Children’s online privacy.

1. Who this notice covers

This notice applies to personal information OneTeam collects, uses, or discloses from or about students under 13 who use OneTeam through their school’s authorization. Information about adult users (teachers, school administrators, parents, and guardians) is governed by our Privacy Policy.

2. The school-authorization model

OneTeam is provided to schools as an educational tool. Under the FTC’s guidance on COPPA in the school context (16 C.F.R. § 312.5; FTC COPPA FAQ Section M), a school may consent to the collection of student personal information on behalf of a parent when:

• The data is collected for the use and benefit of the school, and
• The data is not used for any commercial purpose unrelated to the educational service.

OneTeam meets both conditions. We collect student data only at the school’s direction, only for the educational decisions OneTeam supports (check-ins, MTSS tier reasoning, intervention tracking, family communication), and never for advertising, profiling, or any commercial purpose unrelated to the service.

Schools that adopt OneTeam are responsible for notifying parents of the data-collection practices described in this notice. OneTeam provides parents direct access to review the data through the OneTeam app and parent-rights workflows described below.

3. What information we collect from or about children

OneTeam may collect the following categories of personal information from or about students under 13:

• Identifiers — first name, last name, optional student ID, classroom assignment.
• Educational records — check-in data, behavior ratings, attendance, intervention progress, goals, rewards, parent-request notes — entered by authorized teachers and administrators.
• Tier assignments — computed by OneTeam from the data above; reflects the school’s MTSS framework.

OneTeam does not collect from children: precise geolocation, biometric identifiers, browsing or search history, social-graph data, audio or video, photos, or any data that is not directly required for the educational decision being supported.

4. How we collect it

OneTeam does not collect personal information directly from children. Children do not create accounts, do not log in, and do not submit data to OneTeam through any user interface. All data about children is entered by authorized adults (teachers, administrators) acting under the school’s authority.

5. How we use it

We use children’s personal information only to provide the OneTeam service to the school:

• Displaying the student’s record to authorized teachers, administrators, and the student’s parent or guardian.
• Computing MTSS tier suggestions and progress trends from the school’s data.
• Sending school-configured Microsoft Teams notifications to channels the school designates.
• Maintaining an audit log of changes for accountability.

We do not use children’s personal information for: advertising, behavioral targeting, AI model training, market research, profiling, or any commercial purpose unrelated to the educational service.

6. Disclosure of children’s information

We disclose children’s personal information only to:

• The school — authorized teachers, administrators, and the student’s parent or guardian.
• Sub-processors — Supabase (Postgres database, authentication, and transactional auth email; us-west-2), Vercel (web hosting and serverless compute, iad1), and Microsoft Teams (only when the school has configured the Teams integration). Each sub-processor is contractually bound to handle data subject to the same restrictions as this notice. No student information is ever included in any auth email.
• As required by law — in response to a valid legal process, with notice to the school except where prohibited.

7. Parents’ rights

Parents and guardians of students under 13 have the following rights, exercisable at any time:

• Review. View your child’s complete record in the OneTeam parent app, or request a copy in machine-readable form.
• Correct. Request correction of inaccurate information through your child’s school. Corrections are completed within 7 days of school confirmation.
• Refuse further collection. Withdraw consent at any time by notifying your child’s school. Withdrawal does not by itself delete the existing record — request deletion separately if you want the record removed.
• Delete. Request permanent deletion of your child’s record. We delete within 7 days of school confirmation, with cascading deletion across every database table.

Contact your child’s school directly, or email privacy@oneteam.school. For full procedural detail, see Parents’ Bill of Rights.

8. Data retention

Children’s personal information is retained only as long as needed to provide the service to the school. Behavioral check-ins, tier history, and cycle evaluations are eligible for automatic deletion after 2 academic years by default (schools may configure shorter retention). When a school’s license terminates, all student data is deleted within 30 days, except as required by law.

9. Security

Data in transit is protected by TLS 1.2 or higher. Data at rest in our database is encrypted with AES-256. Access is governed by Row-Level Security so a teacher can only see students assigned to them, and an administrator can only see students within their authorized school. Every access and change is recorded in an audit log. Full details on Security.

10. Changes to this notice

We may update this notice. Material changes affecting how we collect, use, or share children’s personal information will be announced with at least 30 days’ prominent notice to schools. Continued use after the effective date constitutes acceptance.

11. Contact us

The operator of OneTeam for COPPA purposes is Foxtide, LLC, 11615 Holmes Point Drive NE, Kirkland, WA 98034. Questions, complaints, or requests under COPPA: privacy@oneteam.school. We acknowledge within 3 business days and respond substantively within 14 days.