MyBookBag is used by families and school staff to read school announcements, sign permission forms, order lunch, pay for trips, log volunteer hours, and keep track of aftercare. This policy explains what the app holds, who can see it, and what you can ask us to do with it. It is written for schools in the United States.

## Who is responsible for your child's information

Your school is. SmartyPantz LLC provides the software; the school decides what is entered, who on staff may see it, and how long it is kept. Under the Family Educational Rights and Privacy Act (FERPA), we act as a **school official** performing a service the school would otherwise do itself. We use student information only to operate the app for that school, on the school's instructions.

Each school's data is kept separate. Staff at one school cannot read another school's records.

If you want a record corrected or removed, your school is the fastest route — they can make the change directly. You can also write to us at cjordan@mybookbagapp.com and we will work with your school.

## What the app holds

**Your account.** Your name, email address, and sign-in credentials, plus which school you belong to and which children are linked to you.

**Student records, entered by your school.** Name, student ID, grade, homeroom, house and clubs, an optional photo, meal-price category, allergies, emergency contacts, who is authorised to collect the student, anyone the school has been asked to prevent from collecting them, aftercare enrolment, and enrolment or withdrawal dates.

**What you do in the app.** Permission form responses, including the name you type as your signature and the date; lunch orders; trip and aftercare payments; volunteer hours you log, with an optional photo; sign-ups for events and item lists; "on my way" pickup notifications; and your low-balance alert settings.

**School activity.** Behaviour and house points recorded by staff, with the reason and any staff note; aftercare check-in and check-out times recorded by staff at the door.

**Money.** Invoices, balances, order and payment history, and a reference to the Stripe checkout that paid them. **We never see or store card numbers** — those are entered on Stripe's own payment pages.

## What the app does not do

It does not request or record your location. The "on my way" button sends a fixed notice to staff; it does not read GPS. It does not access your contacts, photo library, microphone, or camera roll except when you deliberately choose a photo to upload. It contains no advertising, no ad identifiers, no analytics or tracking SDKs, and no third-party trackers of any kind.

**We do not sell personal information, and we do not share it for advertising.** We do not use student information to build profiles for any purpose other than running the app for your school.

## Sensitive information, and how it is treated

Some of what the app holds needs saying plainly rather than folding into a general category.

**Free and reduced-price meal status.** Federal law restricts how a child's meal-benefit status may be used or disclosed. In this app it exists for one purpose: to charge the correct price for a meal. It is visible to the family and to school staff whose role requires it, and it is never shown to other families, never used for anything else, and never disclosed outside the school.

**Health information.** Allergies recorded by the school are shown to staff so that a child is not served something unsafe, and to warn the family when a menu item may match. They are not used for any other purpose.

**Custody and safety information.** Emergency contacts, authorised pickups, and any individuals the school has recorded as not permitted to collect a child are visible only to school staff. We do not disclose them to anyone else, and we do not use them for any purpose other than showing them to the staff responsible for release at pickup.

**Signatures.** When you sign a permission form, the app records the name you typed, that you gave consent, and when. It does not capture a drawn or scanned signature image.

## Children

Children do not have accounts and do not sign in. Accounts belong to parents, guardians, and school staff, and the app is not directed to children.

Student records are created and controlled by the school as part of running the school. Where the Children's Online Privacy Protection Act (COPPA) applies, the school provides consent on behalf of parents for this school purpose, as it may for other school services. Your school can tell you what it has agreed to on your behalf, and we will support any request it makes to access, correct, or delete a student's information.

## Who else receives information

**Stripe** processes card payments. You enter card details on Stripe's pages, not ours, and the money goes to your school's own Stripe account. See stripe.com/privacy.

**Base44** hosts the application and its database on our behalf, under contract, and may not use the data for its own purposes.

**Email delivery.** Service messages — receipts, reminders, low-balance alerts, form notifications — are sent by email on the school's behalf. These are messages about your account and your child's school; they are not marketing.

**Facebook and Instagram, only if your school chooses.** A school may connect its own social accounts and cross-post a school announcement to them. Only announcements the school selects are sent, and anything posted to a public page becomes public. If your school does not connect an account, nothing is sent.

**Calendar subscriptions.** A school can publish a calendar feed that families subscribe to in Apple or Google Calendar. It carries event titles and dates, and anyone holding the link can read it — so schools should share it as they would a newsletter.

We may also disclose information if the law requires it, or to protect someone's safety. We do not sell information, and we do not give it to data brokers or advertisers.

## Deleting your account

You can delete your account from **Settings** inside the app. It happens immediately, and this is what it does:

Your email is removed from your children's records, so you are no longer linked to them. Your link requests, wallet balance, event sign-ups, form responses and signatures, volunteer hours, pickup notifications, and balance-alert history are **deleted outright**. Your sign-in account is removed.

Financial records — invoices, trip payments, lunch orders, aftercare charges, and monthly lunch bills — are **kept without your name on them**. The amounts remain so the school can balance its books, but your name, email, and your child's name are stripped from them.

Deleting your account does not delete your child's school record. That belongs to the school and is governed by its own retention rules — contact the school directly about it.

## How long information is kept

Records are kept while your school uses MyBookBag and for as long as the school's own retention policy requires. Schools can archive students who leave, which keeps their record for the school's records without showing them in day-to-day use. Anonymised financial records are kept for the period the school needs for accounting and audit.

## Your rights

You can ask to see the information held about you or your child, have it corrected, or have it deleted. For student records, your school is the right first stop; we will help it act on your request. For your own account, Settings does it immediately, and you can always write to cjordan@mybookbagapp.com.

If you live in California, note that we do not sell or share personal information as those terms are used in the CCPA/CPRA, and we do not use it for targeted advertising or profiling. Exercising any of these rights will not cause you or your child to be treated differently.

## How information is protected

Access is checked on our servers, not just in the app: each school's records are separated by access rules that run on every read and write, staff features are limited by role, and operations that touch payments or personal data verify who is asking before they run. Card details are handled entirely by Stripe and never reach our servers.

No system is perfectly secure. If a breach affects your information, we will notify your school and, where the law requires it, you.

## Changes to this policy

If this policy changes in a way that materially affects you, we will update the date at the top and notify schools. Continued use after a change means the updated policy applies.

## Contact

Questions about this policy, or a request about your information: **cjordan@mybookbagapp.com**. For anything about your child's school record, contact your school directly — they can usually resolve it the same day.

---

SmartyPantz LLC · This policy describes the MyBookBag app and the service provided to schools.