Privacy Policy

Who we are

Rostrum is a program management tool for educators and students. This policy explains what data we collect, how we use it, and how we protect it. By using Rostrum, you agree to this policy.

What we collect

We collect only what is necessary to operate the service:

• Account information: your name, email address, and school or organization name
• Program data you enter: rosters, projects, memberships, and related content
• Authentication data used to verify your identity at login
• Basic usage data (e.g., login timestamps) for security and reliability purposes

We do not collect sensitive personal information such as Social Security numbers, financial data, or health records.

How we use your data

Your data is used solely to provide and improve Rostrum's features:

• Authenticating you and syncing your program data across devices
• Sending account-related messages (e.g., password resets, service notices)
• Diagnosing technical issues and improving app performance

We do not use your data for advertising, profiling, or any purpose unrelated to operating the service.

FERPA compliance

Rostrum is designed for use in educational settings and handles student education records in accordance with the Family Educational Rights and Privacy Act (FERPA). We act as a “school official” under FERPA when processing education records on behalf of institutions, and we do not disclose education records without appropriate consent except as permitted by law.

Data storage and security

Your data is stored on servers located in the United States, provided by Supabase (supabase.com), a SOC 2-compliant database infrastructure provider. Supabase processes data solely on our behalf and is contractually prohibited from using your data for any other purpose.

We use industry-standard security practices including encrypted connections (TLS), access controls, and regular security reviews to protect your data.

Third-party subprocessors

We use a limited number of third-party services to operate Rostrum:

• Supabase — database hosting and authentication (United States)
• Google — optional single sign-on (SSO) authentication

We do not sell your data to any third party. We do not share your data with advertisers.

Data retention

We retain your data for as long as your account is active. If you delete your account, your data will be permanently removed from our systems within 30 days, except where retention is required by law.

Children's privacy (COPPA)

Rostrum may be used by students under the direction of an educational institution. We do not knowingly collect personal information directly from children under 13 without verifiable parental or institutional consent in compliance with the Children's Online Privacy Protection Act (COPPA). Schools and districts are responsible for obtaining appropriate consent before enabling student access.

Data breach notification

In the event of a data breach that poses a risk to your personal information, we will notify affected users and, where required, relevant authorities without undue delay — and in any event within 30 days of becoming aware of the incident.

Your rights

You have the right to access, correct, or request deletion of your personal data at any time. To exercise these rights, contact us at the address below. Institutions may also request access to records related to their students in accordance with FERPA.

Changes to this policy

We may update this policy from time to time. When we do, we will update the “last updated” date above and notify users of material changes by email or in-app notice. Previous versions are available upon request.

Contact

Questions about this policy or your data? Email [email protected].