Privacy Policy

Introduction

Pink Cow ("we," "our," or "us") is committed to protecting the privacy of students, teachers, parents, and school administrators who use our special education management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

FERPA Compliance

Pink Cow complies with the Family Educational Rights and Privacy Act (FERPA), which protects the privacy of student education records. We are committed to:

• Acting as a "school official" under FERPA when handling education records
• Using student data solely for providing our educational services
• Enforcing access controls in the database itself, so they apply to every client rather than only to the web app
• Never selling or marketing student data
• Allowing schools to maintain full control over their data
• Providing a copy of a school's data on request

Information We Collect

Teacher and Staff Information

• Name and email address
• School affiliation and role
• Account credentials (encrypted)
• Usage data and preferences

Student Information

• Name and grade level
• IEP goals, the objectives under them, and the tasks within a goal
• Observations of progress, and any note recorded with an observation

Technical Information

• IP addresses and device information
• Browser type and version
• Time zone and location (general)
• Usage patterns and feature interactions

How We Use Information

We use collected information strictly for educational purposes:

• Providing special education management tools
• Tracking student progress on IEP goals
• Generating reports for teachers and administrators
• Facilitating communication between team members
• Improving our platform's functionality
• Ensuring platform security and preventing abuse
• Complying with legal obligations

Data Security

We implement industry-standard security measures to protect your data:

• TLS 1.2 or later for all data in transit
• AES-256 encryption at rest on our servers
• AES-256 encryption of the local database on the teacher's device
• Role-based access controls (RBAC)
• Automated backup and disaster recovery
• Incident response procedures

Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share data only:

• With your explicit consent
• To comply with legal obligations or court orders
• To protect our rights, privacy, safety, or property
• With the service providers listed below, who are contractually bound to process it only on our documented instructions, and are prohibited from selling it, sharing it, or combining it with data from other sources
• In connection with a merger or acquisition (with notice to users)

Service Providers

We use the companies below to operate Pink Cow. Not all of them handle student education records — the table says which do. All process data in the United States; our database is in Supabase's US East (Ohio) region. For a plain-language walkthrough written for parents and districts, see How student information is handled.

“Not intentionally” means we do not send student information to that provider on purpose, but an error report can occasionally include whatever data was being handled when the error happened. We would rather say this plainly than claim a guarantee we cannot make.

We do not sell student information, use it for advertising, or build profiles for any purpose other than providing Pink Cow. If we add or change a provider that handles student records, we will update this page and give notice as described under “Changes to This Policy.”

Your Rights and Choices

You have the right to:

• Access and review your personal information
• Correct inaccurate or incomplete data
• Delete your account, from Settings → Your data. It is deleted seven days after you ask, so you can change your mind; see Data Retention below for exactly what that removes and what it does not
• Download a copy of your data at any time, as one file, from Settings → Your data
• Opt-out of non-essential communications
• Revoke consent for data processing

Data Retention

While your account is open we keep your data so that Pink Cow works. When an account is deleted, not everything is treated the same way, and it is worth being specific about which is which.

• Deleted outright. Your students and everything attached to them — goals, objectives, observations, tasks, consent records — along with your classroom, your to-do list and your calendar dates. This is everything Pink Cow holds about a child in your care.
• Kept, with your name removed. If you were the first person to add your school or district to Pink Cow, that entry stays for the next teacher who searches for it, but it stops recording that you added it. Deleting it would take it away from colleagues who had nothing to do with your account. Records of emails we sent you are kept the same way, so we can still answer whether a consent request reached a parent.
• Kept in full. Tax records, for as long as tax law requires. We cannot delete those on request, and would rather say so here than after you have asked. Our own copy of your payment history is kept with your name removed; the billing record itself sits with Stripe, our payment processor, under their retention rules rather than ours. We also keep a record that you asked for your account to be deleted and when that was done, so we can show that it happened.

Your district or state may separately require IEP documentation to be preserved for a set period. Where that applies, the obligation comes first, and we will tell you when it does.

The access record

When a teacher opens a student's record, requests consent from a parent, or gives or removes someone's access to a child, Pink Cow writes that down: who, which child, and when. It is kept for 3 years and then deleted automatically.

Two things it is not. Opening a class list is not written down — only opening a particular child's record is. And it does not disappear when someone deletes their account: a record of who viewed a child cannot answer that question if we remove the name of the person who did it. That is the one place where deleting an account leaves something behind on purpose, and the 3-year clock is what limits it.

Records of agreeing to these terms are kept and are not deleted on a timer. They are evidence about an agreement, and an agreement can matter for longer than any period we would pick in advance.

Children

Pink Cow holds information about students because their teachers and schools enter it, under the school's authority and the Family Educational Rights and Privacy Act (FERPA). How that information is handled is described above and in How student information is handled.

Children cannot have Pink Cow accounts. Accounts are for educators and authorized school staff who are 18 or older, and there are no student accounts. If we learn that an account belongs to a child, we close it and delete it.

International Data Transfers

Pink Cow operates in the United States and processes data in accordance with U.S. law. If you access our service from outside the U.S., please be aware that your data may be transferred to and processed in the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes affecting student data, we will provide additional notice to schools and parents as required by law.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: