Privacy

TeachDay is a lesson planbook for teachers, made by Kerfuffle Labs LLC (“we”). It is built so that it does not need information about students. This page says what we keep, why, who helps us run the service, and what you can do about it.

The short version

• TeachDay is for teachers. There are no student accounts, rosters, grades or pages for students or parents.
• We keep your account details and the plans you write, to run the service for you. You can export all of it, and delete it, at any time.
• We don’t show ads, sell personal information, or share it with data brokers. No third-party tracking scripts run on our pages.
• Our product analytics count how often things happen in a day (“12 sample planbooks made”), never who did them.

What we collect

Your account

Your email address, your name if you give one, and how you sign in (an emailed link, Google or Microsoft). Sign-in links and session cookies are stored only as one-way hashes. For each signed-in device we keep a short label such as “Safari · macOS” so you can see and end your sessions.

Your plans

Planbooks, classes, schedules, lessons, units, standards tags, comments, attachments and the history of changes: what you and the people you share with put in. The “for substitutes” notes are free text; we ask you not to put a class roster in them.

Billing

If you pay for Pro, Stripe processes the payment. We keep your plan, its dates and your receipts (name, email, amount, date). We never see or store your card number.

Connections you choose

If you connect Google, we keep the access Google grants, encrypted, and use it only for what the connection says: reading the school calendar you choose and putting your lessons on a calendar TeachDay creates (Calendar), opening the files you pick (Drive), and posting the lessons you choose to your classes (Classroom). Disconnecting removes our copy and asks Google to revoke the access. If you follow a school calendar by its link, we fetch that link to read the school’s events.

How the service is used

Counts of events per day, with no person, planbook, device or address attached. When something breaks, an error report with what broke and where in the code, never who it happened to or what they had typed. Our servers’ ordinary request logs [retention period of hosting provider logs to confirm].

What we do not collect

• Information about students: no names in a roster, no grades, attendance or behaviour, no student logins.
• Your contacts, your location, or anything from your browser beyond what a page needs to work.
• Advertising or tracking identifiers. There are none on our pages.

Students and schools

TeachDay is not directed at children and has no student-facing features, so we do not knowingly collect personal information from children. Lesson plans are a teacher’s working documents rather than student education records. When a school or district pays for TeachDay, we act on its behalf for its teachers’ accounts and will sign the Student Data Privacy Consortium’s National Data Privacy Agreement on request. [Counsel: confirm the FERPA “school official” framing and state-law (SOPIPA, NY Ed Law 2-d, SOPPA) positions for a teacher-only product.]

AI features

Some features draft or check lesson content with an AI model. When you use one, the lesson text it needs is sent to our AI provider to produce the result, and a lesson AI drafted is marked as a draft until you accept it. We use the provider under terms that do not let it keep your content or train on it. [Confirm the provider’s zero-retention and no-training terms are in place before publishing; name the provider below.]

Who helps us run TeachDay

• Hosting and database: Railway [confirm region].
• Payments: Stripe.
• Email delivery: [provider not chosen yet].
• Backups: an S3-compatible storage provider [not chosen yet].
• AI: [provider name], only when you use an AI feature.
• Google, only if you connect it, under Google’s own privacy policy.

How long we keep things

• Your plans: until you delete them. Deleted lessons and planbooks wait in the trash for 30 days, then are removed.
• Your account: when you ask us to delete it, we wait 30 days (in case you change your mind), then delete it and everything it owns. Backups holding it expire 30 days after that.
• Error reports: 30 days. Signed-in sessions: they expire after 30 days. Daily event counts: kept, since they are about nobody.

How we keep your data safe has the details of backups and the restore drill.

Your choices

• Download everything: every planbook as PDF, Word, CSV and JSON, from Settings, Your data, on every plan.
• Correct or delete: edit anything in the app; delete your account from Settings, Your data.
• Ask us what we hold about you, or anything else, at hello@kerfufflelabs.dev. [Dedicated privacy address and response times by state law.]

Security

Everything travels over HTTPS. Sign-in tokens and sessions are stored as hashes. Google access is encrypted with a key kept apart from the database [move the key to a key management service before launch, as Family Rumpus does]. Every person sees only the planbooks they own or were invited to; our staff tools show counts and metadata, never lesson content, and every look is logged.

Changes and contact

If this policy changes in a way that matters, we will email account holders before it takes effect. Kerfuffle Labs LLC, 2 Bridgeview Cir, Ste 8 #267, Tyngsborough, MA 01879. Email hello@kerfufflelabs.dev.