Privacy Policy

1. Who we are

Chalk is an open-source K-12 IT platform covering asset tracking, help desk, rostering, identity, and provisioning. We track district-owned devices and their assignment to students and staff, run a help desk for district IT, and connect systems such as PowerSchool, Skyward, and Infinite Campus to downstream applications via OneRoster, SAML 2.0, OIDC, Google Workspace, and Active Directory. Chalk is available as a hosted service at usechalk.xyz and as self-hosted software under AGPL-3.0. This policy covers the hosted service. Not every module is generally available; the pricing page states which ship today.

2. Data we collect

• Administrator data. Name, work email, district name, chosen URL slug, plus server-side logs (IP, user agent, timestamps) for security and abuse prevention.
• Billing and procurement contacts. For districts on a paid tier: the names, work email addresses, phone numbers, and billing or mailing addresses of the district's billing, purchasing, and authorized-signatory contacts, plus purchase-order numbers, quotes, order forms, and invoice records. We use these to issue quotes, invoice against a purchase order, and keep the records a district's business office and our own require. We do not take payment-card details.
• School data processed on behalf of districts. Student rosters, staff records, classes, enrollments, and (if opted in) demographics. Where a district uses the asset-tracking module, this also includes device inventory records and the assignment of a device to a named student or staff member. Where a district uses the help desk, it includes ticket contents — the text a requester writes, correspondence on the ticket, and any files, screenshots, or attachments uploaded to it — which may contain personal data the requester chooses to include. This data belongs to the district; we process it solely to deliver the service.

3. Why we collect it

Administrator data lets us provision tenants, authenticate users, send transactional email, and maintain audit logs. Billing and procurement contact data is used to quote, invoice, and maintain financial records for a paid tier, and for nothing else. Student and staff data is processed exclusively to perform the sync, provisioning, identity, asset-tracking, and help-desk functions the district has configured. We do not use student data for advertising, profiling, or any unrelated commercial purpose.

4. Where it lives

Hosted Chalk runs in US-based data centers. Credentials, tokens, SAML keypairs, and OIDC JWKs are encrypted at rest with AES-256-GCM. Per-tenant database schemas isolate one district's data from another's. Encrypted backups age out on a rolling 30-day window.

5. Sub-processors

We use the following sub-processors. Each is bound by written agreement to protect data consistent with this policy. When we add or replace a sub-processor, we notify district administrators at least 30 days before the change takes effect; districts may object during that window.

6. FERPA and COPPA

Chalk acts as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)). The district remains in control of student records at all times. We do not disclose personally identifiable information from student records to any third party except the sub-processors listed above.

For students under 13, Chalk does not collect data directly from children. Districts are responsible for COPPA-compliant parental notice and consent; Chalk processes data on the school's behalf under the COPPA school-authorization framework.

We never sell student data. We never use it for advertising. We never train AI models on it.

7. Retention and deletion

Roster data is retained for as long as the tenant is active. Districts may export their data at any time and may request deletion within 30 days of service termination. Encrypted backups age out on a 30-day rolling window. Security audit logs are retained for 13 months for incident-response purposes.

8. Data-subject rights

Data subjects (e.g., parents, students, staff) have the right, where applicable law provides one, to access, correct, delete, restrict, port, or object to processing of their personal data. Because Chalk processes school data on behalf of the district, requests should be directed to the district first. If a request reaches Chalk directly, we will forward it to the relevant district without undue delay and assist the district in responding within the timeframes required by applicable law.

Districts themselves can access, export, correct, and delete their data from the admin console at any time.

9. Security incident notification

If we confirm a security incident affecting district data, we will notify affected districts without undue delay and in any case within 72 hours of confirmation. Notification will describe what is known about the scope, the categories of data involved, and remediation steps.

10. International transfers

The hosted service operates from data centers in the United States. Where personal data is transferred from a jurisdiction that requires a transfer mechanism, the parties agree to incorporate Standard Contractual Clauses or equivalent safeguards by reference.

11. Children's privacy

Chalk is not directed to children as a consumer product. All processing of data about children under 13 occurs at the direction of, and under the authorization of, the district acting in loco parentis consistent with COPPA.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced to district administrators at least 30 days before they take effect. The "Last updated" date above always reflects the current version.

13. Contact

Privacy questions, data-subject requests, and incident reports: privacy@usechalk.xyz.