The short answer
Curipod is a Norwegian company selling one product into US school districts, and in the last year it has changed what that product is. Its published disclosure is candid in places that most vendors stay vague about, and thin in the two places a district privacy office always looks. The gaps are specific, which means they can be closed in one email before anything is signed.
We read every page reachable from Curipod’s own navigation on 11 September 2026, searched their help centre, and checked the third-party privacy rating at the source rather than repeating the claim.
| Question a district asks | What we found |
|---|---|
| What is the product now? | An ELA writing practice platform aligned to core curricula, not a slide generator |
| Can we get a signed DPA? | Yes, but only on the School and District plan. Free and Premium get the standard policy |
| Where is our data stored? | US storage is available on request, by email. It is not the default |
| Do students need accounts? | No. Students join without creating accounts |
| Is there a SOC 2 report? | No public claim on any route we checked. That is not the same as no report |
| Can we pay on a PO? | Yes. Card, invoice or purchase order, and a W-9 is available on request |
| Are teacher emails used for marketing? | Yes, including lookalike audiences. EU users are opted out by default |
This is a company evaluation. Whether the writing feedback is any good is a different question with a different answer, and it lives in our Curipod review. What a licence costs lives in our Curipod pricing breakdown, and is deliberately not repeated here.
The product you are evaluating is probably not the one you read about
This is the first thing to establish, because it invalidates a lot of secondary research. Curipod became well known as an AI lesson and slide generator: type a topic, get an interactive deck with polls and word clouds. That is what most published reviews describe, ours included until today.
As at 11 September 2026, Curipod’s own homepage is titled “Writing Practice Students Love” and opens with “Teacher led lessons aligned to your district’s curriculum. Students read, write and discuss.” The pricing page describes the product as “Writing practice with feedback for your classroom, school and district”. The plan comparison is built around writing sessions, standards alignment and growth tracking.
What the repositioning actually changes
The company now sells against your core curriculum rather than alongside it. Curipod names HMH Into Reading, Amplify CKLA, Wonders and Eureka as scope and sequence it aligns to, and offers a separate “ELA Curriculum Alignment” plan for districts on HMH, Savvas and Bluebonnet. The framing is Tier 1 and Tier 2 instruction, which is instructional core language, not supplementary tool language.
That moves the purchase. A slide generator is a teacher expense that a principal can approve. A platform that claims to sit inside Tier 1 ELA instruction is an instructional materials decision, which in most districts means a different budget line, a different approval path, and a curriculum director in the room.
Faz says: If your evidence about a vendor is more than about a year old in this category, re-read their homepage before you re-read your notes. A repositioning is not a rebrand. It changes who has to approve the purchase, and finding that out after the quote arrives wastes a term.
Who you are buying from
Curipod is a Norwegian company. Its privacy policy states that for European customers it does not transfer personal data outside the EU and EEA, which is the disclosure of a company whose default infrastructure sits in Europe. No funding, ownership or headcount figures are published anywhere we could reach, so company viability cannot be assessed from the site.
One structural signal worth naming without over-reading it: almost every commercial and compliance route on the site ends at a named individual’s email address rather than a department or a ticketing system. Quotes, discounts and co-op questions go to one person, data privacy agreements to a second, DPA signature requests to a third, US data residency to a fourth, and marketing opt-outs to a fifth. That is normal for a company of this size and it usually means fast answers. It also means your procurement timeline depends on individual inboxes, so start the compliance thread before you start the quote thread.
Data protection, and the one answer that decides your plan
A signed data privacy agreement is a paid feature
This is the most consequential thing on the pricing page, and it is easy to miss because it sits in a feature comparison row rather than in the plan descriptions. The row is “Data privacy agreements”. Free and Premium both read “Standard privacy policy”. Only School and District and the ELA Curriculum Alignment plan get a tick.
Curipod’s own FAQ confirms it in plain language: signing custom data privacy agreements is included on the School and District plan, and agreements should be sent over if you are on, or planning to sign onto, that plan.
The practical consequence is that the common pilot pattern does not work here. A department cannot buy a handful of Premium seats, run the tool with real students for a term on a signed district agreement, and decide later. If your district requires an executed DPA before student data touches a system, and most do, you are on the district plan from day one or you are not running the pilot with students at all.
Saru says: Ask for the DPA template in your first email, not your last. If the vendor’s standard agreement already covers your state’s requirements you have saved a month. If it does not, you have found that out while you still have alternatives, rather than in the week before a term starts.
Where the data actually lives
Curipod’s privacy policy says, directly and without qualification, that if you want teacher and student data stored in the United States you should email a named member of staff. It is an available option, not the default.
For a US district that is a genuine review item rather than a technicality. Several state student privacy statutes and many district agreements carry data location or transfer terms, and a vendor that can meet them on request but does not do so automatically is a vendor whose contract needs the request written into it. An email thread is not a contractual commitment. Get it into the agreement.
For EU and UK buyers the same disclosure reads as a strength: no transfer of personal data outside the EU and EEA, which is a cleaner position than most US-headquartered competitors can offer.
What happens to teacher email addresses
Curipod draws a hard line between student data and everyone else’s, and the line is worth reading carefully because both halves are unusual.
On the student side the policy is firm and repeated: student data is never used for commercial purposes, never sold, never used to train AI models, and third-party model providers do not train on it either. Curipod also states that when an AI is prompted, account personal data such as email and school name is not sent as part of the prompt. Students join without creating accounts, so the data surface is teacher name, email, password, IP address, an instance ID, a sign-in identifier, plus student responses and optionally student names held inside the teacher’s account.
On the non-student side the policy is unusually expansive, and unusually honest about it. It states that email addresses may be used to create lookalike audiences on third-party platforms such as Meta, Google and TikTok, and that where a non-student user outside Europe arrives from a digital ad, Curipod may confirm the signup back to that ad platform using an anonymised click identifier. Users in the EU are opted out by default. Everyone else is opted in, and opting out means emailing a named individual.
Neither half is hidden. Both are in the published policy. But a US district approving a tool for its teachers is approving that teacher work email addresses can be matched into advertising audiences on three large platforms, and that is not what most reviewers mean when they call a policy student-safe.
Security posture: what is published, and what is not
What Curipod does publish is specific. Data is encrypted in transit and at rest. Sub-processors do not collect personal information for their own purposes. Deletion happens on request no later than 180 days, and IP addresses are deleted within 180 days of account deletion. The company states compliance with FERPA, COPPA, SOPPA and GDPR, and states that under FERPA it acts as a school official under the direct control of the district, with COPPA consent provided by the school on parents’ behalf. Those are the correct legal postures to assert.
What is missing is an independent audit. We found no SOC 2 or ISO 27001 claim of any kind, in any form. Three separate routes, so this is a narrower statement than it looks:
| Route checked | Result |
|---|---|
| Every page reachable from their own navigation | No mention, in text or in page source |
| A trust or security subdomain | Does not resolve |
| Their own help centre search | No article returned for either term |
Two clarifications matter here. The paths that look like a public security page redirect to the application login, so they are product routes rather than disclosure. And an absent claim is not a failed audit. Companies of this size frequently hold a SOC 2 and never publicise it, and Curipod may well be one of them. What we can say is that a district that requires audit evidence will not find it on the website and should ask in the first email rather than the last.
Sub-processors are the second gap. The policy describes categories of third-party provider and commits that they do not use the data for their own purposes, but it does not name them, and it does not name the AI model providers. If your agreement requires a sub-processor list with change notification, that list has to be requested.
The independent rating, and what it actually assessed
Curipod holds a Common Sense privacy evaluation of 68%, rated Pass. We read it at the source rather than repeating a vendor claim about it. Two details change how much weight it carries.
The first is scope. The six findings behind a Pass are all about selling, sharing and advertising: information not sold or rented, not shared for third-party marketing, no personalised advertising displayed, not collected by third parties for their own purposes, not used to target ads on other sites, and no ad profiles built. It is a data monetisation rating. It says nothing about encryption, breach history, audit posture or uptime. A Pass here and a SOC 2 answer two completely different questions, and a badge on a vendor page invites a buyer to treat them as one.
The second is date. The evaluation was last updated 8 February 2024 and assessed the policies in effect on 7 February 2024. That is roughly two and a half years before the policy we read this week, which is the one that describes lookalike audiences on Meta, Google and TikTok. We are not saying the rating is now wrong; only Common Sense can re-rate it, and the student-data protections it examined still read as intact. We are saying the badge assessed a different document from the one governing your purchase.
Faz says: Every third-party trust badge carries an assessment date and an assessed document. Both are usually published and almost never read. When the gap between the badge and the current policy is measured in years, the badge is evidence about the past.
Buying: quotes, purchase orders and the co-ops
Procurement is the part of Curipod’s disclosure that needs no chasing, which is unusual in this category. School and district licensing is quote-based and sized to student count, and the published answers are direct.
| Procurement question | Curipod’s published answer |
|---|---|
| Payment methods | Credit card, invoice, or purchase order |
| Vendor paperwork | W-9 available on request, published as a downloadable form |
| Purchasing co-operatives | TIPS and Allied States, through ESC 19, plus others on request |
| Volume and term discounts | Multi-school, district-wide and multi-year agreements are discounted |
| Small schools | A separate price for schools under 200 students, by request |
| Hardship | An explicit financial aid route, plus help fitting the cost to grant funding |
Being awarded on a co-operative contract is the detail worth confirming in writing, because it is the one that can remove a competitive bid requirement and take weeks out of your timeline. Curipod names TIPS and Allied States. Confirm the award number and its expiry with the co-op directly, not with the vendor, because awards lapse and vendor pages lag.
One disclosure gap sits on the free plan. The pricing FAQ says the free plan includes “a set number of live sessions each week” without stating the number on the page. If you are sizing a pilot around free accounts, that number is the whole plan, so get it before you build a term around it.
The outcome claims, and their stated basis
Curipod leads with efficacy rather than features, which is the right instinct for this buyer and raises the standard of evidence it has to meet. These are the company’s claims, and we are reporting them as claims along with the basis Curipod gives for each.
The headline is that students in Curipod classrooms improved by up to 23 percentage points on state reading and writing tests, illustrated as a move from a 50% baseline to 73%, with the company stating that the furthest-behind students made the biggest gains. Curipod attributes this to case studies built on official state test data from the California Department of Education and the Texas Education Agency. Named examples include STAAR reading passing rates rising from 69% to 89% at an elementary school in Texas, 46% CAASPP growth in upper elementary ELA in Southern California, fifth-grade ELA moving from 51% to 69% meeting standards, and one Texas district accountability rating moving from a C to an A in a single year. The company also states it is trusted in more than 14,000 districts.
Attributing figures to state assessment data is meaningfully better than the unattributed percentages most vendors in this category publish, because it points at a source a district can check. What these case studies do not establish is attribution: none of the published summaries we read describes a control group or a matched comparison, so they show what happened in schools using Curipod, not what Curipod caused. Ask for the full case studies, ask what else changed in those schools in the same year, and treat the range as the vendor’s best cases rather than an expected outcome.
Saru says: A vendor naming the state assessment behind a claim has done more than most. It still is not a controlled study. The useful follow-up is not “can you prove it”, which gets you a deck. It is “what else changed at that school that year”, which gets you an honest answer or a revealing silence.
What we would settle before signing
None of these is a red flag. They are the specific gaps between what is published and what a district agreement needs, and every one of them can be closed in a single email thread.
| Ask for | Why it matters |
|---|---|
| The DPA template, before the quote | Signing is plan-gated, so this decides which plan you can even pilot on |
| US data residency written into the contract | It is available on request today and an email is not a commitment |
| A named sub-processor list, including AI model providers | Neither is published, and most district agreements require both |
| SOC 2 or equivalent, or a plain no | No public claim exists on any route. A clear no is still an answer you can act on |
| The free plan session limit, as a number | It is unpublished and it defines what a free pilot can cover |
| Written confirmation that staff emails are excluded from ad audiences | The policy permits it and the default outside the EU is opted in |
| The co-op award number and expiry | Confirm with the co-op, not the vendor. It can remove a bid requirement |
How we did this and what we did not do
We have not used Curipod with students. This is a company evaluation built from published material, not a product test. Everything above was read from Curipod’s own pages on 11 September 2026 by following their navigation rather than guessing URLs, plus a search of their help centre and a direct check of the Common Sense evaluation at the source.
We did not complete the district quote form, so we hold no district pricing and are not withholding one. Where we could not establish something we have said we could not find it, which is a different claim from saying it does not exist, and only one of those two is supported by what we did.
Written by
FazFaz is the founder of AIToolsBakery. Some tools here are tested hands on. Others are assessed from vendor documentation and pricing verified on the live page, and every review says which one it is. Sponsors can buy a position in a guide. They cannot buy the score, the criticism, or silence about a better option.
How we test and how we make money →Frequently Asked Questions
