Privacy Policy

Overview

MarkIT is an attendance service for teachers. This policy explains the data used to provide the service, including data that teachers enter about their students. We do not sell personal data or use student and attendance records for advertising.

1. Data used by MarkIT

Teacher account data

When you create and use an account, MarkIT uses your email address, display name, password hash, account settings, session information, and subscription status. Passwords are stored as bcrypt hashes, not as readable passwords.

Teacher-entered classroom data

MarkIT stores the data a teacher enters to run the service, which can include student names, school IDs and LRN, date of birth, sex, grade level, contact details, teacher-only notes, class and section information, attendance records, reasons, settings, and optional student photos. MarkIT can also create a student access code when a teacher chooses to use the student attendance-view feature.

Technical and security data

We process IP address and timestamps in security and service activity records for abuse prevention and operation. When the app encounters an error, it may also send a diagnostic report containing the page URL, browser user agent, error message, stack trace, relevant app context, and timestamp. These reports help us diagnose reliability and security problems.

2. How data is used

• To authenticate teachers and keep their accounts working.
• To display attendance, reports, and exports requested by the teacher.
• To synchronize account data between a teacher’s devices when they are online.
• To provide support and investigate service or security problems.
• To send account-related messages such as verification, password-reset, and email-change messages.

We do not send marketing email from the app.

3. Storage, synchronization, and service providers

MarkIT is offline-first. The app stores working data in the browser’s IndexedDB storage on the device, then synchronizes supported data with the MarkIT server when the device is online. Browser storage and cached photos can remain on a device until the teacher signs out, switches accounts, clears the device’s MarkIT data, or the browser removes stored data.

MarkIT uses Neon-hosted PostgreSQL for its application database and Cloudflare infrastructure for delivery and private R2 object storage for student photos. Photos are served through an authenticated MarkIT route rather than a public R2 link. We use email delivery services to send the account messages described above. These providers process data only as needed to operate their services for MarkIT.

Data sent between the app and MarkIT is protected in transit with HTTPS/TLS. Student photos are not public: MarkIT serves them only through an authenticated route. Passwords are stored as bcrypt hashes and authenticated sessions use secure, HttpOnly cookies.

4. Support access and sharing

We do not sell, rent, or share teacher account data or classroom data for advertising. Authorized MarkIT support and operations personnel may access data only when reasonably needed to provide support, maintain the service, investigate a security or reliability issue, or meet a legal obligation.

5. Payments and the Android app

The public website may offer a separate manual-payment flow. If you contact support about a website payment, send only the information support asks for; MarkIT does not ask you to email card or bank details. The first Android app release is access-only and does not offer Android checkout, pricing, receipt, QR, or upgrade instructions.

6. Student and minor data

MarkIT is intended for teachers, not for students to create their own teacher accounts. Teachers are responsible for deciding what student data to enter and for obtaining any permissions required by the laws and school rules that apply to them. MarkIT does not knowingly collect personal information directly from students.

7. Access, exports, and deletion

Teachers can view and update their classroom data in the app. MarkIT provides account backup/export tools, including a JSON account-data export and CSV exports for supported records.

You can delete an account in MarkIT under Settings → Profile & Security → Delete My Account. The app requires your current password and an explicit confirmation before it deletes the account’s associated account data. You can also use our public account-deletion request page if you cannot sign in.

Account deletion removes the account’s application data, including its classroom data, settings, sessions, tokens, payment records held by MarkIT, queued error reports, and account information. We also delete associated private photo objects. We retain only limited de-identified security and audit records when needed to protect the service or meet legal obligations: ordinary activity records for up to 60 days and data-wipe reminder audit records for up to 400 days.

8. Retention

While an account is active, MarkIT automatically deletes attendance records after two years. Student and section records that have been inactive for two years are deleted, and their associated photos are deleted at the same time. We send advance reminders before this classroom-data cleanup when applicable. Resolved diagnostic reports are retained for up to 60 days and unresolved reports for up to 180 days.

9. Cookies and website analytics

The app uses an essential HttpOnly session cookie to keep an authenticated teacher signed in. The public website uses Google Analytics and Cloudflare Web Analytics for aggregate website usage information. Google Analytics may set cookies such as _ga; Cloudflare Web Analytics does not use cookies. The website analytics are separate from student attendance data.

10. Changes and contact

We may update this policy by changing the “Last updated” date. For privacy questions or account-deletion requests, email [email protected].