Apps custom-designed for schools are sending staggering amounts of data to Facebook and Google, researchers found.