# WYG School Data Controls — Illinois Pilot Packet

**Status:** Draft for pilot discussion and attorney review  
**Updated:** August 23, 2026  
**Contact:** wygplaybookapp@gmail.com

This packet is designed to help an Illinois public school evaluate a limited WYG football learning and assessment pilot. It is not legal advice, a certification, or a representation that WYG has completed every operational control described in the drafts.

## Included documents

1. [Pilot Agreement Draft](./WYG-Pilot-Agreement-Draft.md)
2. [Student Data Privacy Addendum Draft](./WYG-Student-Data-Privacy-Addendum-Draft.md)
3. [Privacy Policy Draft](./WYG-Privacy-Policy-Draft.md)
4. [Terms of Service Draft](./WYG-Terms-of-Service-Draft.md)
5. [Security Summary](./WYG-Security-Summary.md)
6. [Subprocessor List](./WYG-Subprocessor-List.md)
7. [Data Retention Schedule](./WYG-Data-Retention-Schedule.md)
8. [Export and Deletion Procedure](./WYG-Export-and-Deletion-Procedure.md)
9. [Breach Notification Procedure](./WYG-Breach-Notification-Procedure.md)
10. [School Contact and Support Process](./WYG-School-Contact-and-Support-Process.md)

## Operational reliability packet

11. [Operational Reliability Runbook](./WYG-Operational-Reliability-Runbook.md)
12. [Backup and Recovery Procedure](./WYG-Backup-and-Recovery-Procedure.md)
13. [Monitoring and Alerting Runbook](./WYG-Monitoring-and-Alerting-Runbook.md)
14. [Production Access Standard](./WYG-Production-Access-Standard.md)
15. [Incident Response Procedure](./WYG-Incident-Response-Procedure.md)
16. [NIST SSDF Baseline](./WYG-SSDF-Baseline.md)

## Legal foundation reviewed

- Illinois Student Online Personal Protection Act, 105 ILCS 85: https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3806&Chapter=SCHOOLS&ChapterID=17&MajorTopic=EDUCA
- U.S. Department of Education FERPA guidance: https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPA%20Guidance%20for%20School%20Officials%20on%20Student%20Health%20Records.pdf
- Federal Trade Commission COPPA FAQs, Section N (schools): https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA%20AND%20SCHOOLS

## Required completion before signature

- Insert WYG's legal entity name, business address, state of formation, notice address, insurance, pricing, and governing-law terms.
- Insert the school district's legal name, address, authorized representative, privacy contact, security contact, and approved pilot dates.
- Confirm the exact technical service providers, their legal entities, hosting locations, contracts, and security commitments.
- Select data-retention periods and confirm how they will be technically or manually enforced during the pilot.
- Decide breach cost allocation, liability caps, indemnification, insurance, service commitments, and dispute terms.
- Have qualified education/privacy counsel review the complete packet and any district form.

## Product controls already represented in WYG

WYG provides team-scoped access, optional athlete email, hashed credentials and tokens, revocable accounts and invitations, private file access, server-side grading keys, immutable play and test evidence, original score preservation, coach-reviewed drawing disputes, administrative audit events, coach export, reviewed deletion requests, a school privacy contact, and a selectable retention policy. Operational procedures and contractual promises still require an accountable WYG operator and signed school agreement.