Privacy Policy

1. What we collect

• Account info: name, email address, and role (student/parent), from Clerk
• Date of birth (students only) — used only to gate under-13 accounts behind a guardian link
• Academic data you enter: courses, assignments, grades, calendar events, portfolio entries, degree plan, university application tracker
• Guardianship links between parent and student accounts, and their status
• School affiliations: schools you register or join, staff roles, class rosters
• Messages you send, and reports/blocks you file against other users
• Basic usage data needed to run the product (timestamps, streaks, XP)

2. How we use it

To run the features you use — showing your assignments, computing grades, syncing guardian views, delivering messages to people you're actually eligible to message, and enforcing the access rules described below. We don't sell your data or use it for advertising.

3. Who can see what

• Your assignments, grades, and calendar are visible only to you
• A linked parent/guardian (only after you accept the link, or after you invite them yourself) sees a high-level summary: GPA, per-course grades, upcoming deadlines, streak — not your individual assignment-by-assignment activity
• A teacher at a school-managed class you join can see your enrollment in that class; they do not automatically see your grades in that class (grading by teachers isn't built yet — see roadmap.md)
• Messages are visible to the people in that conversation, plus a platform admin if the message is reported
• A platform admin can review reported messages to enforce the Terms of Service

4. Third parties we use to run Schoolify

We use a small number of infrastructure providers to operate the service, each under their own privacy terms:

• Clerk — authentication (sign-up, sign-in, session management)
• Supabase — our database (Postgres), where your academic data lives
• Vercel — hosting for the application itself
• Upstash — short-lived rate-limiting data (to prevent abuse; not your academic content)

We don't sell data to these providers or anyone else — they process it strictly to provide their service to us.

5. Children's privacy (COPPA)

We ask for date of birth from student accounts specifically to identify accounts under 13 and require a linked parent/guardian before full access — see the disclaimer above for why this is a UI safeguard, not certified Verifiable Parental Consent yet. A parent can review and request deletion of their linked child's data by contacting us (below) or by deleting the linked account directly.

6. Data retention & deletion

You can delete your account at any time (Account → Security → Delete account). This permanently removes your personal data — assignments, enrollments, calendar events, activities, degree/application records, sent messages, guardian links, and block lists. Some structures you merely had a role in (like a class you taught) stay intact for other users, with your association to them removed rather than the whole record being destroyed.

7. Security

We use industry-standard practices (encrypted connections, provider-managed authentication, access controls enforced on every request) but no system is perfectly secure. If you believe your account has been compromised, contact us immediately.

8. Changes

We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page.

9. Contact

Questions, data requests, or to report a concern: therealtariqkhalif@gmail.com