The Third-Party Clause

Paloma had been using the school's approved study app since ninth grade, tracking her focus sessions and quiz scores. She had never read past the first line of its privacy policy. Nobody her age actually read those, or so she'd always assumed.

Everything changed the day her older brother, studying data privacy at university, asked to see the app on her phone.

"Did you know this thing sells your usage patterns to a marketing firm?" he asked, scrolling through settings she'd never opened. "Your study habits, your stress levels during exams — all of it, packaged and sold."

"It's a school app, though," Paloma said. "The school wouldn't approve something that does that."

"The school probably didn't read the fine print either," her brother said. "Third-party data sharing is buried in clause fourteen. I only found it because I was looking."

Paloma felt a strange mix of embarrassment and anger — embarrassed that she hadn't checked, angry that checking had been made so difficult. If the terms had been written clearly, she would have noticed months ago.

She brought it up with her school counselor the next day, expecting to be told it wasn't a big deal.

"I'll be honest, I never read past the summary either," the counselor admitted. "Let me look into it properly before I recommend it to anyone else."

Two weeks later, the school sent a notice to all students. The app's contract was under review, and a version with stricter data settings was being considered as a replacement.

"You actually got something changed," her brother said, sounding genuinely surprised. "Most people just complain and move on."

"I didn't get anything changed yet," Paloma said. "I just asked one question the school hadn't asked."

She still used the app while the review continued, but she read every settings menu now, disabling whatever she could. It felt less like using a tool and more like negotiating with one.

"Small thing," she told her brother. "But at least now I know what I agreed to."