Privacy Policy

1. Introduction

AtomicSchools, Inc. ("AtomicSchools," "we," "us," or "our") is committed to protecting the privacy of students, educators, parents, and all users of our educational technology services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including the AtomicSchools platform, PassJack digital hall passes, ClassMessage secure messaging, and all related educational tools (collectively, the "Services").

We comply with applicable privacy laws, including the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment (PPRA), and state student privacy laws such as the California Student Online Personal Information Protection Act (SOPIPA) and similar state regulations.

2. Our Platform and Services

AtomicSchools provides a comprehensive educational technology platform that includes:

• Student Information System (SIS): Student enrollment, demographics, class scheduling, and academic records management
• Gradebook: Assignment tracking, grade recording, and academic progress monitoring
• PassJack: Digital hall pass system for tracking student movement within school buildings
• ClassMessage: Secure messaging platform for communication between educators, students, and parents
• Learning Games & Challenges: Educational games, quizzes, and interactive learning activities
• Attendance: Daily attendance tracking and reporting
• Behavior Management: Positive behavior tracking and incident documentation
• Scheduling: Class schedules, bell schedules, and calendar management

3. Information We Collect

3.1 Information Provided by Schools and Districts

Schools and districts may provide us with:

• Student names, school-assigned student IDs, and demographic information
• Grade levels, homerooms, and class/course enrollments
• Teacher, staff, and administrator information
• Parent/guardian names and contact information
• School and district organizational structure
• Academic calendar and scheduling information

3.2 Student Information System (SIS) Data

Through our SIS functionality, we collect and process:

• Student enrollment records and class assignments
• Course schedules and section information
• Academic history and transcript data
• Special program participation (with appropriate permissions)

3.3 Gradebook and Academic Data

Our gradebook system collects:

• Assignment submissions and completion status
• Grades, scores, and rubric evaluations
• Teacher feedback and comments on student work
• Grade calculations and academic progress indicators
• Standards and learning objective mastery data

3.4 PassJack (Digital Hall Pass) Data

Our hall pass system collects:

• Pass requests including origin, destination, and purpose
• Pass duration and timestamps (start and end times)
• Pass approval/denial records and approving staff member
• Aggregate pass usage patterns for school safety and policy compliance

3.5 ClassMessage (Messaging) Data

Our secure messaging platform collects:

• Message content between authorized users (teachers, students, parents)
• Message timestamps and read receipts
• Attachments shared through the messaging system
• Communication logs for school record-keeping requirements

Note: All messages are subject to school review and are not private communications. Schools maintain full access to all messaging content for student safety purposes.

3.6 Learning Games, Challenges, and Educational Activities

Our educational games and interactive learning tools collect:

• Game scores, achievements, and completion data
• Quiz and assessment responses and results
• Learning activity participation and progress
• Time spent on educational activities
• Skill mastery and learning progression data
• Challenge completion and competitive rankings (within school context)

3.7 Attendance Data

Our attendance system collects:

• Daily attendance records (present, absent, tardy, excused)
• Class period attendance
• Attendance patterns and historical records

3.8 Behavior and Conduct Data

Our behavior management tools collect:

• Positive behavior recognitions and awards
• Behavioral incident reports (as documented by school staff)
• Intervention records and outcomes

3.9 Technical and Usage Data

When users interact with our Services, we automatically collect:

• Login timestamps and session information
• Device type, browser type, and operating system
• IP addresses (for security and access control)
• Feature usage patterns to improve our Services
• Error logs for troubleshooting and support

3.10 Information We Do NOT Collect

We do not collect:

• Social Security numbers
• Financial, banking, or credit card information from students
• Biometric data (fingerprints, facial recognition, etc.)
• Precise GPS geolocation data
• Health or medical records (unless specifically authorized by schools for nurse visits/passes)
• Data from personal social media accounts
• Information for advertising or marketing profiling

3.11 Information Kept Only in Your Browser

Until a school has authorized AtomicSchools to hold records about its students, or the teacher has given the attestation described in Section 12, a teacher may still build class rosters and issue hall passes for students they enter by name. That information is stored only in the teacher's own web browser on that device. It is never sent to our servers, we cannot see it, back it up, or recover it, and it is removed when the browser's site data is cleared. It is sent to us, and becomes subject to the rest of this policy, only after the school authorizes AtomicSchools or the teacher attests (see Section 12). Teachers remain responsible for handling such information in line with their school's own policies.

4. How We Use Information

We use collected information solely for legitimate educational purposes, including:

4.1 Educational Service Delivery

• Providing access to our SIS, gradebook, messaging, and learning tools
• Enabling teachers to manage classes, assignments, and grades
• Facilitating student learning through games and interactive activities
• Processing and tracking hall passes for student safety
• Enabling secure communication between educators, students, and families

4.2 School Administration

• Generating attendance, grade, and progress reports
• Supporting school scheduling and resource allocation
• Providing analytics to help schools improve educational outcomes
• Maintaining accurate student records as required by law

4.3 Safety and Security

• Monitoring hall pass usage for student accountability and safety
• Reviewing messaging content to prevent bullying and ensure student welfare
• Detecting and preventing unauthorized access to accounts
• Investigating potential policy violations at school request

4.4 Service Improvement

• Analyzing usage patterns to improve features and user experience
• Identifying and fixing technical issues
• Developing new educational tools based on educator feedback

We do NOT use student data for advertising, marketing, or commercial purposes. We do NOT sell, rent, or trade student information to any third party. We do NOT create advertising or marketing profiles of students.

5. Data Sharing and Disclosure

We may share information only in the following limited circumstances:

5.1 With Schools and Districts

We share student data with the school or district that has authorized the student's use of our Services. Schools maintain ownership and control over their student data.

5.2 With Parents and Guardians

Parents may access their child's information through school-authorized parent accounts, including grades, attendance, messages, and progress reports.

5.3 Service Providers

We use trusted third-party service providers for:

• Cloud hosting and data storage (Amazon Web Services)
• Web application hosting (Firebase Hosting, a Google service)
• Sign-in with Google, when you choose it (Google LLC; receives your sign-in request and returns your name, e-mail address and whether Google has verified it, never student records)
• Text-message delivery for notifications you or your school request (Twilio)
• Email delivery for account and school notices. No e-mail provider is connected today; we will name the provider here before any e-mail is sent on our behalf
• Campus maps (Mapbox; receives map tiles requests and approximate device location from the browser, never student records)
• Hall-pass printing for schools that enable it (PrintNode; receives the pass text sent to the printer)
• Payment processing for school subscriptions (Stripe; receives school billing details, never student records)
• Web fonts (Google Fonts; receives standard browser requests, never student records)

Each provider handles data under its published terms, which limit its use of the data to providing the service to us. Before adding a provider that could receive student records we review those terms and add the provider to this list; we do not add providers that claim a right to use student data for their own purposes.

5.4 Legal Requirements

We may disclose information if required by law, court order, or government regulation, or if necessary to protect the safety of students or others.

5.5 We Never Share Data With

• Advertisers or marketing companies
• Data brokers or resellers
• Any party for non-educational commercial purposes

6. Data Security

We implement comprehensive security measures to protect your information:

6.1 Technical Safeguards

• TLS encryption for all data in transit
• Encryption at rest for our databases and their backups (AES-256, managed by Amazon Web Services)
• Hosting in Amazon Web Services data centers; our databases are not reachable from the public Internet, only from our application servers and an access-controlled administrative relay
• Periodic security and privacy reviews of the application, recorded in our written security program (most recently September 2026), and a review before each new district is onboarded
• Server and database monitoring through Amazon CloudWatch

6.2 Access Controls

• Role-based access controls limiting data access to authorized users at the student's own school
• Multi-factor authentication (authenticator app) available to administrators
• Automatic session timeouts
• Audit logging of staff access to student records, of every deletion, and of every consent and authorization
• Support staff see production records only through a masked view that hides names, contact details and dates

6.3 Organizational Measures

• Access to student data is limited to named staff who are bound by confidentiality obligations and complete privacy and security training at least yearly
• A written information security program, including incident response and breach notification procedures, available to schools on request
• Yearly review of this policy and of the security program

7. Data Retention and Deletion

7.1 Retention Period

We retain student data only for as long as necessary to provide our Services or as directed by the school and applicable law. Our default schedule, which a school may shorten or lengthen for its own students in writing, is:

• Student roster records and enrollments: until the school directs deletion or its agreement ends (Section 7.3)
• Hall pass logs: the current school year plus one further school year, then deleted automatically
• Messages: three years from the date sent, then deleted automatically
• Learning-game and practice activity: the current school year, then deleted automatically
• Records of consent, authorization, access and deletion: kept as evidence for as long as the related account or agreement exists and for six years after

Automatic deletion is paused for a student or school while a records-inspection request, correction request or legal matter is open. Each pause has an owner, a stated basis and a review date.

7.2 Data Deletion

Schools may request deletion of student data at any time. Upon receiving a verified deletion request:

• We will delete or de-identify the data within 30 days (school administrators can do this immediately from the application)
• We will confirm deletion in writing to the requesting school
• Automatic database backups expire within 35 days; we keep no other copies

7.3 Account Termination

When a school terminates their agreement with AtomicSchools, we will:

• Provide data export in a standard format upon request
• Delete all school and student data within 60 days of termination
• Provide written certification of data deletion

8. Parental Rights and Access

Parents and guardians have the right to:

• Review their child's personal information held by AtomicSchools
• Access their child's grades, attendance, and progress reports
• View messages sent to or from their child (subject to school policy)
• Request correction of inaccurate information
• Request deletion of their child's information

For a child whose school uses our Services, please contact the school, as it maintains control over student education records under FERPA. Schools can facilitate access through parent accounts or by contacting us on your behalf, and we respond to a school's request within 30 days. Our rights process is described in Section 9.

9. Student Rights

Students using our Services have the right to:

• Access their own educational records through our platform
• Expect that their data will be used only for educational purposes
• Know that their information will not be sold or used for advertising
• Have their data protected by industry-standard security measures

Under FERPA the rights in a student's education records belong to the parents until the student turns 18 or attends a postsecondary institution, at which point they transfer to the student.

9.1 How to exercise your rights

If you registered on your own (Section 10.1) and no school directs your use, you deal with us directly. The Privacy & data page in your account lets you download everything we hold about you and delete your account immediately; being signed in to the account is how we verify the request. You can also ask us for a correction there or by e-mail, and we answer within 30 days.

If a school directs your use, your school holds the records and we act on its instructions. You or your parent ask the school; the school can view, correct, export or delete the records in the application or ask us to. We answer a school's request within 30 days and, for an inspection request, preserve the records until it is resolved.

Requests sent to privacy@atomicschools.com are logged with the date received; we may ask you to confirm the request from the e-mail address on the account before acting.

10. Children's Privacy (COPPA Compliance)

Our Services are designed for use in K-12 schools and are not directed at children under 13 outside of the school context. We collect information from children under 13 only with the consent of schools, which act as authorized agents for parents under COPPA.

Under this school consent model:

• Schools authorize collection of student data for educational purposes
• Parents can review school policies and opt-out through their school
• We collect only information necessary for educational services
• We do not use children's data for commercial purposes
• We do not enable public profiles or social features for children under 13

10.1 Accounts created without a school

A person may create an account on their own to practice with our learning games. Before an account is created we ask for a birth date on a neutral screen; the date is used once, is not stored, and if it shows the person is under 13 no account is created and nothing entered is kept. A self-created account is limited to practice features until the person joins a class with a code from their teacher, or a school with authorization to do so adds them to a class.

11. California Privacy Rights

California residents, including students, have additional rights under SOPIPA and the California Consumer Privacy Act (CCPA):

• We do not sell personal information of any users, including students
• We do not use student data for targeted advertising
• We do not create profiles of students for non-educational purposes
• Schools and parents may request data deletion as described above

12. Data Privacy Agreements

We sign Student Data Privacy Agreements (DPAs) with schools and districts, including the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) where a district uses it. These agreements provide additional contractual protections for student data.

A school may also authorize AtomicSchools directly: a principal or district administrator with authority to act for the school accepts our School Authorization Agreement inside the application.

A teacher may adopt AtomicSchools for their own classes before the school has done either. To hold roster records on our servers, the teacher first attests that they are employed or engaged by the school, that they are permitted to use AtomicSchools with their classes, that the school has been told and has this policy, and that they are responsible for the notice to parents and for consent or an applicable exception, including the school's consent for students under 13. The attestation is recorded with the teacher's account, applies only to that teacher's own classes at that school, can be reviewed and withdrawn by the school or by us, and is superseded by the school's agreement when one exists. Until a school agreement or a teacher attestation exists, we hold records only about students who created their own accounts, and teachers' rosters stay in their own browsers as described in Section 3.11.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes:

• We will notify schools via email at least 30 days before changes take effect
• We will post the updated policy on our website with a new "Last Updated" date
• We keep every previous version of this policy and provide it on request

14. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us:

For data access, correction, or deletion requests, please contact your school first, as they maintain control over student educational records. Schools may then contact us to facilitate your request.