Privacy Policy

If you enter a referral code during signup, we link your new account to the student who shared it. That student can see your first name, join date, and whether you completed a verified school connection. We do not share your email address, grades, school login, or password through the referral page.

We keep referral codes, attribution, connection qualification, notification read dates, and reward redemption records to operate the program and prevent repeated rewards. Checkout uses an account-restricted Stripe discount. Using a referral code is optional.

When you create or use a GradeStash account, we may collect information you provide directly, including:

• Name
• Email address
• School or school district
• Grade level or graduation year
• Account preferences
• Notification preferences
• Information you provide when contacting GradeStash for support
• Beta registration or invitation information

GradeStash may also maintain information necessary to determine whether your account has completed onboarding, connected a supported school system, or enabled particular features.

When you choose to connect a supported school account, GradeStash may retrieve, process, and store academic information that your school account is already authorized to access.

Depending on your school and the information made available through its systems, this may include:

• Courses and class names
• Teachers
• Class periods
• Sections
• Rooms and buildings
• School schedules
• Grading periods
• Current and previous grades
• Assignment names
• Assignment categories
• Assignment dates and due dates
• Scores
• Points possible
• Assignment status
• Grade history
• Course and assignment metadata
• Other academic information necessary to provide GradeStash features

GradeStash may use this information to provide features such as grade history, grade-change information, estimated GPA, What-If calculations, missing-work information, and other academic tools.

GradeStash does not make a student's academic information publicly searchable.

GradeStash may allow you to connect an account provided by your school or school district.

Authentication takes place using your school's sign-in process. You can sign in manually or optionally ask GradeStash to save your school login and, with your permission, reconnect automatically in the background while you use GradeStash. Manual reconnect remains available.

GradeStash stores your school username and password only if you explicitly choose to save your school login. This choice is optional and is separate from creating a GradeStash account or connecting your school manually.

Saved school credentials are stored encrypted in Supabase Vault. When you request a reconnect or have enabled automatic reconnect, GradeStash's server retrieves and decrypts those credentials to enter them into the supported school sign-in screen. They are saved only after a successful connection retrieves and verifies academic information. With separate permission, saved credentials may be used for background sign-in when your existing session cannot be restored while you use GradeStash. They are not displayed in account or internal user-management pages. Automatic attempts are limited and stop when school verification or a rejected password needs your help.

This is not end-to-end encryption. Privileged systems with the necessary access can decrypt saved school credentials to perform a reconnect you requested or an automatic reconnect you authorized. School verification requirements, including additional authentication challenges, still apply.

You can turn off automatic reconnect, replace, or remove saved credentials in Settings → School Connection. Removing them withdraws permission to use that saved login for future reconnects. It does not end an existing school session or delete previously synchronized academic information.

To maintain a connection after authentication, GradeStash may securely process and retain encrypted authentication session information, such as session cookies or equivalent session state. This information is used only to maintain the connection you authorized and retrieve your academic information.

School authentication sessions may expire. When this occurs, GradeStash may require you to reconnect your school account.

Authentication session information is treated as sensitive information and is not intended to be exposed publicly or made available to other GradeStash users.

GradeStash uses account authentication to protect user accounts and academic information.

Authentication information may include:

• Email address
• Authentication session information
• Account verification status
• Password-reset information

Passwords used for your GradeStash account are handled through our authentication provider. GradeStash does not need to store your GradeStash password in readable form.

GradeStash may use information to:

• Create and maintain your account
• Authenticate users
• Connect supported school accounts
• Retrieve and synchronize academic information
• Display courses, grades, assignments, schedules, and related information
• Detect changes to grades and assignments
• Maintain grade history
• Calculate estimated GPA
• Provide What-If and grade-impact calculations
• Identify missing, upcoming, or recently graded work
• Maintain user preferences
• Provide account and service communications
• Provide requested notifications when supported
• Operate and improve the GradeStash beta
• Diagnose errors and reliability issues
• Prevent fraud, spam, automated abuse, and unauthorized access
• Protect GradeStash, its users, and its infrastructure
• Respond to support, privacy, and security requests
• Comply with applicable legal obligations

GradeStash may perform calculations using academic information retrieved from your school.

These calculations may include estimated GPA, What-If grades, grade impact, projections, or similar information.

These calculations are provided for convenience and may differ from calculations made by your teacher, school, or district.

Your school's official records remain authoritative.

GradeStash does not alter grades or academic records maintained by your school.

GradeStash does not sell student personal information or academic information.

GradeStash does not use a student's academic records to create publicly searchable student profiles.

If GradeStash's business model or data practices materially change in the future, this Privacy Policy will be updated as appropriate.

GradeStash uses service providers to operate the service. Depending on the features being used, these providers may process limited information on GradeStash's behalf.

Categories of service providers may include:

• Authentication providers
• Secure data storage and database infrastructure
• Website and application hosting
• School-system connectivity infrastructure
• Transactional email providers
• Security and abuse-prevention providers

Supabase provides GradeStash account authentication and database infrastructure, including encrypted storage of optional saved school logins through Supabase Vault. Our school-connection infrastructure processes saved credentials temporarily when carrying out a reconnect you request.

These providers operate under their own terms and privacy practices.

GradeStash may change service providers as the service develops.

We do not consider the use of service providers necessary to operate GradeStash to be a sale of student academic information.

GradeStash may interoperate with third-party student information systems, including Skyward.

GradeStash is an independent service and is not affiliated with, endorsed by, sponsored by, or operated by Skyward, Inc., McKinney Independent School District, or any other school or school district unless explicitly stated otherwise.

References to third-party services are used only to identify compatible systems or explain functionality.

All third-party trademarks belong to their respective owners.

You should only connect a school account that you are authorized to access.

GradeStash is not intended to provide access to academic information that the user could not otherwise access through the applicable school account.

GradeStash and its service providers may use cookies, browser storage, and similar technologies where necessary to:

• Keep users signed in
• Maintain sessions
• Remember preferences
• Provide security
• Prevent abuse
• Support application functionality
• Determine whether certain onboarding or installation prompts have already been shown

GradeStash does not currently use these technologies for third-party behavioral advertising.

GradeStash treats student academic information and authentication information as sensitive.

GradeStash uses technical and organizational measures intended to protect information, which may include:

• Encrypted connections
• Authentication
• User-level access controls and data isolation
• Encryption of sensitive information where appropriate
• Server-side protection of privileged credentials
• Rate limiting and abuse prevention
• Restricted infrastructure access

You can read more about these protections and saved-school-login choices on our Security page.

However, no website, application, network, or storage system can guarantee absolute security.

If you believe you have discovered a security issue involving GradeStash, contact gradestash@gmail.com.

GradeStash retains information for as long as reasonably necessary to provide and secure the service, maintain accounts, fulfill user requests, resolve disputes, prevent abuse, or satisfy applicable legal requirements.

Academic information may remain stored after a school authentication session expires so that users can continue viewing their most recently synchronized information.

Encrypted school session information may be retained while a school connection remains active and may be replaced, invalidated, or deleted when appropriate.

Saved school credentials are retained until you remove them, replace them, or your account is deleted. Removing or replacing a saved login deletes its old credential value from active storage. Previously created backups may retain encrypted copies until those backups expire under the applicable retention process.

Beta registration information may be retained while the beta program is active or for as long as reasonably necessary to manage access.

Users may request deletion of their GradeStash account and associated personal information by contacting:

gradestash@gmail.com

GradeStash may need to verify the identity of the requester before processing a deletion request.

Deleting your account also removes its saved school credentials from active storage.

Deletion may not immediately remove information from temporary backups, security records, or systems where limited retention is reasonably necessary for legal, fraud-prevention, security, or operational purposes.

Where supported, users may disconnect their school account from GradeStash.

Disconnecting a school account may prevent future synchronization. Previously synchronized information may remain associated with the GradeStash account until deleted or otherwise removed.

GradeStash may invalidate or remove stored authentication session information when a school connection is disconnected.

GradeStash is currently intended for users 13 years of age or older.

Children under 13 should not create a GradeStash account, join the beta, connect a school account, or provide personal information through GradeStash.

GradeStash does not knowingly seek to collect personal information from children under 13 without appropriate authorization.

If we learn that information from a child under 13 was collected in circumstances requiring parental authorization that was not obtained, we will take reasonable steps to address the situation, including deletion where appropriate.

Parents or guardians may contact gradestash@gmail.com with concerns.

GradeStash treats academic records as sensitive information.

Academic information is processed to provide features requested by the student and to operate, secure, and improve GradeStash.

GradeStash does not claim to be acting as a FERPA-designated school official for a school or district unless GradeStash has separately established such a relationship.

Nothing in this Privacy Policy should be interpreted as representing that GradeStash is officially approved by a particular school or district.

GradeStash may send service-related emails, including:

• Account verification
• Password resets
• Security notices
• Beta invitations
• Important account notices
• School-connection notices
• Other communications necessary to provide GradeStash

GradeStash may later offer optional notifications or product communications. Where appropriate, users will be given relevant choices regarding optional communications.

GradeStash may support browser or device notifications in the future.

When available, notification permission will be controlled through the user's browser or device. Users may disable those permissions through their device or browser settings.

GradeStash may link to or interact with third-party websites and services.

GradeStash is not responsible for the privacy or security practices of third-party services outside GradeStash's control.

GradeStash is under active development, and this Privacy Policy may change as the product, integrations, or legal requirements evolve.

When appropriate, GradeStash may provide notice of material changes through the website, application, or email.

The date at the top of this policy identifies its most recent update.

Questions, privacy requests, deletion requests, or security concerns may be sent to:

gradestash@gmail.com