Privacy Policy

Introduction

SchoolGPT ("we," "our," or "us") is committed to protecting the privacy of K-12 educators who use our AI teaching assistant platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

We designed SchoolGPT with educator privacy in mind. We do not collect student personally identifiable information (PII), and our platform is built to be privacy-friendly from day one.

Information We Collect

Account Information

When you create an account, we collect:

Email address
Full name
Password (securely hashed)
Authentication data if you sign in with Google

Usage Information

When you use SchoolGPT, we collect:

Chat conversations and messages you send to our AI
Tool inputs and generated outputs (lesson plans, rubrics, feedback, etc.)
AI model usage statistics (tokens used, model selected)
Saved resources and favorites
Feature requests and feedback you submit

File Uploads

If you upload files to SchoolGPT (images, PDFs), we store these files securely to process your requests. Files are associated with your user account and are not shared with other users.

Technical Information

We automatically collect standard technical information including browser type, device information, IP address, and cookies necessary for authentication and session management.

How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain SchoolGPT services
Process your AI requests and generate teaching materials
Save your conversation history and generated resources
Improve and personalize your experience
Communicate with you about updates, features, and support
Monitor usage to prevent abuse and ensure service quality
Comply with legal obligations

Third-Party Services

We use trusted third-party services to operate SchoolGPT:

Service	Purpose	Data Shared
Supabase	Authentication & user management	Email, name, session data
OpenRouter	AI model access (OpenAI, Anthropic, Google, DeepSeek)	Prompts and generated content
Cloudflare R2	File storage	Uploaded files
PostHog	Analytics & product improvement	Usage data, device info, interactions

These providers have their own privacy policies and are contractually obligated to protect your data.

Data Security

We implement industry-standard security measures to protect your information:

All data is encrypted in transit using HTTPS/TLS
Passwords are securely hashed and never stored in plain text
User data is segregated by account
We use secure, authenticated API connections to third-party services
Regular security reviews and updates

Student Data Handling

SchoolGPT is designed as a teacher productivity tool. We do not require or request student personally identifiable information (PII):

No student PII required. Our tools are designed for teachers to input curriculum content, lesson topics, and teaching materials—not student personal data.
Terms prohibit student PII. Our Terms of Service explicitly prohibit users from inputting student names, grades, or other personally identifiable information.
Teacher responsibility. While we cannot technically prevent all inputs, teachers are responsible for ensuring they do not include student PII when using SchoolGPT.
Content safety filters. Our default AI model includes content safety filters appropriate for educational use.
No AI training. We do not use your data to train AI models.

If you accidentally input student information, you can delete individual chats or your entire account at any time. For school administrators with questions about privacy, please contact us at support@schoolgpt.app.

FERPA Compliance

SchoolGPT is designed to support school compliance with the Family Educational Rights and Privacy Act (FERPA):

No student education records required. Our service does not require the collection or processing of student education records.
PII prohibition. Our Terms of Service prohibit users from inputting student personally identifiable information.
No data selling. We do not sell, rent, or share your data with third parties for marketing purposes.
No AI model training. Your data is never used to train AI models.
User-controlled deletion. Teachers can delete their data at any time through their account settings.
Data Processing Agreements. We will sign Data Processing Agreements (DPAs) with school districts upon request.

For school administrators seeking a Data Processing Agreement or security questionnaire, please contact us at support@schoolgpt.app.

COPPA Compliance

SchoolGPT complies with the Children's Online Privacy Protection Act (COPPA):

Teacher-only platform. SchoolGPT is designed exclusively for use by educators, not students. Users must be at least 18 years old to create an account.
No child accounts. We do not offer accounts for students or children.
No collection from children. We do not knowingly collect personal information from children under 13.
Immediate removal. If we learn that we have collected personal information from a child under 13, we will delete that information immediately.

If you believe we have collected information from a child under 13, please contact us immediately at support@schoolgpt.app.

GDPR Compliance (European Users)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, SchoolGPT complies with the General Data Protection Regulation (GDPR):

Legal Basis for Processing

We process your personal data under the following legal bases:

Contract performance: To provide our services to you when you create an account and use SchoolGPT.
Legitimate interests: To improve our services, ensure security, and prevent fraud.
Consent: For optional marketing communications, which you can withdraw at any time.
Legal obligations: To comply with applicable laws and regulations.

Your GDPR Rights

As a data subject in the EEA, you have the following rights:

Right of access: Request a copy of your personal data.
Right to rectification: Request correction of inaccurate personal data.
Right to erasure: Request deletion of your personal data ("right to be forgotten").
Right to restrict processing: Request limitation of how we use your data.
Right to data portability: Receive your data in a structured, machine-readable format.
Right to object: Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
Right to lodge a complaint: File a complaint with your local data protection authority.

International Data Transfers

Your data may be transferred to and processed in the United States, where our servers and third-party service providers are located. We ensure appropriate safeguards are in place for such transfers, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Working with service providers who maintain adequate data protection certifications

To exercise any of these rights, please contact us at support@schoolgpt.app. We will respond to your request within 30 days.

CCPA Compliance (California Users)

For California residents, SchoolGPT complies with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information:

Identifiers: Name, email address, IP address, account ID
Internet activity: Browsing history on our site, interactions with our service
Professional information: School or district affiliation (if provided)

Your CCPA Rights

As a California resident, you have the following rights:

Right to know: Request information about the personal data we collect, use, and disclose about you.
Right to delete: Request deletion of your personal data, subject to certain exceptions.
Right to correct: Request correction of inaccurate personal data.
Right to opt-out of sale/sharing: We do not sell or share your personal information for cross-context behavioral advertising.
Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

We Do Not Sell Your Data

SchoolGPT does not sell, rent, or share your personal information with third parties for monetary or other valuable consideration. We do not engage in cross-context behavioral advertising.

How to Exercise Your Rights

To exercise your CCPA rights, you may:

Email us at support@schoolgpt.app
Delete your account directly through the app settings

We will verify your identity before processing your request and respond within 45 days. You may also designate an authorized agent to make a request on your behalf.

Data Retention

We retain your data as follows:

Account data: Retained while your account is active
Chat history & generated content: Retained until you delete it or close your account
Usage logs: Retained for up to 12 months for service improvement and security

Your Rights

You have the right to:

Access: Request a copy of your personal data
Correction: Update or correct inaccurate information
Deletion: Delete your account and associated data
Portability: Export your generated content and saved resources
Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at support@schoolgpt.app.

Cookies

We use the following types of cookies:

Essential Cookies

Required for authentication and session management. These cookies are necessary for SchoolGPT to function and cannot be disabled.

Analytics Cookies

We use PostHog to understand how users interact with our service and to improve the product. These cookies collect anonymous usage data. For users in the European Economic Area, we request consent before setting analytics cookies.

We do not use cookies for advertising or cross-site tracking purposes.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.