Privacy policy

GoalPath helps school staff record how students are doing on their daily goals (the Daily Engagement Form, or “DEF”) and share that progress with families. It is operated by Akshay Ravikumar (“we”) on behalf of the school districts that use it.

The short version

• Student information belongs to the school district. We use it only to run GoalPath for that district.
• We never sell it, never use it for advertising, and never build profiles of students for any other purpose.
• Only people the district invites can sign in, and each person sees only what their role allows.
• The district can ask us to export or delete its data at any time.

Who this applies to

GoalPath is used by district administrators, paraeducators and other school staff, and by parents or guardians the school invites. Students do not have accounts and do not use GoalPath directly.

What we store

• Student information entered by school staff: name, grade, school, behavior goals, daily scores, attendance notes (such as absences or time out of class), written notes (“wins”, “challenges”, services attended), and photos of paper forms.
• Account information: name, email address and role of each staff member and parent, which students they are connected to, and invitations sent.
• Activity records: who created or changed each DEF and when, and standard server and security logs (for example, sign-in events and data access logs).

We do not collect students' birthdates, home addresses, ID numbers, health records or location.

How we use it

• To show staff and families each student's progress, and to let staff record and correct DEFs.
• To read photos of paper DEFs: a photo is sent to Google's Gemini model (Vertex AI, processed in the United States) to fill in the form. Google does not use this data to train its models.
• To send invitation and sign-in emails.
• To keep the service secure and working, and to fix problems.

Who can see it

• District administrators can see and manage all students and accounts in their district.
• Paraeducators can see and edit DEFs only for the students they are assigned to.
• Parents and guardians can see progress only for their own children. They do not see staff-only notes or review details.
• The operator can access data only to run, support and secure the service, or when the district asks us to.

We do not share student information with anyone else, except as required by law.

Service providers

We use a small number of providers who process data only to run GoalPath:

• Google Cloud (United States): hosting, database, photo storage, sign-in (Firebase Authentication) and the Gemini model for reading form photos.
• Resend (United States): sending invitation emails. Resend receives only the recipient's email address and the invitation message.

How long we keep it

• DEFs and student information are kept while the district uses GoalPath, so staff and families can see progress over time.
• Photos sent from a phone that are never saved to a DEF are deleted within one day.
• Administrators can permanently delete a student and all of their data at any time.
• If a district stops using GoalPath, or asks us to delete its data, we delete it within 60 days, after giving the district a chance to export it.
• Security and server logs are kept for up to 400 days, as set by Google Cloud.

Security

Data is encrypted in transit and at rest. Access requires signing in with an invited account. Each request is checked against the user's role and assigned students, and access to stored data is logged. If we learn of a breach affecting student information, we will notify the district promptly and as required by law, so it can notify families.

Families' rights (FERPA)

DEFs are part of a student's education records, which the school district controls. Under the Family Educational Rights and Privacy Act (FERPA), parents and eligible students can ask the school to review, correct or limit the sharing of these records. Please contact your school or district; we help them respond. We operate as a “school official” under the district's direction and do not disclose education records except as the district allows. We also follow California's student privacy laws, including the Student Online Personal Information Protection Act (SOPIPA) and Education Code section 49073.1.

Changes

If we make a material change to how student information is used, we will tell the districts using GoalPath before it takes effect, and update the date at the top of this page.

Contact

Questions or requests: support@goalpath.org.