How Core approaches account security, role-based access, private student data, payments, account exports and deletion requests.
Community admins manage their school, teachers work with students in the classes they teach, and families see their own students. Private application routes verify signed-in users before returning protected data.
Firestore and file-storage rules restrict access by signed-in identity, community membership and role. The public marketing site never publishes a school's private roster, records or community documents for search engines.
Core uses Firebase Authentication, server-side token verification, request rate limits and bot-detection controls on sensitive account workflows. Password reset and recovery requests are limited to reduce automated abuse.
Card payments are processed by Stripe. Core records transaction status and references needed for the school ledger, but does not receive or store a user's full card number.
Signed-in users can request an export of their account data and submit an account deletion request from the More section. Some school records may need to be retained by the school or as required by law.
Core uses validation, security headers and automated checks as part of development. No public page claims that software can eliminate every risk, and schools should evaluate Core against their own legal and policy requirements.
Core's intended access model limits families to their own student information. Protected server routes verify authentication, while database rules use identity, membership and role to restrict direct access.
No. Card details are entered into and processed by Stripe. Core stores only payment references and status information needed to connect the transaction with the school's records.
Yes. Account data export and deletion-request controls are available to signed-in users in Core's More section, subject to records a school or applicable law requires to be retained.
The Privacy Policy explains what Core collects and how it is used. The Terms describe responsibilities that apply to Core, schools and account holders.