Security & privacy
How student information is handled here, in plain terms, so a teacher, a principal, or a district tech director can check it for themselves.
Roster names stay on your device
Each student syncs under a random code like S-K7MPQ2XW. Not their name, not their student ID. The server refuses a student record whose ID is not a code, but it cannot check comment text for names, because it never sees your roster. Your device takes the names on your roster out of each comment before sending, and warns you if a comment mentions anyone else. The list matching codes to names stays in your roster, on your device. There are two honest limits. Accounts from before August 30, 2026 synced names the old way, and those records are being deleted before school accounts open. A comment's content can also still describe a student, so we protect these records with full care regardless.
Nothing is saved unless you ask
By default your work lives only in the page you are looking at. It is not written to your browser, not sent to us, and it is gone when you refresh. You can switch to keeping it on your device or to a school account any time. The app always shows which one you are in.
No AI company ever sees your students
Comments are written by the app itself, not by ChatGPT or any outside AI service. Nothing you type about a student goes to another company unless you connect an integration such as Google Classroom and send it there. Every sentence comes straight from the ratings you pick, so the app can put your evidence into words but cannot make things up.
One school can never see another's students
In a school account, the database itself blocks it. Not just the screen. Every record is stamped with its school. A request for another school's data is refused at the data layer. We test this with 13 checks that try to break in and confirm they fail.
A save history the app cannot rewrite
In a school account, each class push also tries to add a line to a log of what was saved and when, and each save of your own work keeps its earlier version. The app cannot edit or delete these entries. People with operator access to the database can still remove them during deliberate maintenance, such as a deletion a district asks for, and not every such removal is recorded yet.
An edit needs a new approval
In the app, a comment moves from draft to reviewed to approved to exported. An edit to an approved comment is not approved until the teacher approves it again. A comment written in the Standards workspace also keeps each earlier version in its history. A comment sent to a school account is stored as a draft, and a changed comment is added as a new copy instead of replacing the old one. People with operator access to the database can still change or remove stored comments during deliberate maintenance.
Never sold, never advertising, never AI training
We do not sell student information, use it for ads, build profiles from it, or feed it to AI training. There are no ad trackers and no third-party analytics. The hosted app has an optional first-party usage measurement of teacher activity that stays off until a teacher turns it on, and it collects nothing about students and nothing a teacher writes.
Your sign-in can't be stolen from the page
Sign-in details are held in a way the page's own code cannot read, and the app blocks outside scripts from running or sending anything anywhere.
We only keep what a comment needs
A random student code, grade, pronoun, the ratings you enter, and the comments made from them. No addresses, phone numbers, birthdays, photos, health information, or family details. Those fields do not exist in our system.
For school and district reviews
We can send your district the full review packet: what we collect and why, how it is protected, who we use to host it (Vercel and Supabase), which other companies see teacher details or can be connected by a school (Google, Google Classroom, Resend, Stripe, MasterAlp and Canva, listed in the privacy policy), what happens if there is a security incident, accessibility, and the data agreement your district signs. Signing in creates an account and a workspace before any agreement is signed, so the agreement sets the terms for the student records kept there. We will also tell you plainly what we have not done, so your review starts from facts. For example, no outside firm has security-tested us yet.
Request the procurement packageFound a vulnerability? Email support@papalotledu.com. Reports are acknowledged within 72 hours and never met with legal threats for good-faith research.