Privacy Policy

Toward June is operated by [Legal entity] (“we”). This policy covers towardjune.com and the app signed in to from it. We are not affiliated with SFUSD — a report card you upload is a document the district gave you, and what SFUSD does with its own copy is governed by its policies, not this one.

Accounts are held by parents and guardians; children do not sign in. “You” means the adult who holds the account.

• Your account — email and display name. Google sign-in gives us your email and name and nothing else. Passwords are stored hashed by our authentication provider; we never see them.
• Your children — first name and grade are required. School, student ID, date of birth, English-learner status, and height are optional and stay empty if you leave them empty.
• The record — report cards you upload and the marks and comments read from them, district assessment results you enter, activities and schedules, and AI summaries generated from confirmed marks.
• Tutoring sessions, if you turn them on — your child’s voice, the written transcript, whiteboard drawings, and the guardrail scan’s verdict on each turn. See Children, consent and voice.
• Technical — aggregate page analytics that set no cookies, and error reports when a page fails. No advertising trackers, no social pixels, no device fingerprinting.
• Things you share on purpose — the email addresses of people you invite, and a hash (not the token) of your calendar feed’s secret.

The download page asks for your ParentVUE username and password so it can sign in to the district portal for you and list the documents it holds for your children. The login crosses TLS to our server, is used in memory for that one sign-in, and is then gone — it is never written to a database, a log, or a file, and it is not recoverable afterward.

For the roughly 25 minutes a session lasts, the portal’s session lives inside an encrypted token held by your browser tab alone. Each document you download streams through the server’s memory to yours; no copy is kept. Using the tool creates no account, no consent record, and no usage entry.

A child’s voice is personal information collected from a child, so under COPPA it needs verifiable parental consent before the first audio frame exists. Tutoring is off until a parent or guardian turns it on, per child, after reading a short disclosure of what is recorded and for how long. We store what you agreed to — which child, which version of the disclosure, and when — and if the disclosure changes materially we ask again.

You can revoke consent at any time and new sessions stop immediately. The consent record itself is kept even after recordings are deleted: it is the only evidence the collection was lawful while it happened, and it contains no recording — a date, a policy version, and who agreed.

Stay nearby during a session. The guardrails are enforced in code, but they are not a substitute for an adult in the room.

Three paths, each given only what its job needs:

• Reading a report card. An uploaded card is sent to a model to be read into marks. Extraction never writes a confirmed mark — the result is a draft until you check it against the paper in your hand.
• Writing a summary. Generated from confirmed marks only, and scanned before you see it for clinical or deficit language and for comparisons to other children.
• June, the live tutor. A session opens a direct connection from your browser to Google’s Gemini Live using a short-lived token; the browser never holds our API key. June reads your child’s confirmed record the way a teacher reads a gradebook, and is instructed never to recite a mark or score back to them — every transcript is scanned for exactly that.

Every AI call that touches a child’s data is logged first. The log holds the purpose, model, timing, token counts, and SHA-256 hashes of the prompt and completion — not the text itself, which would be a second permanent copy of the record. It carries no child identifier.

We do not use your family’s data to train models, and we do not permit our providers to.

Your household — enforced in the database itself by row-level security on every query, so a bug in a screen cannot show you another family’s child. People you invite hold one of three roles: owner (everything), guardian (read and change child data, turn tutoring on), or viewer (read only).

Uploaded cards live in private storage under your household’s path, reachable only through links we sign server-side that expire shortly after they are made. Beyond your household we disclose data only to the service providers that run it and where the law requires. We do not sell it, rent it, or hand it to advertisers.

• Session audio: 30 days. Every recording is written with an expiry date the moment it is stored, and a job deletes it on that date.
• Transcripts and whiteboard history: kept until you delete them, and append-only — a transcript that could be edited after a guardrail flags it would be worth nothing.
• Report cards, marks, activities, summaries: kept until you delete them or close the account.
• Consent records: kept, as explained in Children, consent and voice.
• AI audit logs: hashes and counts only — no child identifier, no prompt text.
• ParentVUE sessions: about 25 minutes. Held inside an encrypted token in your own browser tab, never on our servers.

Closing your account deletes your household’s data, including uploaded cards and recordings. Backups roll off within 30 days.

• Delete any of it, any time. Delete a child’s recordings and transcripts, turn tutoring off, revoke the calendar feed, or remove someone from your household — all from inside the app.
• Get a copy, correct it, or delete all of it. Email privacy@towardjune.com and we will answer within 30 days.

California residents have CCPA rights to know, delete, and correct, and not to be discriminated against for using them. We do not sell or share personal information, so there is nothing to opt out of. Requests about a child’s record are for the parent or guardian to make.

These are absent from the code, and the tests fail if they reappear.

• No selling of personal information, and no advertising anywhere in the product.
• No use of your family's data to train an AI model.
• No sharing of your child's record with their school, the district, or an activity provider.
• No GPA, no averaging of marks, no ranking, no comparing your child to anyone else, and no trendline drawn through their marks.

Data is encrypted in transit and at rest, access is enforced at the database row, and uploaded documents sit behind expiring signed links. Tutoring tokens are minted per session and live for minutes. No system is perfect; if we discover a breach affecting your family’s data we will tell you.

When this policy changes, the effective date at the top changes. If a change materially affects what we collect from a child or how long we keep it, we will email account holders and ask for tutoring consent again.

privacy@towardjune.com: privacy questions, data requests, and anything you think this page gets wrong. [Legal entity], [Mailing address].