagicStudent is educator- or school-enabled, so accounts are generally provisioned through the school rather than created independently by a student.

How student data is used

Vendor-documented commitments include:

• MagicSchool states it does not sell or share student conversation data for advertising.
• MagicSchool states it does not allow student conversation data to be used to train external AI models.
• The Student Data Policy states children's personal information is not used to train, retrain, or improve general-purpose AI models.
• Third-party AI providers used to power MagicSchool's tools are described as acting as service providers under contract, not as independent data controllers.
• Student materials and prompts sent to underlying AI providers are described as processed transiently, with zero-data-retention commitments from those providers.

SafeGradeAI assessment: These are meaningfully stronger commitments than a typical consumer AI product, and they are the main driver of the 88 privacy score. SafeGradeAI has not independently audited the underlying AI-provider contracts; districts should request copies as part of procurement.

Storage, access, and security

MagicSchool's security documentation states that data is encrypted in transit and at rest, access is controlled through role-based permissions, and the company conducts ongoing monitoring and vulnerability scanning plus annual third-party penetration testing. Student interactions inside MagicStudent are stored to enable teacher visibility, and the vendor states only authorized educators and administrators can view them.

Certifications and compliance documentation

MagicSchool publishes:

• A SOC 2 Type II report covering security controls.
• An iKeepSafe FERPA certification.
• An iKeepSafe COPPA Safe Harbor certification.
• Standard Data Processing Agreements (DPAs) and district privacy documentation for procurement review.

SafeGradeAI assessment: These are third-party certifications from named certifying bodies (iKeepSafe, and an unnamed SOC 2 auditor per standard practice); SafeGradeAI treats these as vendor-attested and recommends districts confirm current validity dates directly with MagicSchool.

Integrations and identity data

MagicSchool integrates with Google, Microsoft, Clever, ClassLink, and Canvas/Schoology depending on plan, which means roster and identity data may flow from these systems into MagicSchool under the school's existing agreements with those providers.

What SafeGradeAI recommends

• Request the current SOC 2 Type II report and DPA before district-wide adoption.
• Verify iKeepSafe FERPA/COPPA certification status directly on MagicSchool's trust pages, as certifications can lapse or renew.
• Confirm which AI providers process student prompts and whether zero-data-retention terms are contractually current.
• Pair this with the is-it-safe overview and the parent guide.

Return to the MagicSchool hub for the full picture.