Privacy & cookies
Last updated September 2026.
schoolz ("we", "us") helps parents and guardians in the Cherry Hill, NJ school district keep up with their kids' schools. This page explains what data the site stores about you and why. Questions or requests (including to access, correct, or delete your data) can be sent to enr@profitnaut.com.
You don't need an account to use most of this site
Schools, districts, the calendar, and Smore newsletter content are public and browsable by anyone, with no login required. Registering is only needed for the optional personal layer: linking your own kids, narrowing the calendar to just their schools, and connecting Gmail.
What we store, and why
| What | Where | Why |
|---|---|---|
| Your picked schools, and which are currently shown/hidden | Your browser's local storage | So the Today/Calendar/Lunch pages remember your schools without needing an account. Never sent to us or any third party — it stays on your device. |
| Light/dark theme choice | Your browser's local storage | Remembers your display preference between visits. |
| Login session | A cookie/token set by our authentication provider, Supabase | Strictly necessary to keep you signed in if you register. Set only if you create an account; not set for anonymous visitors. |
| Anonymous performance & error data (page load times, which pages are used, JS errors) | Grafana Cloud, our monitoring provider | We collect anonymous performance and error data to make the site faster. It's tied to a random per-visit session, never to your name, email, or children, and isn't shared with advertisers. Login tokens and other sensitive URL content are stripped before anything is sent. |
| Account info (email, username), your linked children, guardian invites | Our database | Powers the optional personal layer described above. A linked child's record is shared only with guardians you or an auto-match connects it to — never made public. |
| A count of visits to each public page, and roughly where visitors came from (e.g. "facebook") | Our database | So we can tell whether a post about this project actually reached anyone. This is a running tally, not a record of you — we store one number per page, per day, per source, and nothing else. No id, no IP, no profile, no cookie, nothing that could be traced back to a person or linked between visits. If a link brings you here with a tracking code attached (Facebook adds one), we read it once to label the visit "facebook" and then discard it — it's never stored or sent on. |
| Your survey answers (the schools you picked, what you said is hard to find, your comments, and your name and email if you chose to give them) | Our database | Only if you fill in the survey. Name and email are optional and blank by default; your email is never shared with the district or anyone else — it's only so we can follow up. Your comments may be quoted to the district without your name unless you explicitly tick "you can use my name." |
| Proof a survey response is genuine: the date and time it arrived, which browser sent it, and a scrambled one-way code that stands in for your internet connection | Our database | So a stack of responses can be shown to the district as real, separate people rather than one person submitting over and over. We never store your IP address. It's immediately scrambled with a secret key into a code that can't be turned back into an address, and that code is useless anywhere else. It isn't used to track you, isn't tied to your browsing, and isn't shared with anyone. |
| Gmail read-only access token (only if you choose to connect Gmail) | Our database, encrypted at rest | Used solely to detect school newsletter links in your inbox for scanners you set up yourself. We never send, delete, or modify email, and this is entirely opt-in — nothing is connected unless you click "Connect Gmail" and complete Google's own consent screen. |
What we don't do
- No advertising or ad-tracking cookies of any kind.
- No selling or sharing your data with advertisers or data brokers.
- No cross-site tracking — nothing here follows you to other websites.
- No identifying you personally in our performance/error monitoring — it's tied to a random per-visit session, not your account, name, or email.
Why there's no "accept cookies" popup
Under GDPR and the ePrivacy Directive, a consent banner is required for non-essential tracking (like ad cookies or analytics that identifies you personally) — not for things a site needs to function, or anonymous, aggregate performance monitoring. Everything schoolz currently stores falls into that "strictly necessary" / functional / anonymous category, so there's nothing here that requires your opt-in consent. If that ever changes, this notice (and a real consent choice) will change with it.
Third parties involved
- Supabase — handles login/authentication for registered users.
- Fly.io — hosts the website and backend.
- Grafana Cloud — receives the anonymous performance/error data described above, plus backend operational metrics/logs. No account data or content from your inbox ever passes through it.
- Google — only if you connect Gmail, to read newsletter-related messages you've filtered for; governed by your own Google account settings.
Your rights
You can clear your browser's local storage at any time to remove your saved school picks and theme preference. If you have an account, you can delete your linked children yourself from the Children page, or email us to delete your account entirely, correct inaccurate data, or ask what we hold about you.