The Brief
Last year, Khan Academy quietly updated Khanmigo — its AI tutor, now used in thousands of schools across the US and UK — to allow students to have open-ended conversations about almost anything, not just homework. The update was covered in the ed-tech press as a feature launch. What didn’t make the headlines: every word of those conversations is stored, associated with your child’s account, and used to personalise future interactions.
Khan Academy is not doing anything unusual here. Synthesis, Socratic by Google, and most AI tutoring products work the same way. The conversation log is not a side effect of the product. It is, in a meaningful sense, the product itself. The AI gets better at teaching your child by remembering everything your child has ever said to it. A human tutor might recall that your child found fractions hard last month. An AI tutor has the full transcript, the timestamps, and the pattern of every session your child has ever had — and it never forgets any of it.
Most parents who approved these tools did so because someone at school recommended them, or because they watched their child get unstuck on a maths problem for the first time in months. That is a completely reasonable response to a genuinely useful product. The approval happened fast, in the middle of homework time, with a school email in one hand and a distracted child in the other.
What almost nobody was told in that moment: the AI your child is talking to is building a detailed profile of how your child thinks, what they struggle with, what they find funny, and what upsets them. That profile lives on a server. It can be retained for years. The AI uses it every single session — to predict what your child will find useful, what they will respond to, and what will keep them engaged. In most cases, you have never seen it.
This is not a reason to ban AI tutors. Some of them are genuinely good. It is a reason to know what you agreed to.
Behind the Build
Here is how an AI tutor actually works, from the inside.
When your child types a message to Khanmigo, that message is sent to a large language model — the same underlying technology as ChatGPT. The model generates a response. So far, this is what most people imagine. What most people don’t imagine is what happens at the edges of that exchange.
Before your child’s message reaches the model, it is enriched. The system adds context: your child’s grade level, their recent assessment scores, the subjects they have struggled with, and — critically — the history of previous conversations. The model doesn’t just see “I don’t understand fractions.” It sees that this particular child has asked about fractions four times in the last two weeks, got frustrated and closed the app on Tuesday, and responded well to visual explanations in the past.
That history is what “personalisation” means in practice. It is not a setting. It is not something you turned on. It is the default operating condition of every AI tutor that stores conversation logs — which is most of them.
The conversation log itself is more detailed than parents typically assume. It includes the full text of everything the child typed, the timestamps, how long they spent on each message, and whether they deleted and retyped answers. Some products go further: natural language processing is used to infer your child’s emotional state from how they write — not just what they say, but the patterns. Short answers. Repeated attempts at the same problem. The words they reach for when they get stuck. None of this is recorded by a human tutor. An AI system can do it systematically, at scale, across millions of children. This data is retained according to each company’s privacy policy — which varies significantly between products and which most parents have never read.
There is also a school versus consumer distinction that matters. If your child uses Khanmigo through their school, the data handling is governed by a contract between Khan Academy and the school district, and may be subject to FERPA (the US student privacy law). If your child uses the consumer version — the one you signed up for at home with a personal email — different rules apply, and the protections are typically weaker.
COPPA in the US and GDPR-K in the UK and EU both require parental consent for data collection from children under 13. Most AI tutor companies satisfy this requirement with a checkbox during account creation. What the checkbox does not tell you is how long the data is kept, who it is shared with, or what happens to it if the company is acquired.
None of this means the products are malicious. The engineers building these tools are, in most cases, genuinely trying to make tutoring better. Personalisation based on past interactions does make the AI more useful. The model responding to your child today is not a generic AI. It is an AI that has been given an increasingly detailed file on your child to read before it answers. But the business model that sustains these products — whether advertising-supported, subscription, or school licensing — depends on building and retaining that file. The personalisation and the data retention are not separate features. They are the same feature.
What To Do
This week: find and test your child’s AI tutor data deletion — before you need it
Most parents have never located the conversation history deletion option in their child’s AI tutor. Most have never tried to use it. Do it now, while you have no particular reason to — because finding out it doesn’t work in the moment you need it is much worse.
In Khanmigo: go to your child’s account → Settings → Privacy → Request data deletion. Note whether this executes immediately or opens a support ticket. If you cannot find the option at all, that is worth an email to the company.
While you are in the settings, two things are also worth checking. First: is this a school account or a personal account? School accounts are covered by a contract between Khan Academy and your child’s district, which typically provides stronger protections than the consumer version. If your child’s school set up the account, ask the school what data agreement they have in place. Second: what does the retention policy actually say? Search for “data retention” in the privacy policy. Anything longer than 12 months without a clear deletion path warrants a follow-up question directly to the company.
The whole thing takes ten minutes. Most parents using these products every day have never done it.
Next issue: There is a setting in YouTube Kids that is on by default and was not designed with your child’s interests in mind.
Their Device is written by [Name], a parent and former kids tech industry professional. If someone forwarded this to you, you can subscribe at [link].