PathwaysTracker Privacy Policy

The Service collects the minimum information needed to track student progress:

• Student education records: first and last name, grade, homeroom/classroom, assigned school, behavior goals, and behavior data recorded in 15-minute intervals (ratings, incident reports, session summaries, and time-based exemptions).
• Parent/guardian contact: parent or guardian email address, used only to send weekly progress reports for that student.
• Staff account information: full name, email address, assigned role (administrator, district, school, or teacher/staff), and assigned building.
• Audit data: records of who created, edited, or deleted behavior data, retained for accountability.

Information is used solely to support the Service’s educational purpose:

• Track and analyze student progress toward individualized behavioral goals.
• Generate daily summaries, progress charts, and weekly parent/guardian reports.
• Administer role-based access for district and school staff.
• Maintain an auditable record of changes to behavior data.

We do not use student data to profile students, to train advertising models, or for any commercial purpose.

Student information collected by the Service constitutes “education records” under the Family Educational Rights and Privacy Act (FERPA). The Service receives, collects, and discloses this information on behalf of the District under the FERPA “school official” exception, at the direction of and under the direct control of the District.

Access is limited to school officials with a legitimate educational interest, and the Service meets FERPA’s “direct control” requirements through the contractual and technical controls described below.

Access to student records is enforced both in the application and at the database level:

• Role-based access: administrators, district-level staff, school-level staff, and classroom staff each see only the scope of data their role requires.
• District isolation: every student record is scoped to a single district, and database row-level security prevents any user from reading, creating, editing, or deleting records belonging to another district—even if application controls were bypassed.
• Building-level scoping: within a district, school and classroom staff are further limited to students in their assigned building.
• Authentication: staff access requires authenticated, invitation-based accounts; there are no shared or anonymous credentials.

We share information only as necessary to operate the Service:

• Hosting & infrastructure: Base44 (the platform provider) and its underlying cloud infrastructure, used to store and process data on the District’s behalf.
• Email delivery: a transactional email provider, used only to deliver weekly parent/guardian progress reports when the District enables them.
• Optional AI features: AI-assisted features (such as summary or report generation) are used only when the District actively invokes them, and only with data already accessible to the invoking staff member.

We do not sell student data, do not share it for advertising, and do not allow third-party trackers to profile students. Service providers are bound to use data only to provide the Service and are prohibited from secondary use.

Student and staff data is retained for as long as the District subscribes to the Service and uses the relevant records. The District controls deletion: district administrators may remove individual student records or request bulk export or deletion at any time. When a student record is deleted, associated behavior logs, incidents, sessions, exemptions, and interval records are removed as well. Upon termination of the District’s subscription, data is deleted within a defined transition period unless otherwise instructed in writing.

The Service uses industry-standard safeguards, including encryption of data in transit (TLS) and at rest, least-privilege access enforced by row-level security, invitation-only authentication, and an audit log of material changes to student behavior data. Staff accounts may be suspended or revoked by district administrators at any time.

Under FERPA, parents and eligible students have the right to inspect, review, and seek amendment of education records, and to consent to disclosures. Because the District is the controller of these records, these requests should be directed to the District’s designated privacy or records official, who will coordinate with the Service to fulfill them. Staff may similarly request access to or correction of their own account information through their district administrator.

The Service is designed for use by authorized school staff. It does not knowingly collect information directly from students, and students do not create accounts or interact with the Service. All student information is supplied and managed by school personnel acting under FERPA. The Service is therefore operated consistent with the school-administered exception under COPPA.

Student and staff data is stored and processed in the United States. We do not transfer education records to jurisdictions outside the U.S.

We may update this policy to reflect changes in the Service or applicable law. When we do, we will revise the “Last updated” date above. Material changes will be communicated to the District’s administrator.

For questions about this policy, access requests, or data practices, contact your District’s designated privacy or records official. The District administers these records and will coordinate any action involving student data with the Service.