Privacy Policy for School JAWN
1. Overview and roles
BFactor LLC ("we," "our," or "us") operates School JAWN. The service helps authorized schools, educators, service providers, students, and parents or guardians record and review educational progress.
Schools and authorized staff decide which student records to place in School JAWN and who may access them. Depending on the arrangement, the school or district may control the education records and BFactor LLC may process those records on its behalf.
2. Information we process
Account and school information
- Name, email address, school or district affiliation, role, and account credentials
- Invitation, email-verification, login, security, and access-control records
Student and educational records
- Student names, identifiers, grade information, and authorized account relationships
- IEP goals, objectives, progress measurements, services, interventions, notes, and reports
- Supporting documents uploaded from a browser, camera, or mobile document scanner
Operational information
- IP address, browser or device information, timestamps, security logs, and diagnostic events
- Public-page analytics only after the visitor affirmatively allows optional analytics
3. How we use information
- Provide progress monitoring, reports, account access, invitations, and school collaboration
- Authenticate users, investigate misuse, secure accounts, and maintain audit records
- Operate, support, troubleshoot, and improve the service
- Comply with applicable contracts, school instructions, and legal obligations
We do not sell student data or personal information, and we do not use student records for targeted advertising.
4. Access and disclosure
We disclose information only as needed to provide the service, follow the instructions of the responsible school or account owner, protect the service, complete a business transaction subject to appropriate protections, or comply with law. Recipients may include authorized members of the same school, approved parents or students, hosting and email-delivery providers, and professional advisers.
Private invitation links are not sent to an outside QR-code service. Invitation recipients must verify the invited email address before signing in.
5. Students, parents, and children
School JAWN is not an open consumer service for children to register independently. A student or parent account is created through a school-authorized invitation or another approved school workflow. Schools and families are responsible for supplying any consent or authorization required by their policies and applicable law.
Parents, eligible students, and school officials should direct education-record access, correction, or deletion requests to the school that controls the record. They may also contact us so we can route or support the request.
6. Security
We use safeguards intended to limit information to authorized users, including HTTPS, role and school access checks, protected session cookies, short-lived signed handoffs between School JAWN IEP planning and progress monitoring, email verification for invited accounts, and audit logging.
Supporting-document metadata is tied to a goal and uploader in the database. Files are stored outside normal public access and are delivered only through an authenticated, access-checked download route. Raw mobile scans are held in browser memory only until upload; the application removes legacy browser-database scan copies.
7. Cookie and browser-storage schedule
Optional analytics is disabled until a visitor chooses “Allow analytics.” School JAWN does not load analytics on sign-in, registration, invitation, authenticated, student, parent, bridge, reporting, or account pages.
| Name or type | Provider | Purpose and data | Duration | Choice |
|---|---|---|---|---|
PHP session cookie (commonly PHPSESSID) | School JAWN | Necessary authentication and security state; contains a random session identifier, not the student record itself. | Browser session when “Remember Me” is off; up to 8 hours when it is selected. | Necessary for signed-in use. |
pm_remember | School JAWN | Random selector and verifier used to restore a signed-in session. | Up to 30 days. | Created only when “Remember Me” is selected; uncheck it before signing in to opt out. |
iep_public_analytics_consent_v1 in local storage | School JAWN | Stores “granted” or “denied” and expiry so the public-page choice is remembered. | Up to 180 days. | Necessary to remember the privacy choice; use “Privacy choices” to reset it. |
_ga and _ga_* | Google Analytics | Optional public-page visit and interaction measurement. No student or authenticated application page intentionally loads it. | Up to 2 years, subject to browser controls. | Loaded only after affirmative consent; deny or reset through “Privacy choices.” |
| Supporting-document recovery metadata in session storage | School JAWN | Temporary account-, school-, student-, goal-, and upload-state identifiers used during a mobile scan/upload. | No more than 10 minutes and the current browser tab/session; cleared sooner on completion, cancellation, or page reset. | Necessary only while using the upload feature. |
| Raw scanned document | School JAWN | Held in volatile browser memory while it is uploaded. It is not placed in local storage or IndexedDB. | Until upload, cancellation, page reset, or tab close. | Necessary only when the user chooses to scan/upload. |
Cloudflare Web Analytics or Browser Insights is not intentionally loaded by School JAWN application code. A content-security-policy error showing a blocked Cloudflare beacon means the browser did not allow that analytics script; the application does not whitelist it.
8. Retention and deletion
We keep account and educational information for the period needed to provide the service, follow the responsible school's instructions, resolve security or billing matters, and meet applicable legal or contractual requirements. Authorized users can delete individual supporting documents, which removes the database record and stored file. Account and organization deletion requests may require coordination with the school that controls the education records.
We create daily backups of MySQL records and stored supporting documents for disaster recovery and service continuity. Each backup is retained for no more than 90 days. When information is deleted from the active service, a copy may remain in an access-restricted backup until that backup expires, but it is not available for ordinary use. If a backup is restored, applicable deletions are reapplied unless continued retention is required by law or the responsible school's documented instructions.
Expired invitation and security tokens are not valid for access. New invitations expire after seven days unless used sooner.
9. Your choices and requests
- Update account details available in the application
- Uncheck “Remember Me” for a session-only login
- Allow, deny, or reset optional public analytics through “Privacy choices”
- Ask the responsible school, or contact us, about access, correction, export, or deletion
Email privacy requests to [email protected]. We may need to verify the requester and coordinate with the responsible school.
10. Service providers and external links
Service providers may process limited information to host the application, deliver verification or invitation email, or provide optional consented public analytics. Public “Book a Demo” links take the visitor to Google Calendar; Google then handles information under its own terms. External content-delivery networks may receive ordinary request information such as IP address when public assets are loaded.
11. Policy changes
We may update this policy as the service or legal requirements change. We will post the revised policy with a new effective date and provide additional notice when appropriate.
12. Contact
BFactor LLC
Email: [email protected]
Website: https://iepreport.com