COPPA Compliance Guide for Self-Hosters

This guide is for organizations (schools, edtech companies) that self-host ɳSelf and serve users under 13.

Controller vs. Processor

When you self-host ɳSelf, your organization is the data controller. ɳSelf (the company) is a processor only when you use our cloud services (plugin downloads, license validation). For self-hosted instances, you control all user data directly.

Your Responsibilities as Controller

• Parental consent: Obtain verifiable parental consent before collecting data from users under 13
• Privacy notice: Provide a clear, age-appropriate privacy notice to parents
• Data minimization: Only collect data necessary for the educational purpose
• Parental access: Allow parents to review, modify, or delete their child's data
• Security: Implement appropriate technical and organizational security measures

ɳSelf Features for Child Safety

The ɳSelf CLI includes configuration options to help you comply:

• COPPA_MODE=true in your .env enables age-gate enforcement at the backend level
• Audit logging tracks all data access for compliance reporting
• Data export and deletion tools support parental data requests
• Role-based access control limits who can view student data

FERPA Addendum

For US educational institutions that need FERPA compliance, we provide a template Data Processing Addendum that covers FERPA requirements when ɳSelf cloud services are used alongside your self-hosted instance.

Template Data Processing Agreement

Contact legal@nself.org for a signed DPA if your organization requires one for self-hosted instances that connect to ɳSelf cloud services (plugin registry, license validation).