CircleTime Privacy Policy

Draft policy — requires review before launch. Replace placeholders below with your organization's legal name, contact details, actual retention periods, hosting and service providers. Do not publish as your final privacy policy without confirming actual practices.

Who uses CircleTime

CircleTime is designed for authorized adult parents, guardians and educators to communicate about school and classroom activities. Children do not create accounts.

Information handled

Depending on how a school uses CircleTime, information may include adult account identifiers, names and contact information, class membership, children's names and photos, calendar events and classroom announcements, plus limited technical access information used for security.

Why information is used

To provide access to classroom communications, photo albums, calendars and school directories, and to handle privacy requests and security.

Who can see information

Only signed-in users authorized for the relevant school or classroom should access those records. Teachers can manage content only within their assigned classroom. Classroom-specific authorization is not complete in this demonstration build; **do not deploy with real children's information until it is implemented and tested**.

Photos

Photos should be uploaded only when the school has documented appropriate family permissions. Images are stored in protected server storage and served through access-checked handlers. The app is intended to strip unnecessary image metadata when it processes uploads; verify all image processing paths before production use.

Retention, deletion and requests

School administrators should set and publish an actual retention schedule. Adults can initiate requests to delete an account or remove a child's photo using the Privacy & Account page. Requests require follow-up by the school/operator; submitting a request does not immediately delete stored records.

Security and third parties

Use HTTPS, strong credentials, restricted server access, private backups and a documented incident response process. Before release, identify all hosting, notification, analytics, crash-reporting or other third-party providers and accurately describe sharing and processing.

Your choices

Contact the school to correct family or student information, withdraw photo permissions where applicable, or request account deletion. Access may depend on school record-retention obligations.

Contact

[INSERT OPERATOR BUSINESS NAME, POSTAL CONTACT, PRIVACY EMAIL AND EFFECTIVE DATE]

CircleTime — School 1 / Classroom 1 prototype