Protecting student data
We build and document practical safeguards for student data.
Security is built into GradLaunch
Our hosting providers protect data in transit and at rest. Server side controls limit access to saved data.
Selected staff actions are logged
Selected staff access and check ins are logged with who and when, never student writing. Records are retained for up to two years.
Public database roles are locked down
Browser facing roles have no public table privileges. Server access and release checks verify permissions. This helps keep data private.
Sign in is secured by Clerk
Clerk manages sign in and account security. Passwords do not pass through GradLaunch servers.
Access is scoped to one school
Staff routes verify school membership on the server. Role based rules limit access before staff data is returned.
Student writing stays private
Staff views show progress signals, not private student writing. They do not request essay text or draft content.
API data is not shared for model training
GradLaunch keeps OpenAI API data sharing disabled. AI requests include only the content needed for the requested coaching.
Extension access is limited
The extension does not collect browsing history. When you use Read this page outside its supported sites, it asks for access to that site.
District privacy materials
Draft privacy agreement
A draft agreement covers data use, security, deletion, and incident response. District counsel reviews the final agreement.
Published subprocessors
The current list of processors is available on our privacy page. The draft agreement describes the notice process for changes.
Incident response terms
The draft agreement sets out notification and response expectations if a breach affects student data.
Data return and deletion
The draft agreement describes return or deletion at contract end. The process is managed by GradLaunch staff.
Found something?
If you believe you have found a vulnerability, write to us before disclosing it publicly and we will work with you. We do not pursue researchers who report in good faith and give us a reasonable window to fix it.
The other values