1. Introduction

SchoolPTO ("we," "our," or "us") provides a platform for parent-teacher organizations (PTOs/PTAs) to manage membership, a family directory, events, volunteering, fundraising, and communications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

Information You Provide

Account Information: Name, email address, phone number, and password when you create an account.
Family & Student Information: Names, grade, classroom, and contact details you provide when joining a membership or listing a family in the directory. This information is provided by parents or guardians.
Payment Information: Billing details processed securely through our payment processor, Stripe. We do not store credit card numbers on our servers.
Organization Information: Organization name, address, contact details, and settings provided by board members and administrators.

Information Collected Automatically

Usage Data: Pages visited, features used, and interaction patterns to improve our service.
Device Information: Browser type, operating system, and device identifiers.
Cookies: We use cookies to maintain sessions and remember preferences. See Section 7 for details.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain our platform
Process membership sign-ups, event RSVPs and ticket sales, volunteer sign-ups, and donations
Display directory listings according to each family's own privacy settings
Send transactional emails (receipts, confirmations, renewal reminders, account notifications) and, where you've subscribed, newsletters from your organization
Communicate with organization administrators about their PTO
Improve and develop new features
Ensure security and prevent fraud
Comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We may share information with:

Your Organization: Membership and family information is shared with the PTO/PTA you join.
Other Members: Directory information is visible to other logged-in members of your organization, limited to exactly what you or your family have chosen to share in your privacy settings.
Payment Processors: Stripe processes payments on our behalf under their own privacy policy.
Service Providers: We use third-party services for email delivery, hosting, and analytics.
Legal Requirements: We may disclose information when required by law or to protect our rights.

5. Data Security

We implement industry-standard security measures to protect your information, including encryption of sensitive data in transit and at rest, secure password hashing, and regular security reviews. However, no method of transmission over the internet is 100% secure.

6. Data Retention and Deletion

We keep information while it is needed to provide the Service to your organization, and some records longer where the law requires it (for example, records of payments and refunds).

When you ask to delete your account

Account deletion happens in stages:

Your request and your access. You can ask to delete your account from your profile page, or in the SchoolPTO mobile app if your organization uses it. We record the request and turn off your access immediately: you are signed out on every device, your mobile app sign-ins and any password-reset links stop working, and the account can no longer sign in. If you are the only full administrator of an organization, the request is refused until the organization has another full administrator.
Your information is kept for now. Turning off your access does not yet erase or anonymize your information. Your name, contact details, family and student information, and payment and donation history remain in our records. The rules for what must be kept, and for how long, are still being finalized with legal review, and we do not anonymize or delete these records until those rules are approved. We will update this policy when that changes.

When your organization deletes a household

Your organization's administrators can delete a household from their records, one household at a time. We refuse the deletion while the household still has any of these open:

a current membership, or a membership waiting for payment or approval;
a membership payment in progress, or a membership refund it is owed that has not settled;
tickets or an RSVP for an event that has not ended;
a ticket order waiting for payment, or a ticket refund it is owed that has not settled.

We also refuse it while a legal hold covers the organization's household records. Completed history, such as a lapsed membership or a past event, never blocks a deletion. A deleted household no longer appears in the organization's lists, but its record is kept in our database as evidence of the deletion.

Retention schedule and legal holds

We keep a written schedule of the kinds of records we hold, such as financial records, security credentials, newsletter opt-out records, and deleted household records, and of the event that starts each one's retention period. How long each kind is kept after that event is still pending approval, and nothing is deleted under the schedule until it is approved; until then, those records are kept. If we are required to preserve records, for example for a legal claim, we place a legal hold, and the affected records are not deleted while it is in place.

Some short-lived technical records are removed automatically today, outside that schedule: expired mobile app sign-in tokens, a day after they expire; mobile account-access requests, as soon as they are processed (any left unfinished are removed after 30 days); mobile account-access links, 30 days after they are used, replaced or expire; and application log files, after a short period.

When an organization closes its account

An organization's administrator can ask us to close the organization's account. We deactivate the organization, so its website, administrator panel and mobile app access stop working. Deactivation does not erase its records; they are kept under the retention schedule above.

7. Cookies

We use essential cookies to maintain your login session, protect forms, and remember your preferences. We also use analytics cookies through PostHog to understand which SchoolPTO pages and features are visited and how people move through the service. PostHog may record interactions and a visual replay of a session, but all input values and rendered text are masked before leaving the browser, query strings and network payloads are removed, and identified analytics profiles are disabled. PostHog is also configured to discard client IP addresses. These analytics help us improve the service. We do not use cookies for targeted advertising or sell information collected through cookies. You can configure your browser to refuse or delete cookies, but some features may not function properly and analytics preferences may be reset.

8. Children's Privacy

Our platform collects limited information about children (name and grade) solely for the purpose of membership and the family directory. This information is provided by parents or guardians and is shared only within the relevant organization, and only to the extent the family's own privacy settings allow. We do not collect information directly from children under 13 and comply with applicable children's privacy laws.

9. Your Rights

Depending on your location, you may have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your information (see Section 6 for how deletion works)
Object to or restrict processing of your information
Request a copy of your data in a portable format

To exercise any of these rights, please contact us at the email address below.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

For PTO Boards

For Families

Privacy Policy