Privacy Policy

1.Introduction & Scope

Classrin ("Classrin," "we," "our," or "us") provides academic scheduling, communication, campus-life, and school-store software for students, teachers, and school districts. We are committed to protecting the privacy and security of every user, with heightened protections for students and minors.

This Privacy Policy applies to the Classrin websites, web app, iOS and Android apps, and related services (collectively, the "Services"). By using the Services, you acknowledge the practices described here. Where a school or district has a separate written agreement or Data Privacy Agreement (DPA) with us, that agreement governs student data and controls if it conflicts with this policy.

2.Our Role & Legal Basis for Processing

When Classrin is used in a school setting, the school or district is the owner and controller of student education records, and Classrin acts as a "school official" with a legitimate educational interest under FERPA and as a service provider processing data solely on the school's behalf and under its direction.

For independent accounts (Section 3), there is no school involved, and Classrin is responsible for that account's data under this policy.

We process personal information on these bases: (a) to perform our agreement with the school or user; (b) with school authorization or verifiable parental consent for students; (c) to meet legal obligations; and (d) for limited legitimate interests such as securing the Services, that never override student protections.

3.School Accounts & Independent Accounts

Classrin has two kinds of accounts, and some rules in this policy depend on which one you have:

• School accounts are connected to a school on Classrin. They are created through a school's sign-up, through district single sign-on (ClassLink), or by a school administrator's teacher invite. The school controls student data in these accounts.
• Independent accounts are for people 13 or older whose school isn't on Classrin. They are not connected to or shared with any school. See Section 9.

If you later sign in through your school (for example with ClassLink) or accept a school invite, your account becomes a school account and the school-account rules in this policy apply from then on.

4.Information We Collect

A. Information you or your school provides

• Identity & contact: name, email address, and (optionally) phone number
• Profile: display name, bio, and an optional profile photo and banner image that you upload
• Academic information: student or staff ID, schedule and course data, class preferences, and school features your school turns on (for example, room assignments)
• Roster data: names, emails, roles, schools, classes, enrollments, and terms provided through district rostering (ClassLink or OneRoster). See Section 8.
• Independent-account details: birth month and year, and the school name and type you type in. See Section 9.
• Store orders: items ordered, delivery room, order status, and payment status, plus any dietary preferences you choose to save. See Section 10.
• Content you create: messages, posts, club and board activity, to-dos and notes, suggestions, support requests, and feedback
• Optional connections: if you connect a Canvas account, your Canvas domain and an encrypted access token so we can show your courses and assignments
• Account credentials: login email and authentication identifiers (district single sign-on users don't need a separate Classrin password)

B. Information collected automatically

• Device and browser information, including app version and device name for push notifications (see Section 12)
• Log and diagnostic data (e.g., IP address, timestamps, error logs)
• Usage data (features accessed, time spent, interaction patterns) for operating and improving the Services
• Strictly necessary cookies and similar technologies (see Section 22)

5.How We Use Information

We use information only for educational, operational, and service-related purposes, including to:

• Provide, maintain, and secure the Services
• Personalize scheduling and school-related features
• Support school-authorized educational activities
• Process and deliver store orders
• Send notifications you or your school have turned on
• Moderate content to keep the Services safe (see Section 11)
• Monitor performance, debug, and improve functionality
• Detect, prevent, and respond to security incidents, fraud, or misuse
• Provide customer and technical support
• Comply with legal obligations and enforce our Terms

6.What We Never Do

• We do not use student data for targeted advertising or to build advertising or commercial profiles.
• We do not show ads in Classrin today, on any account, and we don't load ad code. If we ever introduce ads, we will update this policy and give notice before they start.
• We do not use student data for any non-educational commercial purpose.
• We do not retain, use, or disclose student data beyond what the school authorizes or the law permits.
• We do not use automated decision-making to profile students for advertising.

These commitments reflect the principles of the Student Privacy Pledge and the requirements of SOPIPA-style state laws.

7.Compliance & Commitments

We design the Services to align with the leading federal and state student-privacy frameworks, including:

• FERPA — the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g)
• COPPA — the Children's Online Privacy Protection Act, for users under 13
• PPRA — the Protection of Pupil Rights Amendment
• SOPIPA and the 100+ comparable state student-data-privacy laws adopted across the U.S.
• Applicable state consumer-privacy laws (e.g., the CCPA/CPRA in California) for non-student, adult users

8.School Rostering & Single Sign-On

Schools can connect Classrin to their district systems through ClassLink single sign-on and OneRoster rostering. A school administrator sets up the connection.

• What we receive: names, emails, roles, schools, classes, enrollments, and academic terms from the district's roster.
• Use: data from districts is used only to provide the Services to that school — for example, placing students and teachers in the right classes and schedules.
• No automatic accounts: roster entries are held as "waiting" records until that person first signs in through their school. We don't create accounts or contact anyone from roster data alone.
• Secrets: rostering credentials are stored encrypted in a secrets vault, not in plain text.
• Changes: when a class ends or leaves the roster, it is marked inactive rather than erased, so schools keep their history. Students removed from the roster lose those classes.

9.Independent Accounts

Anyone 13 or older can sign up without a school by choosing "My school isn't listed." These independent accounts work differently from school accounts:

• Age: you must be 13 or older. We ask for your birth month and year only to check this. We don't let anyone under 13 create an independent account.
• What we collect: your name, email, the school name and type you type in, your birth month and year, and the classes you add to your schedule.
• No ads: independent accounts are free and don't show ads. If that ever changes, we will update this policy and give notice first.
• Not shared with schools: your independent account isn't connected to any school or district, and we don't share it with one. The school name you enter is only shown to you.
• Your choices: you can delete classes at any time, and delete your whole account yourself (Section 18).

10.Store Orders & Payments

Some schools let their existing school stores (such as a student store or booster club) take orders on Classrin for delivery to a room on campus. The school store is the seller. Classrin provides the ordering and delivery platform and the payment connection; we don't sell the items.

• Card payments are processed by Clover under the store's own Clover merchant account. Card details are entered into Clover's secure payment fields and go directly to Clover. Classrin never sees or stores full card numbers. We receive the payment result and limited card details such as the card brand and last four digits.
• Platform fee: Classrin charges a 5% platform fee on the goods in online orders (not on tax), shown before you pay.
• What the store sees: the store's staff and delivery runners see what they need to fill your order, such as your name, items, and delivery room.
• Refunds: refunds follow the store's policies. When the store approves a refund, Classrin processes it through Clover for the store.
• Order history: orders, payments, refunds, and store audit records are kept for the store's financial records, including after an account is deleted (with the name removed — see Section 18).

11.Content Moderation

Because Classrin serves students, we use AI-assisted content moderation to help detect harmful or inappropriate content. Display names, bios, profile photos, banners, and message text may be sent to an AI model for review. Today that model is Google Gemini, reached through Lovable's AI gateway.

• What is sent: only the text or image being checked, plus our moderation instructions. We don't send your full profile, email address, or account details.
• Content is sent only to check it against our content rules, not to build advertising profiles.
• Flagged content may be hidden or held for review by a person, and you'll see a notice with a reference ID. If you think we got it wrong, email Support@classrin.com.
• School administrators may see moderation flags for their school's users.
• Automated moderation is not perfect and does not guarantee that all objectionable content is caught.

12.Push Notifications

If you allow notifications, we store a device token for your device, along with the platform, app version, and device name, so we can send you alerts such as order updates and messages. Tokens are delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging on Android where enabled. A token is removed when you sign out on that device or delete your account, and you can turn notifications off at any time in your device settings.

13.How We Share Information

We share personal information only in these limited situations:

A. Service providers (subprocessors)

Trusted vendors who host, secure, and operate the Services under contract. Each may use data only to provide services to us. See Section 14.

B. Within your school

For school accounts, teachers, administrators, and store staff at your school see the information they need for their role, as your school configures it.

C. At your school's direction

If a school or district instructs us to access, export, transfer, or delete data, we act on that instruction.

D. Legal compliance & safety

To comply with applicable law, lawful requests, or legal process, and to protect the rights, safety, and security of users, the public, or Classrin.

E. Business transfers

If Classrin is involved in a merger, acquisition, or asset sale, affected schools will be notified, student data will remain subject to this policy and any DPA, and districts retain all FERPA rights.

14.Subprocessors

We rely on a small set of infrastructure providers. The current list is:

We update this list as our providers change; material changes affecting student data are communicated to schools under their DPA.

15.Data Security

We apply administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit (TLS) and at rest
• Row-level access controls and the principle of least privilege
• Authentication via district SSO and scoped access tokens
• Encrypted storage of integration secrets and access tokens
• Audit logging and monitoring of sensitive operations
• Content moderation and safety controls on user-generated content
• Regular review of access, dependencies, and configuration

No method of transmission or storage is 100% secure, but we work to meet or exceed industry-standard practices and to improve continuously.

16.Data Breach Notification

If we discover a security incident that compromises personal information, we will investigate promptly, take steps to contain and remediate it, and notify affected schools or districts without undue delay and consistent with our contractual obligations and applicable law. For students, we notify the school so it can fulfill its notification duties to parents and authorities. For independent accounts, we notify affected users directly as required by law.

17.Data Retention

• We retain personal information only as long as necessary to provide the Services or as required by a school agreement or law.
• Store orders, payments, refunds, and audit records are kept for the store's financial records, with the name removed if the account is deleted.
• Residual copies may persist in secure backups for up to 90 days and are not used for any operational purpose before being purged.
• On termination of a school's agreement, student data is deleted or returned per the school's instruction and any DPA.

18.Deleting Your Account & Data

You can delete your Classrin account yourself at any time. Step-by-step help is on our Delete your account page.

A. How to delete

In the web app, go to Profile → Account → Delete account. In the iOS or Android app, open Profile, scroll to the bottom, and tap Delete account. Type DELETE to confirm. Deletion happens right away. If you can't sign in, email Support@classrin.com from your account email.

B. What is deleted

Your personal data, including your profile, profile photo and banner, schedules, to-dos, notes and calendars, friendships, direct messages, group messages you sent, posts and club activity, suggestions and support tickets, device tokens, roles and school memberships, room claims, roster class links, connected Canvas link, and your sign-in.

C. What is kept, and why

• Store orders, payments, refunds, and store audit records are kept because the store needs them for its financial records. Your name is removed from them.
• Audit and moderation records keep what action was taken, but your name and the old profile text are removed.
• Records other people rely on (for example, an order you accepted as store staff) stay, with you removed from them.
• Group chats you created are handed to another member, or deleted if nobody else is in them.
• Backup copies are purged within 90 days.

D. When deletion is blocked

• You have a store order in progress — wait until it's delivered or cancelled.
• You manage a store that still has orders in progress.
• You're your school's only full-access administrator — give another staff member full access first.
• Platform administrator accounts can't be deleted from the app.

E. ClassLink students

If your school rosters you through ClassLink and you sign in with ClassLink again after deleting, you'll get a new, empty account. Your old data does not come back. To stop an account from being created again, ask your school.

F. Requests from schools and parents

• Schools and districts can request deletion of their students' data at any time by emailing Support@classrin.com. We complete school requests within 30 days unless a longer period is legally required.
• Parents and guardians can request deletion of their child's data by emailing Support@classrin.com. We verify the request, coordinate with the school for school accounts, and respond within 30 days.

19.Your Rights

Students, parents, and school administrators may request to:

• Access the personal information we hold — signed-in users can use Profile → Account → Download my data in the web app
• Correct inaccurate information
• Delete information (see Section 18)
• Export information (portability)
• Restrict processing for non-educational purposes

Because schools control student records, student and parent requests for school accounts are generally directed through the school administrator, who may act on the student's behalf. You can also contact us at Support@classrin.com and we will coordinate with your school. We respond within 30 days. We do not discriminate against anyone for exercising these rights.

20.Children Under 13

For students under 13, Classrin collects personal information only with school authorization (acting under COPPA's school-consent provisions) or with verifiable parental consent. Independent accounts are not available to anyone under 13. We do not knowingly collect personal information from children under 13 outside of these authorized channels. If you believe a child provided information without proper authorization, contact Support@classrin.com and we will delete it.

21.California & State Privacy Rights

For student data, we comply with SOPIPA and comparable state laws: we do not sell student data, do not use it for targeted advertising, and do not create non-educational profiles. For adult users in California, the CCPA/CPRA gives rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell personal information. We do not "share" personal information for targeted advertising. Residents of other states with similar laws have comparable rights. Submit requests to Support@classrin.com.

22.Cookies & Tracking

We use strictly necessary cookies and similar technologies to keep you signed in, maintain security, and operate core features. We do not show ads, load ad code, or use third-party advertising or cross-site tracking cookies on any account. You may restrict cookies through browser or device settings, though some features may not function without them.

23.Data Location

Classrin stores data primarily in the United States. Some subprocessors, such as the AI moderation provider in Section 14, may process data in other locations under their own safeguards.

24.Changes to This Policy

We may update this policy to reflect changes in our practices, technology, or the law. Material changes affecting student data will be communicated to schools. Updated versions carry a new "Last updated" date, and continued use of the Services after an update constitutes acceptance of the revised policy.

25.Contact Us

Questions, requests, or privacy concerns:

Classrin Support
Email: Support@classrin.com
Address: Charleston, SC, USA