We don’t need your data. So we don’t take it.

We do not advertise to students, and we never will.

There is no advertising network, no marketing pixel and no tracking script anywhere in this site. Not disabled — absent. You can confirm it in your browser’s network tab.

We do not sell, rent or trade anyone’s data. There is no version of this we would do.

Our schools pay us. That is the entire business. Selling data would be a different company.

Organizations that post opportunities never receive student data.

Organizations see their own listings and their own account — nothing about who viewed, saved or attended. That is enforced in code by an explicit list of the only fields an organization may be shown; anything outside the list stops the request rather than quietly passing through.

Reports never expose small groups.

When a statistic would describe too few students to stay anonymous, it is withheld rather than rounded. An automated check runs on every code change and fails the build if a new report skips that rule.

When data is deleted, it is gone — with one exception we will name.

Deletion removes the record rather than hiding it, and we specifically test that a later roster import cannot resurrect a deleted student — the usual way “deleted” turns out to mean “hidden”. The exception: if you report an organization as unsafe and later delete your account, your name and your words are removed but the fact that a report was made is kept. Three reports about one organization protect other children, and one person leaving should not erase that.

Software reads what a student writes. It may sort it into a subject; it may never attach a name to it.

When a student asks for something anonymously, no adult at the school can read what they wrote — but the school still has to be able to tell "somewhere to fix bikes" from "a beginner art workshop", or nothing anonymous ever gets acted on. So the software reads the words and records ONE value from a fixed list of subjects we publish: creative arts, athletics, community service, and twenty-four more. It records nothing else. It never writes a note about the student, never adds the request to anything that decides what that student is shown next, and never lets a person see the words. Grouping requests and doing something about them stays a person’s decision, and a group is only ever shown to anyone once enough separate students have asked for the same thing.

The assistant is scoped, masked and logged.

Identifying details are stripped before any question reaches the language model, every request is logged, usage is capped per school, and nothing is used to train anyone’s model.

Your school decides. We only hold the data.

Schools own their records and we act on their instructions. Every query for a student record passes through one scoping layer that adds the school boundary automatically — a query that forgets to filter is refused rather than answered — so forgetting is not sufficient to cause a leak. Database-level enforcement underneath that is written and tested but not yet switched on, and we say so on the security page rather than describing it as though it were.

Most data has no automatic expiry.

We have written down how long every table in the product should live — all 124 of them — and a scheduled job enforces that on 54. The rest are deleted when somebody asks, not when a clock says so, which means a graduate’s record stays until a school directs otherwise rather than ageing out on its own. A build check counts the unenforced ones and refuses to let that number rise. We would rather tell you the number than describe the register as though it ran.

Nothing here has been tested with a screen reader.

Our checks are automated analysis, manual review, and — since August 2026 — real measurement in a browser across every page and role. None of that can tell you how something is announced to a blind user. We would rather say so than let the absence of a known bug read as evidence there is none.

Some staff and operator screens fail our own contrast standard.

A browser pass in August 2026 measured colour as it actually renders rather than as the design tokens promise, and found text as faint as 1.09:1 against its background where 4.5:1 is required. Every instance is on a staff or administrator screen, not a student one. They are named individually in our conformance report, which we will send on request.

Database-level tenant isolation is written but not switched on.

Separation between schools is enforced today by a scoping layer every query passes through. The second layer beneath it — the database refusing cross-school reads on its own — exists and is tested but is not yet enabled in production. Both facts are on the security page in the same words.

Our email domain is monitored for impersonation, not protected from it.

Mail we send is cryptographically signed. But our published policy tells receiving mail servers only to report a forged message, not to reject one — so someone impersonating our domain to a parent would probably still be delivered. Moving to enforcement is a configuration change we have not yet made, and until we do this is worth knowing.

No independent security certification.

We hold no SOC 2 report, no ISO certificate, and have commissioned no third-party penetration test. Everything on these pages is our own account of our own system, backed by code you can ask us about. If your district requires an independent attestation, we do not have one, and we would rather you learn that here than three months into a procurement.