Privacy Policy
Last updated: the date shown at the bottom of this page. This policy explains what School Circle Network collects, why, and what choices you have.
1. Who We Are
School Circle Network ("we", "us", "our") is a community platform, operated in the United States, connecting school Parent-Teacher Organizations (PTOs), parents, teachers, school and district staff, and local businesses that support schools. This policy is written primarily for visitors in the United States; Section 12 below addresses additional information for visitors in the EU, EEA, or UK. If you have questions about this policy or how your information is handled, contact us at contact@schoolcircle.net or via our Contact page.
2. Information We Collect
Account information
When you register, we collect your name, email address, and a password (stored as a one-way cryptographic hash — we never store or can see your plain-text password). You may optionally add a profile photo, cover photo, short bio, and select which school(s) and role(s) you're affiliated with (parent, PTO member/officer, teacher, business owner, community supporter, etc.).
Information about your children
If you add a student under your account (for example, to see grade-specific supply lists), we collect that student's first name, last name, and grade. This information is entered by you, the parent or guardian — never by the child directly — is visible only to you in your own account, and is used only to match your child's grade against supply-list content a teacher has published for that grade. We do not publicly display student names, do not use facial recognition, and do not allow tagging or identifying a child in any photo or video anywhere on the platform.
Content you contribute
Anything you choose to post is stored and, depending on the visibility you or an organization manager selects, may be shown publicly: forum posts and replies, business directory listings and reviews, PTO/school/district news posts, event details, photos you upload to a Media gallery, and links to third-party videos/posts you choose to embed.
Business directory information
If you list a business, we collect the business name, description, category, contact details, logo, and any promotions or certificates you create, along with reviews left by other members.
Payment information
If a PTO you belong to accepts memberships or donations through the platform, payment is completed directly on Stripe's or PayPal's own secure, hosted payment page. We never receive, see, transmit, or store your full card number or bank details — we only receive confirmation of payment status (e.g., succeeded, refunded) and the amount, which we store so the relevant PTO can keep accurate records.
Contact form submissions
When you contact us, a school, a PTO, or a district through a Contact form, we collect the name, email address, organization (if provided), message, and the IP address you submitted from, so we can respond and guard against abuse.
Technical and log information
Like virtually every website, our server automatically logs your IP address, browser type, and access times for security, fraud prevention, and troubleshooting.
Push notifications
If the site operator has enabled push notifications and you explicitly grant your browser permission, a device push-subscription identifier is stored via our notification provider (OneSignal) so we can deliver notifications you've opted into. You can revoke this at any time from your browser's own notification settings.
Cookies
We use a small number of cookies, described in full in our Cookie Policy, and — where required — ask for your consent before any non-essential cookie is set.
3. How We Use Your Information
- To create and maintain your account, and to show you content relevant to your school(s), PTO(s), and role(s);
- To operate features you use directly: the community forum, business directory, events, supply lists, and photo/video galleries;
- To process membership payments and donations through our payment processors, and to send related receipts;
- To respond to messages sent through Contact forms;
- To send account-related and, if you've opted in, notification emails or push notifications;
- To detect and prevent spam, fraud, and abuse (including checking a contact submission's IP/email against a shared spam-reporting service, and using a bot-detection challenge on public forms);
- To comply with legal obligations and to enforce our Terms & Conditions.
We do not sell your personal information, and we do not use your data to build advertising profiles.
4. How We Share Information
We do not sell your personal information. We share it only with:
- Other members, as intended by the feature — e.g., your name and role are visible to people in your school/PTO's directory if you've opted in; content you post publicly is visible to visitors;
- Service providers who process data on our behalf, under contract, and only to the extent needed to provide their service: our email delivery provider, Stripe and/or PayPal (payments), OneSignal (push notifications, if enabled), Cloudflare (bot/spam protection), a shared spam-reporting service used only to check an IP/email's reputation on the Contact form, Google (Maps and web fonts, only if the site operator has enabled them), and our web hosting provider;
- Video/social platforms (YouTube, Vimeo, TikTok, X/Twitter, Instagram, Facebook) — only when a manager has added a link to their content and only once you actively click to play it; see Section 8 below;
- Legal authorities, if required by law, court order, or to protect the rights, safety, or property of School Circle Network, our members, or the public.
5. Children's Privacy
School Circle Network is intended for use by parents, guardians, teachers, PTO members, and school/district staff — it is not directed at children, and children do not create their own accounts. Any information about a student is entered by a parent or guardian for their own reference, is never publicly displayed, and is never used to identify a child in a photo, video, or any automated system (we do not use facial recognition anywhere on this platform). If you believe a child has provided us with personal information directly, please contact us at contact@schoolcircle.net and we will delete it.
6. Cookies and Tracking
See our Cookie Policy for the full list of cookies we use, why, and how to manage your preferences at any time via the "Manage Cookie Settings" link in the site footer.
7. Data Retention
We keep your account information for as long as your account is active. Expired content (past events, expired business promotions, and similar time-bound items) is archived immediately and permanently deleted after the retention period the site operator has configured (visible in Admin > Settings, default 30 days). If you'd like your account and associated personal data deleted sooner, contact us — see Section 9.
8. Third-Party Links and Embedded Content
Pages on this site may embed content from third-party platforms (YouTube, Vimeo, TikTok, X/Twitter, Instagram, Facebook) that a school, PTO, or district manager has chosen to share. That content is never loaded automatically — you must actively click to play it — and once you do, you are interacting directly with that provider, subject to that provider's own privacy policy and cookies, which we do not control. Business directory listings and any external links members post are likewise outside our control; we are not responsible for the content or privacy practices of external sites.
9. Your Rights
Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time where processing is based on consent (this won't affect processing that already happened). You can update most of your own information directly from your Account settings. For anything else — including a full account deletion request, since this platform does not currently offer a self-service "delete my account" button — contact us at contact@schoolcircle.net and we will action your request within a reasonable time and in line with applicable law.
10. International Data Transfers
Depending on where our hosting provider and the service providers listed in Section 4 operate, your information may be processed in a country other than your own. Where required, we rely on the safeguards those providers make available (such as standard contractual clauses) to protect your data in such transfers.
11. Data Security
We use industry-standard measures to protect your information, including encrypted connections (HTTPS), hashed passwords, and access controls limiting who can see what. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
12. Additional Information for Visitors in the EU, EEA, or UK
Everything above applies to you too. In addition, where the GDPR applies to our processing of your information, we rely on the following legal bases: contract (to provide the account and features you've signed up for), consent (for optional cookies and push notifications), legitimate interest (to keep the platform secure and functioning, and for the limited internal analytics needed to do so), and legal obligation (where we must retain or disclose information to comply with the law). You also have the right to lodge a complaint with your local data protection supervisory authority.
13. Changes to This Policy
We may update this policy from time to time. We'll update the "Last updated" date at the top, and where changes are significant, we'll take reasonable steps to let members know (such as a notice on the site).
14. Contact Us
Questions about this policy or your data? Email contact@schoolcircle.net or use our Contact page.
Additional Detail: Information We Collect by Role
Section 2 above describes what we collect in general terms. Because School Circle Network serves several different kinds of members with different relationships to the platform, here is the same information broken out by role, including a few specific data categories not otherwise called out above.
Parents and Guardians
In addition to Section 2's "Information about your children": a child record requires only a first name and either a last name or just a last initial — never a full legal name, date of birth, or any government identifier. You may also encounter, and choose to claim, a class-roster entry a teacher created (see "Teachers" below) — claiming it links that entry to your own account and your own child record.
Teachers
Your own teacher profile may include your name, the subject or grade you teach, and an optional bio. Separately, if your School or School Network enables it, you may create class-roster entries consisting of a student's first and last name (or last initial) only — this is information about a child who is not your own, entered to help identify which family should claim that seat on your roster. An unclaimed roster entry is never shown to anyone as belonging to a specific family, is never displayed publicly, and is never automatically matched to a parent account by name alone — only a parent affirmatively claiming it links the two.
Coaches and Team Managers
If you manage a sports team or similar group, you can organize a roster of students already in the system into that team. This links existing student records to a team; it does not collect any new information about a student beyond the name/grade already described above.
School, School Network (District), and PTO Administrators
Beyond the organization profile content described in Section 2, claiming administrative control of a School, School Network, or PTO page requires submitting a verification document (for example, proof of your role at that organization) for review by our Super Admins. That document is used solely to confirm your claim and is deleted once review is complete — it is never retained indefinitely and never shown publicly.
If your organization executes an Institutional Agreement with us (for example, our Platform Terms of Service, a Student Data Privacy Agreement, or a Services Agreement), we additionally collect and permanently retain, as the legal record of that signature: the signer's name, title, and email address at the time of signing; the IP address and browser/device information used to sign; the typed legal name entered as the electronic signature and, if you choose to draw one, a signature image; and the resulting signed document itself. This record exists specifically to serve as durable evidence of what was agreed to and by whom, and is never edited after signing. If you separately request authority to sign on your organization's behalf, we also collect your claimed title and any supporting evidence file you choose to submit with that request.
Businesses
See "Business directory information" in Section 2 above — no additional categories beyond what is already described there.
All Members — Security and Messaging
If you enable two-factor authentication or a passkey, we store the corresponding security credential needed to verify it — never a fingerprint, face scan, or other biometric itself, which is verified on your own device and never sent to us. We keep a record of recent sign-ins and let you review and remove devices remembered as trusted. Direct and group messages you send through Messenger are encrypted at rest (AES-256-GCM) rather than stored as plain text, so a raw database export does not casually expose conversation content. This is not end-to-end encryption: the platform decrypts a message server-side to display it to an authorized participant, using an installation-wide key that is never shipped in code or sent to any client, and there is deliberately no admin interface for browsing message content outside of a user-initiated abuse report. We use this design, rather than true end-to-end encryption, specifically so your message history is available the same way on every device you sign into, with no separate key or PIN to set up or risk losing.
California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the rights described in Section 9 above, plus the rights below.
We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as either term is defined under the CCPA/CPRA. No advertising network, data broker, or ad exchange ever receives information from this platform.
Do Not Sell or Share My Personal Information. You can record this opt-out preference, and view its current status, at any time on our Do Not Sell or Share My Personal Information page — no account or sign-in required.
Global Privacy Control (GPC). If your browser or a browser extension sends the GPC opt-out signal, we automatically honor it as a valid opt-out request on every visit, with no action required from you. We support GPC as described at our GPC support declaration.
Non-discrimination. We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any right under this section.
Sensitive personal information. Where we process sensitive personal information as CCPA/CPRA defines it (for example, precise geolocation is not collected by this platform; account login credentials are), we use it only to provide the Service and for security purposes, consistent with the limited allowed uses under the CPRA that do not require an additional opt-out.
Authorized agent. You may use an authorized agent to submit a request on your behalf; we may still require you to verify your own identity directly with us before completing the request.
