GradeStash
SECURITY AT GRADESTASH

Your school day.
Your information.

Your school information deserves careful handling. Here’s how we protect your account, connect to your school, and keep you in control.

See how it works

Account access

Your information belongs in your account.

Encrypted connections

Sensitive school sessions are stored encrypted.

Your choice

Saving your school login is optional.

Your Account and Academic Information

GradeStash requires you to sign in to access your academic information. Account access controls help keep your grades, assignments, schedule, and attendance separate from other students’ accounts.

Your academic information is not publicly searchable.

Your GradeStash account password is handled by our authentication provider. It is separate from your school password.

Connecting to Skyward

When you connect your school account, you use your school’s sign-in process. GradeStash retrieves the academic information that account is authorized to access.

To keep your connection available, GradeStash stores encrypted sign-in session information. School sessions can expire, and your school may require you to sign in or verify your identity again.

GradeStash is an independent student tool and is not affiliated with or endorsed by Skyward or your school district.

Your choice

Saved School Login.
Always Optional.

You can choose to save your school username and password and allow automatic reconnect. When you use GradeStash, we first try your existing session; if it cannot be restored, we can sign in again in the background. You can also keep reconnecting manually.

If you choose to save your login

  • Your school login is stored encrypted using Supabase Vault.
  • With your permission, GradeStash retrieves your saved login through its server to reconnect in the background when needed while you use GradeStash, or when you request a reconnect.
  • Your saved password is not displayed in GradeStash account or internal user-management pages.
  • Automatic sign-in does not bypass CAPTCHA or school verification. We ask you to complete those steps, or update a rejected password, when needed.
  • You can turn off automatic reconnect, replace your login, or remove it in Settings → School Connection.

Saving your login does not prevent school sessions from expiring or bypass your school’s security requirements.

What Encryption Means

Encryption protects stored session information and saved school credentials. To reconnect for you, GradeStash must be able to decrypt your saved school login during that process.

This is not end-to-end encryption: privileged systems with the necessary access can decrypt saved credentials. Access restrictions remain important alongside encryption.

You Stay in Control

You decide whether to save your school login and separately allow automatic reconnect. Turning off automatic reconnect leaves it available for manual reconnects. Removing it stops GradeStash from using that saved login for future reconnects; it does not sign you out of an already active school session.

To request deletion of your GradeStash account and associated information, contact gradestash@gmail.com. Our Privacy Policy explains how we handle information and deletion requests.

Help Protect Your Account

Use a unique password for GradeStash, sign out on shared computers, and only connect a school account you are authorized to access.

Never send passwords, verification codes, or sign-in session information in a support message.

Something Doesn’t Look Right?

If you discover a potential security issue, let us know. Include what happened and how to reproduce it, but leave out passwords, verification codes, and other students’ private information.

Report a security concern

No online service can guarantee absolute security. We aim to describe our protections accurately as GradeStash develops.