Privacy Policy
Last updated: June 2026
1. Who We Are
Classroots ("we," "our," or "the Service") is a multi-tenant platform for community religious and cultural weekend schools. Your organization ("School") uses Classroots to manage student records, attendance, grades, and communication.
2. Information We Collect
Account Information
When you create an account we collect your name, email address, and optional phone number.
Student Records
Administrators and teachers enter student attendance, grades, conduct notes, and assignments. Parents may also provide custom registration information requested by their school.
Usage Data
We collect standard server logs (IP address, browser, pages visited) to operate the service and detect abuse.
Push Notification Tokens
With your permission, we store device tokens to send attendance alerts, grade notifications, and messages.
3. How We Use Information
- To provide, operate, and improve the Service
- To send you notifications you have opted into
- To generate attendance reports and report cards
- To respond to support requests
- To comply with legal obligations
We do not sell your personal information to third parties.
4. Data Isolation
Each organization's data is fully isolated. Users in one organization cannot access data from another. All database queries are enforced at the row level by Supabase Row Level Security policies.
5. Children's Privacy (COPPA)
We are aware that student records may include information about children under 13. Student records are entered by school administrators and teachers, not directly by children. Parents/guardians provide consent by agreeing to these terms on behalf of their child during registration. We do not knowingly allow children under 13 to create their own accounts.
6. Data Retention
Account and student data is retained for the lifetime of the organization's subscription. After an account is deleted, personally identifying information is anonymized within 30 days. Backups may retain data for up to 90 days.
7. Your Rights (GDPR / CCPA)
Depending on your jurisdiction you may have rights to access, correct, export, or delete your personal data. To exercise these rights, contact your school administrator or email us at privacy@getclassroots.com.
8. Security
All data is transmitted over HTTPS. Passwords are hashed by Supabase Auth. We use Cloudflare for DDoS protection and global CDN delivery of files.
9. Third-Party Services
- Supabase — database hosting and authentication
- Cloudflare R2 — file storage
- Firebase / FCM / APNs — push notifications
- Resend — transactional email
- Sentry — error monitoring (no PII in error reports)
10. COPPA — Children's Privacy
Classroots is a platform for educational institutions that serve minors. We comply with the Children's Online Privacy Protection Act (COPPA) as follows:
- We do not knowingly collect personal information directly from children under 13. All student data is entered and managed by verified parents, guardians, or school administrators.
- Parental consent is obtained at the time a parent registers their child or links to a student account, either via the registration form, invite code, or direct admin linking.
- Parents may review all information held about their child by contacting their school administrator or emailing privacy@getclassroots.com.
- Parents may request deletion of their child's data at any time by contacting their school administrator or emailing privacy@getclassroots.com. Deletion requests will be processed within 30 days.
- School administrators are responsible for ensuring that only verified parents and guardians are granted access to student records.
11. Changes to This Policy
We will notify organization administrators of material changes by email at least 14 days before they take effect.
12. Contact
Questions? Email us at privacy@getclassroots.com.