Privacy Policy

Who this covers

This policy covers the SchoolOps web application at https://schoolops.cc, the SchoolOps browser extension, and the SchoolOps API. SchoolOps is a direct-to-student product: you sign up for your own account, you connect your own school accounts, and you control what happens to your data. We do not sell to schools or districts, and no parent, teacher, or administrator gets a view into your account.

Personal information and personal data mean the same thing in this document: information that identifies you or can reasonably be linked to you.

What we collect

We collect four kinds of information, and nothing outside them.

Account information

Your email address, a hashed password (or an OAuth sign-in identifier if you sign in with Google), a display name if you set one, and your account settings.

Schoolwork you or your connected platform give us

Assignment titles, instructions, due dates, course names, attached documents, your submissions and grades where your platform exposes them, drafts SchoolOps generates for you, and the writing profile SchoolOps builds from samples you provide so drafts sound like you.

Purchase and usage records

Which access key you bought, the amount, the date, the Square transaction reference, and a log of premium actions you spent (what action, when). We keep this to run your account, honour the refund policy, and satisfy tax record-keeping.

Technical and diagnostic data

IP address, browser and device type, timestamps, error reports, and coarse feature-usage counts. Error reports are scrubbed of personal information before they leave the server, including email addresses and access tokens.

What we do not collect

• Your browsing history. The SchoolOps extension runs only on the learning platforms listed in its permissions, and only on pages you open. It does not watch other tabs.
• Your card number. Payments go directly to Square. Card details never reach a SchoolOps server, so we cannot store, log, or leak them.
• Your location. We do not request geolocation. IP addresses are used for security and abuse prevention, not for location tracking or targeting.
• Advertising identifiers. SchoolOps carries no advertising SDKs, no third-party analytics trackers, and no cross-site pixels.
• Contacts, camera roll, or background microphone. Camera and microphone are used only during an action you start, and only for as long as that action runs.

Google user data

If you connect Google Classroom or let SchoolOps work on a Google Doc, you grant specific Google permissions on the Google consent screen. This is every scope SchoolOps requests and the only thing each one is used for.

SchoolOps use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google data is used only to provide the features you asked for. It is never used for advertising, never sold, and never used to train any AI model.
• Google data is not transferred to anyone except the AI providers listed in this policy, and only as the content of a request you started.
• No human at SchoolOps reads your Google data, except with your explicit permission to debug a problem you reported, to comply with law, or where required for security.
• Revoke access at any time in Settings, or from Google Account permissions. Revoking stops all further access immediately; content already saved in your SchoolOps account is removed when you delete that content or your account.

Connecting a learning platform

SchoolOps connects to Canvas, Edgenuity, Google Classroom, Blackboard, Brightspace, Schoology, Moodle, and MasteryConnect. Depending on the platform, a connection uses an OAuth token you authorise, an API token you paste in, a session your browser already holds, or credentials you enter.

• Credentials and tokens are encrypted at rest and are used only to fetch your own coursework and, when you ask, submit your own work.
• SchoolOps acts as you and sees only what your own account can see. It cannot see other students, and it never touches anything a teacher or administrator would see.
• You can disconnect a platform at any time from Settings. Disconnecting deletes the stored credential for that platform.

Voice and image input

Voice. When you use voice input, audio is captured in your browser while you speak, converted to text, and discarded. Raw audio is never stored, replayed, or retained. Only the resulting transcript reaches our servers.

Images. When you photograph or upload a question, the image is sent to a vision model to read the question and answer it. The image is processed and discarded; it is not kept on our servers after the response is returned, and it is never used for training, advertising, or any purpose other than answering the question you submitted.

Where your schoolwork is processed

SchoolOps runs its own AI models on hardware we control, and that is the default path for your work. When a request needs capacity or a capability our own models cannot serve, it is sent to one of the processors below and to no one else. Every one of them is barred from training on your content.

Each AI provider publishes its own data terms, and these are the ones we rely on:

• Groq — Groq data handling
• Cerebras — Cerebras Terms of Service
• OpenAI — OpenAI business data privacy
• OpenRouter — OpenRouter provider data controls

We publish this list because it is the honest answer to who else sees my homework. If we add a processor, this table changes and the effective date at the top of this page changes with it.

AI training: your work stays yours

Your assignments, drafts, writing samples, images, and chats are never used to train, fine-tune, evaluate, or otherwise improve any AI model, whether run by SchoolOps or by any processor listed above. This applies to every account by default. There is no setting to change and no opt-out to remember.

Your writing profile is the one place your samples shape output, and it is scoped to you: stored against your user ID, used only to make your own drafts sound like your own writing, and deleted with your account.

How we use your information

• To run the product you asked for: reading assignments, generating drafts, answering questions, predicting grades, tracking what is done.
• To operate your account: sign-in, access-key status, purchase history, support.
• To keep the service safe: rate limiting, abuse and fraud detection, and detecting attempts to break into accounts.
• To fix and improve the product: aggregate feature counts and scrubbed error reports. This never involves reading your schoolwork.
• To meet legal obligations: tax records, and responding to lawful requests.

Under the GDPR and UK GDPR, our legal bases are: performance of a contract with you (running the product and your account), our legitimate interests (security, abuse prevention, aggregate product improvement), legal obligation (tax and compliance records), and consent where you give it, such as authorising a platform connection or enabling a microphone.

Sharing and disclosure

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA and CPRA. We have never done so.

Your information is disclosed in exactly three situations: to the processors listed above, each handling only the minimum needed for its function and bound not to use it for anything else; when you direct it, such as submitting your own work back to your own platform; and when compelled by valid legal process, where we will tell you unless we are legally barred from doing so.

If SchoolOps is ever acquired or merged, your data would transfer as part of that transaction. You would be notified before any transfer, and the acquirer would be bound by this policy until you are given notice and a chance to delete your account.

How long we keep things

Data is purged automatically on this schedule. Deleting your account removes everything ahead of schedule except records we are legally required to keep.

Your controls

Export everything

Settings gives you a full JSON export of your assignments, drafts, courses, and settings. It downloads immediately, with no request queue.

Delete everything

Settings deletes your account. Deletion cascades to your assignments, drafts, writing profile, grade history, and stored platform credentials. Purchase records are retained where tax law requires, with your identifiers removed.

Correct your information

Account details are editable in Settings. For anything you cannot edit yourself, email [email protected].

Disconnect a platform

Settings disconnects any learning platform and deletes the credential stored for it.

Global Privacy Control

SchoolOps honours the Sec-GPC and DNT browser signals automatically. If your browser sends one, your opt-out is recorded without you doing anything else.

We answer rights requests within 30 days. We do not charge for them and we do not degrade your service for making one. If we ever refuse a request, we will tell you why and how to appeal.

California, and other state privacy laws

California residents have the right to know what is collected, to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for exercising those rights (Cal. Civ. Code 1798.100 and following). The categories we collect are listed in What we collect above; sources, purposes, and disclosures are covered in the sections around it.

SchoolOps does not sell or share personal information. The control below records a formal do-not-sell preference in our privacy ledger anyway, so that you have a receipt.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have equivalent rights, and the same controls in Settings satisfy them. We do not process sensitive personal information for inference or profiling, and we do not engage in targeted advertising.

Students, minors, and school records

You must be 13 or older to hold a SchoolOps account. We do not knowingly collect personal information from children under 13. If we learn an account belongs to someone under 13, we delete it and its data. If you believe a child under 13 has an account, email [email protected] and we will remove it.

SchoolOps is not a school-purchased service and does not act as a school official under FERPA. You are the account holder, and the coursework in your account is there because you connected your own account and asked us to work on it. Where SchoolOps handles material that is also part of your education record, we treat it with the care this policy describes and disclose it only as set out here.

Security

• All traffic is encrypted in transit with TLS, with HSTS enforced.
• Data is encrypted at rest, and platform credentials and tokens receive an additional layer of application-level encryption.
• Database access is scoped per user with row-level security, so one account cannot read another account rows even if application code is wrong.
• Sessions use httpOnly cookies, so a cross-site script cannot read your token.
• Error reports are scrubbed of email addresses and tokens before they leave the server.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant regulators without undue delay and within the deadlines the law sets, and we will tell you what was exposed and what to do about it.

Cookies and local storage

SchoolOps sets a session cookie to keep you signed in and uses browser local storage to remember interface preferences and cache your own data for speed. There are no advertising cookies and no third-party tracking cookies. Clearing site data signs you out and resets preferences; it does not delete anything from your account.

International transfers

SchoolOps is operated from the United States and your data is processed there. If you use SchoolOps from outside the US, you are sending your data to the US, where privacy law differs from your own. Where transfers are subject to the GDPR or UK GDPR, we rely on the European Commission Standard Contractual Clauses with our processors.

Changes to this policy

When this policy changes materially, we update the effective date at the top and notify account holders in the app before the change takes effect. Continuing to use SchoolOps after that date means the updated policy applies. Previous versions are available on request.

Contact

Privacy questions, rights requests, and security reports go to [email protected]. Put "Privacy request" in the subject line and it will be routed correctly. We aim to reply within 3 business days and to resolve rights requests within 30 days.