Privacy Policy

Effective: May 6, 2026  ·  Last updated: May 17, 2026

IDK Can You? (“the Service,” “we,” “our”) provides hall-pass and device-checkout tools for K–12 classrooms at idkcanu.com and through the iOS app published as “IDK Can You?”. This policy explains what information the Service handles, how it’s protected, and the rights schools, teachers, and parents have over it.

The Service is designed to be operated by school staff. When schools use the Service, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA, 34 CFR § 99.31(a)(1)). Student data is held under the direction of the school and used only for the educational purposes the school authorizes.

1. Information we handle

Teacher account information

When a teacher signs in with Google, we receive their email address, name, and Google profile picture from Google’s OAuth service. We use this to identify the teacher, secure their account, and display their profile in the app.

Student information (entered by the teacher)

Teachers add their roster manually or by uploading a CSV. Roster fields include each student’s name, optional ID barcode, and optional grade and class period. We treat this information as a “school record” under FERPA.

• Student names are encrypted at rest using AES-128 Fernet symmetric encryption. The plaintext name is never logged or sent to any third party.
• Student ID barcodes are one-way hashed with SHA-256 before storage. The plaintext barcode is never stored. Lookups happen by hash comparison.
• The teacher remains in control. Roster entries can be edited or deleted at any time through the admin dashboard, and a single “clear all” button removes the entire roster, sessions, and logs.

Service usage records

To operate the Service we record:

• Hall pass start and end times, destination chosen, and total duration
• Device assignments and check-in / check-out timestamps
• An audit log of administrative actions (who scanned whom, when, with what device)

These records are linked to the hashed/encrypted student record described above. The audit log is visible only to the teacher who owns the account.

Device condition notes

When a device is reassigned, returned, or reported damaged, teachers can add short free-text notes (e.g., “cracked screen,” “keyboard sticking”). These notes describe the device, not the student, and are intended for inventory tracking. Like student names, these free-text fields are encrypted at rest. We still ask teachers not to enter student-identifying information in them.

Technical and diagnostic information

We collect minimal technical information required to keep the Service running and secure:

• HTTP request logs (IP address, timestamp, URL path) retained for up to 30 days for security and abuse-prevention purposes
• Crash reports and unhandled errors captured by Sentry, stripped of personally identifiable student information before being sent
• Session cookies (web) and a Keychain-stored bearer token (iOS) used to keep teachers signed in. These are not third-party advertising or analytics cookies.

2. What we do not do

• We do not sell or rent personal information — ever — to anyone, including to advertisers or data brokers.
• We do not use student data for behavioral advertising or marketing purposes.
• We do not use student data to build any kind of advertising or marketing profile.
• We do not use student data to train large language models or other AI systems.
• We do not track students across other websites, apps, or services.
• We do not collect device location data, contacts, photos, or microphone input. The iOS camera permission is used solely to scan barcodes for the kiosk and is processed locally on the device.

3. Service providers (sub-processors)

We use the following service providers to operate the Service. Each is contractually obligated to use the data only to provide their service to us, and not for their own purposes.

• Render Services, Inc. — web hosting and PostgreSQL database hosting (United States)
• Cloudflare, Inc. — DNS, content delivery, and DDoS protection (United States)
• Google LLC — OAuth 2.0 sign-in for teachers (United States)
• Functional Software, Inc. (Sentry) — application crash and error monitoring (United States)
• Apple Inc. — iOS app distribution via the App Store and TestFlight (United States)

4. Security

• All traffic between your browser or app and our servers is encrypted with TLS 1.2+ (HTTPS).
• Student names are encrypted at rest. Student barcodes are one-way hashed.
• Authentication uses Google OAuth 2.0. We never see or store your password.
• iOS app authentication uses bearer tokens stored in the device’s Keychain with the “first unlock this device” protection class.
• Each teacher account is isolated. Data from one classroom is never visible to another teacher’s account.

5. Children’s privacy (COPPA & FERPA)

The Service is intended for use by school personnel and is not directed to children under 13. We rely on the “school authorization” framework recognized by the Federal Trade Commission’s Children’s Online Privacy Protection Act (COPPA) guidance: when a school authorizes the use of an educational online service for students, the school may consent on behalf of parents, provided the data is collected and used solely for educational purposes.

We commit to handling student records consistent with FERPA. We do not disclose personally identifiable information from education records to any third party except as needed to provide the Service, with parental consent, or as required by law. Schools may, at any time, request the deletion or export of all data tied to their teachers’ accounts by emailing the address below.

6. Your rights and choices

• Access & correction. Teachers can view and edit all roster and session data through the admin dashboard at any time.
• Deletion. Teachers can delete individual students or use “Clear All Data” in the admin dashboard to remove their entire roster, sessions, and logs. Schools or parents can request deletion by contacting us at the address below; we’ll honor the request within 30 days.
• Account closure. Email us to close your account and delete all associated data.
• Export. The dashboard provides CSV export of session logs. Roster and full-data exports are available on request.

7. Retention

Active account data is retained while the account is in use. If a teacher account is inactive for 24 consecutive months, we will email a notice and delete the account if no action is taken within 30 days of the notice. Crash reports retained by Sentry expire within 90 days. HTTP request logs retained by Render expire within 30 days.

8. International users

The Service is hosted in the United States. By using the Service, you consent to the transfer and processing of information in the United States. We do not currently target the Service to users outside the United States.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the admin dashboard at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact

Questions, requests, or concerns about this policy or your data? Email ebriellelucero@gmail.com. We aim to respond within 5 business days.