Privacy Policy

Effective date: October 1, 2026

This policy explains what information eduScout collects, why, who else handles it, how long we keep it, and what you can do about it. We have tried to write it the way we would explain it to a friend. If anything here is unclear, email privacy@eduscout.app. That address reaches both founders directly.

eduScout is run by eduScout LLC, an Arkansas company. “We” and “us” mean eduScout LLC.

The short version

• You can search every school without an account.We don’t ask who you are to show you the map.
• We never sell your information, and we never share it with anyone for their own purposes — not schools, not advertisers, not data brokers. This is a promise in our Trust Covenant, not only a policy line.
• We collect nothing about your children. No names, no ages, no grades.
• We don’t use analytics services, advertising, or tracking cookies.
• You can delete your account yourself,and we explain below exactly what that removes and what it doesn’t.

What we collect, and why

If you just browse (no account)

We don’t store anything that identifies you. Two things still happen, and you should know about them:

• Server logs. Like every website, the servers that run eduScout record basic technical details of each request, including the IP address your device connects from. Our hosting provider records these automatically and we cannot switch it off. They are deleted after 30 days.
• The map. The map is drawn by Mapbox. To load it, your browser contacts Mapbox directly, so Mapbox receives your IP address, the area of the map you are looking at, and basic technical information about how the map loaded, which Mapbox uses for billing and performance. Mapbox also stores a small item in your browser for this. None of this passes through our servers.

“Near me”uses your device’s location only if you allow it, and only on your device. It is used to filter the map on your screen and is never sent to us.

If you join the waitlist

• Your email address and ZIP code, so we can tell you when eduScout opens near you. The ZIP code also helps us decide where to go next.
• If you arrived from one of our printed cards, the card’s code adds one to that card’s count. We count signups per card; we do not record which signup came from which card.
• If you answered our one-time “Keep me posted” email, we keep your email address (not your ZIP code) on a separate list, used only to announce major eduScout updates. Every one of those emails has a one-click way off the list, and leaving deletes your address.

If you create an account

Your account is handled by our sign-in provider, Supabase, so that eduScout never sees or stores your password.

• Email and password. Your email address and a scrambled (hashed) form of your password are held by Supabase. We never see your password.
• Sign in with Google (optional). If you choose it, Google shares your name, email address, profile picture link and Google account ID with Supabase. If your Google account belongs to a school or company, Google also shares that organisation’s domain. We use your name and email to set up and show your account. We don’t display your Google picture, and we use nothing from Google for any other purpose — see Google user data below.
• Your name, if you add or change it on your account page.
• Sign-in records.While you are signed in on a device, Supabase keeps a record of that session, including the device’s IP address and a description of its browser, so it can keep you signed in securely. The record ends when you sign out.

Our own database stores:

• Saved schools — the schools you choose to save.
• Reviews you write — the text, the date, and whether it has been published. A review shows its date but never shows who wrote it. Our servers know which account wrote it, so you can see and manage your own reviews.
• Reports you make — if you report a review, we keep your reason and which account made the report. The report is never shown publicly.

We do not keep a separate copy of your email address in our own database.

What we never collect

• Anything about your children.eduScout doesn’t ask for their names, ages, grades or needs. Please don’t include details in a review that could identify a child. We read every review before it appears, and we won’t publish one that does.
• Your contacts, your browsing on other sites, or advertising identifiers.

Who else handles your information

We don’t sell your information and we don’t share it for anyone else’s purposes. A small number of companies run parts of eduScout for us. They handle information only on our behalf, under contracts that bar them from using it for anything else:

The table above is the current list, and we update it beforeany new company starts handling your information, not after. When eduScout launches we’ll publish it at eduscout.app/subprocessors as well, so you can check it without reading this whole page.

Legal requests.If a valid legal order compels us to disclose information, we will disclose only what the order requires. Where the law allows, we’ll tell you first.

If eduScout is sold or merged. Our promises go with the company — see the Trust Covenant. If eduScout ever shuts down, we will give you notice and a chance to download your information, and then delete it. We will not voluntarily sell family information as part of a wind-down.

How long we keep it

One honest limit on “deleted.” When something is deleted, it disappears from eduScout straight away. Copies still sit in our encrypted database backups until those expire, which takes about four weeks. We cannot remove a single record from a backup; the backup expiring is what completes the deletion.

Deleting your account

You can delete your account yourself from your account page. When you do:

• Straight away:you’re signed out everywhere, and your saved schools are deleted.
• Within about an hour: your sign-in account (your email, password and any Google profile) is deleted by Supabase.
• Your reviews stay up, but without any link to you. Reviews never showed who wrote them. What deleting your account removes is the link that only our servers could see. If you want your reviews taken down too, email privacy@eduscout.app before you delete your account — we can find them while that link still exists. Once your account is gone we cannot take them down, because nothing left in our systems shows which reviews were yours, and we will not remove a review on someone’s say-so that it was theirs.
• Reports you made keep their reason text, with the link to your account removed.
• We keep a short record that the account was deleted, for about 30 days. It contains a random internal account number, not your email or name, so our systems keep honouring the deletion.
• Signing up again:you can register again with the same email address about an hour after deleting. Your new account starts empty, and your old reviews can’t be reattached to it.

Your choices and rights

Wherever you live, you can:

• See your information. Your saved schools, your reviews and your email are all visible in your account.
• Get a copy of everything we hold about you. Email privacy@eduscout.app and we’ll send it within 30 days.
• Correct it. Change your name on your account page, or ask us to correct anything else.
• Delete it. Delete your account yourself, or ask us to remove your waitlist entry — or your reviews, while your account still exists (see Deleting your account).
• Use eduScout without an account.

We will never treat you differently for asking.

Cookies and similar technology

We use only the cookies needed to keep you signed in. There are no advertising or tracking cookies, and we don’t use analytics services. Mapbox stores one item in your browser as part of drawing the map (see If you just browse).

Google user data

If you use Sign in with Google, we receive only basic profile information: your name, email address, profile picture link and Google account ID. We use it only to create your eduScout account and sign you in. We don’t sell it, share it, use it for advertising, or use it to train AI models. Deleting your eduScout account deletes it (see Deleting your account). You can also remove eduScout’s access at any time from your Google Account settings.

Children

eduScout is for parents and guardians. You must be 18 or olderto create an account. We don’t knowingly collect information from anyone under 18, and we don’t collect information about children at all. If you believe someone under 18 has created an account, email privacy@eduscout.app. We look into every report straight away. We don’t close an account on an accusation alone — we check first, and we’ll ask the account holder to confirm they are 18 or over. If we can’t satisfy ourselves that they are, we delete the account.

Security

Information travels between your device and eduScout encrypted. Our database and its backups are encrypted when stored. Access to your information is limited to eduScout’s founders. If a breach ever affects your information, we will tell you within 72 hoursof finding out, in plain language — what happened, what was affected, and what we’re doing about it — whether or not the law requires it.

Where your information is kept

Our servers and the companies listed above are in the United States.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change means we’d use or share your information in a way this policy doesn’t already allow, we’ll tell account holders by email and give you at least 30 days’ notice before it takes effect, so you can delete your account first if you’d rather. We will never make a change that lets us sell your information, or share it for someone else’s purposes — that promise is in our Trust Covenant and it does not change.

What changes on November 12, 2026

Until that date nothing in this section applies. From that date, six parts of this policy will read as follows.

The short version.The line “We don’t use analytics services, advertising, or tracking cookies” becomes:

No advertising, no tracking cookies, and no outside analytics company. We count visits ourselves, on our own servers, without identifying you — and you can switch that off.

If you just browse (no account).“Two things still happen” becomes “Three things still happen”, and a third item is added:

Counting visits. We count which pages get opened, which site sent visitors to us, what kind of device they used, and their rough location (city, never an address). We run this ourselves: no cookies, no outside company, and no link to your account. We can tell when the same device comes back within a month, but not whose it is. Our site never records your screen or what you type. You can turn it off — see Your choices and rights.

Who else handles your information. The Railway row becomes:

Our servers and database: saved schools, reviews, the waitlist, visit counts, and server logs

Your choices and rights. One item is added:

Turn off visit counting.Use the switch on this page. It works without an account. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we don’t count your visits.

Cookies and similar technology becomes:

We use only the cookies needed to keep you signed in. There are no advertising or tracking cookies. Our own visit counting uses no cookies. If you turn visit counting off, we store one item in your browser to remember that choice. Mapbox stores one item in your browser as part of drawing the map (see If you just browse).

How long we keep it. One row is added:

Visit counts (pages opened, arriving site, device type, rough location — not linked to you): 12 months

Contact

privacy@eduscout.app — both founders read it.