Privacy Policy

1. Information We Collect

• Account information — name, username/email, phone number, password (handled by Firebase Authentication; Core never sees your plaintext password), and account role.
• Family & student information — parent/guardian names and contact details, student names, birth dates, grade levels, emergency contacts, allergy or other health/safety notes, academic records (grades, attendance, behavior reports, assignments, transcripts), and any enrollment or application information you or your community administrator submit.
• Files and user content — documents, homework materials, photos, images, messages, and other files that an authorized user chooses to upload or share through Core, together with file names, types, and upload dates.
• Payment information — billing details are entered directly into Stripe, our payment processor. Core does not receive or store your full card number; we retain only transaction metadata (amount, date, status, and a Stripe reference ID).
• Communications — messages, support requests, and recommendations you send us, and records of notifications sent to you.
• Automatically collected information — IP address, browser/device type, and request timestamps, collected for security, fraud-prevention, and rate-limiting. Core does not add advertising trackers or analytics pixels. Google reCAPTCHA may collect device signals or use cookies as described below.
• Browser storage — Core uses local storage and session storage to preserve account-switching information, interface preferences, and temporary workflow state on your device. Signing out or clearing your browser data can remove locally stored state.
• Bot-detection signals (reCAPTCHA) — Core is protected by Google reCAPTCHA Enterprise, which collects hardware and software information (such as device and application data) and sends it to Google to distinguish real users from automated abuse. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. This information is used only for security and abuse prevention, not for advertising.

2. How We Use Information

We use the information above to operate and secure the platform; process enrollment applications and payments; deliver in-app, email, and text notifications; maintain academic and administrative records on behalf of the community administrators you interact with; detect and prevent fraud or abuse; enforce our Terms; comply with legal obligations; and maintain and improve the platform. We do not use your or your student's information for advertising, and we do not build advertising profiles.

3. How We Share Information

We share information only as described here:

• Community administrators — application, enrollment, and academic data is shared with the school community/communities you apply to or join, for their use in operating that community.
• Service providers — we use vendors to operate the platform and disclose only the information reasonably needed for their services: Google Firebase / Google Cloud (authentication, database and file hosting, and reCAPTCHA Enterprise bot detection), Stripe, Inc. (payment processing), Resend (email delivery), Twilio, Inc. (SMS/text delivery), Upstash (temporary rate-limit counters that may contain pseudonymous identifiers such as an IP address or account ID), and Vercel Inc. (application hosting). Their processing is also governed by their applicable terms and privacy commitments.
• Legal and safety — to comply with law, subpoena, or valid legal process, or to protect the rights, safety, or property of Core, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to you.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and similar state laws.

4. Student Education Records (FERPA)

For student education records, Core acts as a service provider (sometimes described as a "school official" with a legitimate educational interest) under the direction of the community administrators who use the platform. We do not use student education records for advertising or for any purpose beyond providing the platform. Community administrators are responsible for determining what student information is collected and for complying with the Family Educational Rights and Privacy Act (FERPA) and any applicable state student-data-privacy law. A parent or guardian seeking to inspect, correct, or delete their student's records should first contact their community administrator; Core will assist with verified requests and coordinate with the community administrator where the record is controlled by the school at coreschoolportal@gmail.com.

5. Children's Privacy (COPPA)

Core does not knowingly collect personal information directly from children under 13. Only parent or guardian account holders (18 or older) may create accounts, and student profiles are entered and controlled by that parent or guardian, or by a school administrator acting on the family's behalf in connection with school enrollment. Where an authorized school or educational institution provides student information to Core on behalf of families for school-authorized use, Core relies on that authorization where permitted by law, consistent with FTC guidance for the school-service-provider context, and does not use that information for any purpose other than providing the platform. Core remains responsible for complying with COPPA for its own operator obligations. A parent or guardian may review, request deletion of, or refuse further collection of their child's personal information at any time by emailing coreschoolportal@gmail.com. If we learn that we have collected personal information directly from a child under 13 without the required consent, we will delete it promptly.

6. Sensitive Personal Information

Information such as allergy or other health/safety notes may be considered "sensitive personal information" under some state privacy laws. We use sensitive personal information solely for the safety and administrative purpose for which it was submitted (for example, sharing allergy information with a student's teacher) and do not use or disclose it for any other purpose, including advertising.

7. Text Messages and Calls (TCPA)

By providing a phone number, you consent to receive text messages from Core and from your community administrators through the platform, including transactional notices, application and payment updates, and — where a community administrator enables it — emergency or safety broadcast alerts. Message and data rates may apply. Contact us at coreschoolportal@gmail.com with text-message questions or preferences. Where supported by the carrier or messaging provider, replying STOP will block further texts from that sending number; you may also contact us or your community administrator to update text preferences. Emergency broadcast messages sent by a community administrator to their own roster are rate-limited and intended for time-sensitive safety communication.

8. Email Communications (CAN-SPAM)

We send required service emails about security, password recovery, accounts, and payments, as well as optional copies of certain in-app community notifications. Each optional notification email includes a clear, simple unsubscribe link. Opting out stops optional email copies but does not stop in-app notices or required service messages. If Core sends marketing email in the future, it will use accurate sender and subject information, identify the message when required, include Core's valid postal address and a working unsubscribe method, and honor opt-out requests within the period required by law. We do not sell your email address.

9. Your Privacy Rights Under State Law

Depending on where you live, you may have rights under comprehensive state privacy laws — including California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, Texas's TDPSA, and similar laws in other states. Subject to applicable exceptions, these rights can include the right to:

• Know / access the personal information we hold about you.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of sale or sharing of personal information (Core does not sell or share personal information).
• Limit use of sensitive personal information (Core already limits this use — see Section 6).
• Non-discrimination for exercising any of these rights, and the right to appeal a denied request.

To exercise these rights, use More → Your Privacy & Data while signed in, or email coreschoolportal@gmail.com from the address associated with your account, or have an authorized agent do so on your behalf. We will verify your identity before fulfilling a request and will respond within 45 days (extendable by an additional 45 days when reasonably necessary, with notice to you). There is no fee to submit or have a request verified.

10. Data Security

We use safeguards designed to protect information, including Firebase Authentication for credential handling, encryption in transit (HTTPS/TLS), Firestore and Storage security rules that enforce role-based access, server-side authorization and rate limiting on API routes, upload type and size restrictions, and least-privilege access to community data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Data Retention

We retain account, enrollment, and academic-record data for as long as your account or your community's use of the platform remains active, and afterward for as long as needed to comply with legal, tax, or recordkeeping obligations, resolve disputes, or as directed by your community administrator — after which it is deleted or de-identified.

12. Data Breach Notification

If a security incident compromises your personal information, we will notify affected users and any legally required regulators in accordance with applicable state and federal data breach notification laws.

13. Where Your Information Is Stored

Core is designed for use within the United States and its territories. Core and its service providers may process information in the United States and in other locations where they operate, subject to their service configurations and applicable law. If you access Core from elsewhere, your information may be transferred to a country whose data-protection rules differ from those where you live.

14. Accessibility

Core is committed to making this platform usable by everyone, including people with disabilities, and is working toward the Web Content Accessibility Guidelines (WCAG) 2.2, Level AA. Core has not yet received an independent accessibility certification. If you encounter a barrier using Core or need this policy in an alternative format, contact coreschoolportal@gmail.com and we will work with you.

15. Third-Party Links and Services

Core may direct you to third-party services (for example, Stripe's checkout page) to complete certain actions. This Privacy Policy does not apply to those third-party services; please review their own privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where required by law, we will provide additional notice.

17. Contact Us

Questions about this Privacy Policy, or requests to exercise a privacy right described above, may be directed to coreschoolportal@gmail.com.