Blindfold EDU

One-page explainer

Blindfold Edu and FERPA

What if your office could use AI on retention files, survey comments and accreditation evidence this week, without a single student name leaving your computer? Here is how that works alongside FERPA, and which decisions stay with you.

What FERPA protects

FERPA protects personally identifiable information (PII) from education records. That includes direct identifiers such as name, student ID, email, address and date of birth. It also includes indirect identifiers: details that, alone or combined, would let a reasonable person in the school community identify a student with reasonable certainty (34 CFR §99.3).

Without consent, PII can be disclosed only under an exception, such as to school officials with a legitimate educational interest (34 CFR §99.31(a)(1)). Pasting identifiable records into an outside AI service can count as a disclosure. That is why so many campuses tell staff to keep student PII out of AI tools altogether.

What Blindfold Edu does

  • Runs in your browser. Your files are processed on your own computer.
  • Swaps identifiers for consistent tokens. "Maria Lopez, ID 919283302" becomes [STUDENT_014] every time she appears, so the AI can still follow her through a file.
  • Shows you everything before it leaves. A review screen lists what was replaced, and you can flag anything it missed.
  • Restores names on your computer. Paste the AI's answer back in and the real names return. The restore key is encrypted on your device and never goes to the AI service.

How this fits FERPA

The AI service receives tokens, not names or IDs. Under FERPA, a record counts as de-identified only when all PII is removed and a reasonable determination is made that no student can be identified, taking into account other reasonably available information (34 CFR §99.31(b)(1)).

Blindfold Edu does the removal. The determination belongs to you and your institution.

One point of vocabulary: because you keep a restore key, FERPA's terms describe Blindfold Edu output as de-identified with a code, not anonymized. The key stays on your machine and is never shared with the AI.

Where your judgment still matters

  • Small cells. "The three students in the physics major" can identify people even with names removed. Aggregate or suppress small groups before analysis.
  • Rare combinations. Age, program, county and veteran status together can point to one person.
  • Free-text comments. A survey answer like "as the only parent in my cohort" can identify its writer. Read open-ended responses on the review screen.
  • File names and metadata. Rename files such as Lopez_appeal.docx before uploading.
  • Campus policy. Your institution may limit which AI tools you can use, even with de-identified data. Check with your registrar or data governance office.

What we never see

Blindfold Edu does not receive your files, your restore keys or the AI's answers. The only things our servers hold are your account and license.

This page is general information, not legal advice. Your registrar or general counsel makes your institution's FERPA determinations.

Sources: 34 CFR §99.3; 34 CFR §99.31; U.S. Department of Education, Privacy Technical Assistance Center, Data De-identification: An Overview of Basic Terms and the studentprivacy.ed.gov glossary.