For school technology and privacy staff · Updated November 1, 2026
Privacy & Security for Schools
Plain answers to the questions school districts ask most. Everything here reflects how The Yearbook App actually works today — nothing aspirational. For the legal wording, see the Privacy Policy and Terms of Use.
Data
What student data do you collect?
Only what a school’s advisor adds: student names, grade levels, photos, and the tags, events, and notes that describe them. Family members can add photos and details through a school’s upload link, and the advisor reviews each one before it is saved.
What do you never collect?
We never collect student ID numbers, birthdates, addresses, phone numbers, or student email addresses. Students never create accounts. Roster imports accept name and grade only — anything else in a spreadsheet is left out.
Who owns the data?
The school does. We store, process, and display it only on the school’s behalf, and only so the service works. The school can export or delete its data at any time.
Do you sell data, show ads, or train AI on student data?
No, never. We never sell student information, never use it for advertising, and never use student photos or records to train AI models. No processor we use may do those things either.
Where is data stored?
Only in the United States. The database, sign-in accounts, and photos are stored in the US West (Oregon) region of our database provider, Supabase, on Amazon Web Services. Cloudflare delivers web traffic through its global network, but student data is not stored there.
Vendors
Which third parties (subprocessors) handle our data, and what does each receive?
A small number of trusted companies help run the service. Each may use data only to provide its service to us:
| Provider | What it receives | Why |
|---|---|---|
| Supabase (on Amazon Web Services, US West — Oregon) | The database, sign-in accounts, and photos | Stores all school data, only in the United States |
| Cloudflare | Web requests passing through its network; the nightly backup copy of photos | Hosts and delivers the website (student data is not stored there); holds photo backups in a private US bucket (R2) |
| Resend | Advisor email addresses and email message content only — never rosters | Delivers account, sign-in, and billing emails from mail.theyearbookapp.com (US region) |
| Lovable | Web requests; technical logs and error reports (error messages, stack traces, page paths, and technical context); the typed helper question and its page | Provides app hosting and deployment on Cloudflare infrastructure, technical logging and error reporting, and the helper’s AI gateway |
| OpenAI | Only the question typed into Ask a question and the page it was asked from | Writes the helper’s replies, through Lovable’s AI gateway, with data storage turned off |
| Stripe | Payment card details and billing information | Processes payments; card details never touch our servers |
| Sign-in identity details (only if Continue with Google is chosen); public-page visits | Optional sign-in; Google Ads measurement tag on public pages only | |
| Microsoft | Public-page visits (clicks, scrolling, page views) | Clarity website analytics on public pages only |
Do you use AI with student data?
Only in one narrow place. Ask a question, the in-app helper, sends the question you type and the page you are on to an OpenAI model, reached through Lovable’s AI gateway, so it can write a reply. Data storage is turned off, and no student records, rosters, or photos are ever sent. We never use school data to train AI models.
What tracking or analytics do you use?
Microsoft Clarity and a Google Ads measurement tag run on public pages only. Lovable also injects hosting measurement scripts: their public-page requests include page addresses, referring addresses, browser/language information, an approximate country, random session identifiers and performance or error details. The app blocks their analytics and replay requests on workspace pages, sign-in pages and family upload links, and after sign-in for the rest of that visit. Hosting scripts may still appear in the browser’s list of loaded files; that does not mean their tracking requests are allowed. Automatic click-label capture and page-content replay are blocked throughout the app, so those trackers do not receive student names, photos or page content. Hosting web-request logs and the separate technical error reporting described below are not visitor analytics.
Security
How is data encrypted?
In transit with TLS 1.2 or newer, and at rest with AES-256 encryption.
Who can access our school’s data?
Only the workspace owner and the co-advisors the owner invites. This is enforced in the database itself: every table that holds school data has row-level security, so one school’s data cannot be read by another school, even by mistake. The owner can remove a co-advisor’s access at any time in Settings.
Can your staff see our data?
The founder doesn’t view your photos or records, except to fix a problem your school reports. The Yearbook App staff follow the same rule, including for community submissions. Review and approval of every photo is done only by your school’s own advisors.
Do you use facial recognition?
No. The service uses no facial recognition, face detection, or biometric technology of any kind. Tagging people in photos is done by hand, by your school’s own advisors.
What login protections do you have (passwords, Google sign-in, MFA)?
Passwords must meet a minimum length and are stored only as secure hashes — never in plain text. Advisors can also sign in with their Google account. We do not currently offer multi-factor authentication (MFA); if your district requires it, tell us at support@theyearbookapp.com so we can plan for it.
What do you log, and for how long?
Lovable provides app hosting and deployment on Cloudflare infrastructure, technical logging and error reporting. Error reports can include error messages, stack traces, page paths, and technical context. Supabase keeps database and sign-in logs. Microsoft Clarity and Google Ads are the public-page measurement services listed above. No separate Sentry, Bugsnag, Datadog, or PostHog service is configured in the app. Provider log retention depends on the provider and its settings; we have not independently verified each retention period.
Do you have security certifications?
We do not hold our own certification yet — we are a small company and will say so honestly. What we do: we run on certified infrastructure (Amazon Web Services, Cloudflare, and Stripe, which is PCI-compliant for payments), encrypt data in transit and at rest, enforce row-level security in the database itself, limit access to the workspace owner and invited co-advisors, and keep our staff away from school data except to fix a problem you report.
Retention and deletion
How long do you keep data?
While the account is active, or until the school deletes it. If a free trial ends without a subscription, the school’s data is kept for 12 months and then permanently deleted — with warning emails 30 days and 7 days before.
What happens when we delete a photo?
Single entries, events, staff photos, and shared photos from Advisor Review you delete rest in a private Recently deleted archive for 14 days, and you can restore them from Settings during that time. After 14 days they are permanently purged, and the backup copy is removed within 14 days after that — so a deleted photo can exist anywhere for at most 28 days.
What happens when we delete our account?
Everything — records, photos, submissions, settings, the archive, and the school’s backup copies — is permanently purged immediately, and any active license is canceled. The provider’s daily database backups age out within about 7 days. Billing records may be kept as long as tax and accounting laws require.
What happens if our free trial expires?
Your data is kept, read-only, for 12 months. We email the advisor 30 days and again 7 days before the 12 months are up. If no subscription has started by then, the school’s data is permanently deleted and we confirm by email. The advisor’s sign-in still works, so starting fresh is always possible.
Can we export our data, and in what formats?
Yes, anytime from Settings: a JSON file of all records, a CSV spreadsheet of coverage, and your original photo files.
How long do backups keep deleted data?
Photos are backed up nightly to a second private US storage location. When a photo is permanently purged, its backup copy is removed within 14 days — at most 28 days in total. The database is backed up daily by our database provider, and those backups age out within about 7 days. Backups exist only to recover from system failures — never to restore individual deleted items.
Compliance and legal
Are you FERPA compliant?
For FERPA purposes, we act as a “school official” with a legitimate educational interest. We work under the school’s direct control over how education records are used and maintained, and we use those records only for the purposes the school has authorized.
What about COPPA?
The service is not directed to children under 13, and children never create accounts. Where a school provides student information, it does so as the agent of parents, as COPPA allows for school purposes.
Will you sign our district’s data privacy agreement?
Yes. We’re glad to review and sign data privacy agreements required by your school or district. Email support@theyearbookapp.com with your district’s agreement.
How do parents request to see or correct their child’s data?
Through the school. Because the school controls its yearbook, parents ask the school’s advisor, who can review, correct, export, or remove a photo or a student’s information at any time. If a parent contacts us directly, we forward the request to the school and help the school respond.
What happens if there’s a data breach?
If we confirm a security breach involving your school’s data, we will notify your school within 72 hours of confirming it, and we will cooperate with your school’s response.
What if law enforcement requests our data?
We will notify your school before disclosing its data, unless the law forbids us from doing so, and we will disclose only what the law requires.
Will you tell us before changing your privacy policy?
Yes. If we make a meaningful change, we let advisors know by email or in the app before it takes effect. The “Updated” date at the top of the policy always shows the latest version.
How are family photo uploads handled?
A school’s upload link can be shared with families and revoked by the advisor at any time. Submitters must be adults (18 or older), or students with a parent’s or guardian’s permission, and each submission includes a permission confirmation. Submitters cannot see the review queue, other people’s submissions, or other submitters’ identities. The advisor reviews every photo before anything is saved to the school’s collection.
Have a question we didn’t answer? Email support@theyearbookapp.com.