Security

Effective September 7, 2026 · Last updated October 12, 2026

How SchoolBoardHQ protects your account and data.

How your account is protected

Your password is never stored in plain text or in a reversible ("encrypted") form. Our authentication provider, Supabase Auth, stores a bcrypt hash of your password — a one-way transformation that cannot be decrypted back into your original password, even by us.

Controls you manage yourself

Everything else on this page describes protections that apply to every account automatically — there is nothing for you to switch on. The security settings you do control for your own account are in the app, under Settings → Privacy → Security. That is where you review the members you have blocked and choose whether other members can find and contact you in the member directory. Your password itself is changed under Settings → Account & identity → Email & password.

Data protection in our database

Every table in our database has row-level security rules that scope what a signed-in user can read or write to their own data and whatever else our visibility rules explicitly allow (for example, a district-mate seeing your board role). Privileged operations — claiming a board seat, an admin approving a manual review — run through dedicated server-side functions rather than a raw database write a client could tamper with. We maintain an automated test suite that exercises these access rules directly against our database.

Data in transit

All traffic between the app and our backend is encrypted in transit (TLS), via our backend provider Supabase's infrastructure.

Third parties

These are the only service providers with access to any of your data.

Service providers we use and what they receive

Supabase

Purpose

Backend database, authentication (including optional sign-in with Google or Apple, an optional LinkedIn connection for importing your name, and optional two-factor authentication), and file storage

Data shared

Account and directory data, uploaded documents, and — if you choose to use them — the identity your sign-in provider shares and your two-factor authentication secret

Retention

For as long as your account is active

Anthropic

Purpose

AI-assisted features: drafting text on your behalf, summarizing and organizing material you already have, finding your board's published information, and answering your questions

Data shared

Only the specific input a feature needs — see AI-assisted features below

Retention

Governed by Anthropic's API terms; not used to train its models

Voyage AI

Purpose

Turning the text of board documents saved to your Workspace, and the Ask HQ questions that search them, into search vectors so Ask HQ can find the relevant passage

Data shared

The extracted text of a document you or a member of your board saved to Workspace, in short passages, and the wording of an Ask HQ question that searches those documents — never your name or account details

Retention

Governed by Voyage AI's API terms; the search vectors are stored with the document in Supabase

PostHog

Purpose

Usage analytics and feature-flag targeting, tied to your account ID

Data shared

Your account ID, feature-flag evaluation requests, and feature-usage events — not their content

Retention

Per PostHog's standard analytics retention

Sentry

Purpose

Crash and performance diagnostics, so we can find and fix errors in the app

Data shared

Error and performance reports from the app. Names, email addresses, message and post text, document contents and similar personal fields are removed on your device before a report is sent — and so are the internal ids of the records involved, so a report cannot be traced back to your account. Error reports from our servers carry only the failing feature, the error type and a short developer-written description, with ids and email addresses removed; never what you wrote, uploaded or asked

Retention

Per Sentry's standard error-reporting retention

Resend

Purpose

Sending account and notification email — verification codes, digests, and opted-in founder/product updates

Data shared

The email address a message is sent to, and the contents of that message

Retention

Per Resend's standard email-delivery retention

Expo

Purpose

Delivering push notifications to your device, if you allow them

Data shared

Your device's notification token, and the notification itself — which includes the name of the member who prompted it and, for a reply to something you posted, the text of that reply. A new-message notification deliberately carries only the sender’s name, never the message

Retention

For as long as the notification is in transit; tokens are removed when you sign out

RevenueCat

Purpose

Processing the optional SchoolBoardHQ Pro subscription, and its web checkout

Data shared

A record of your subscription and an identifier tied to your account, plus, for a web purchase, your account email (or one you enter at checkout) for the receipt — never your payment card details

Retention

Per RevenueCat's standard retention

Apple App Store

Purpose

Billing and payment processing for a SchoolBoardHQ Pro subscription bought in the iOS app

Data shared

Handled entirely by Apple — we never receive or store your payment card details

Retention

Governed by Apple's own retention policies

Stripe

Purpose

Payment processing for a SchoolBoardHQ Pro subscription bought on the web

Data shared

The card details and billing information you enter at checkout, which go directly to Stripe — we never receive or store your payment card details

Retention

Governed by Stripe's own retention policies

Certifications

SchoolBoardHQ has not pursued formal third-party security certification (such as SOC 2 or ISO 27001) at this stage. Our security practices are described above and are open to review on request.

Responsible disclosure

If you believe you have found a security problem in SchoolBoardHQ — a way to read or change data that is not yours, to act as another member, or to get past a check the app is supposed to make — email support@schoolboardhq.com. Please tell us privately first, before describing the problem publicly, so members are not exposed while we are still fixing it.

A report we can act on usually includes:

•

What you were doing, and the screen or web address where you were doing it.

•

What happened, and what you expected to happen instead.

•

The steps someone else would follow to see the same thing.

•

Roughly when it happened, and the device, operating system, and app or browser version you used.

•

Whether you think anyone else’s data was reachable, and roughly how much — described, not attached.

Please do not send us another member’s personal information, anyone’s password, or confidential district, student, or personnel information as evidence. Describing what you were able to reach is enough for us to reproduce it.

What you can expect back: a person will confirm we received your report, then follow up to tell you whether we could reproduce the problem and what we decided to do about it. We have not committed to a published response time, and we would rather say that than name a number we cannot promise to hold — so if you think a problem is being actively exploited, say so in the subject line.

What we ask of you in return:

•

Give us a reasonable chance to fix the problem before you describe it publicly.

•

Stop as soon as you have confirmed a problem exists. One record or one account is enough to demonstrate it — do not collect, change, or keep data that is not yours.

•

Test with your own account, never someone else’s.

•

Do nothing that degrades the service for members: no denial-of-service testing, no high-volume automated scanning, and no attempts to talk a member or a staff member into handing over access.

SchoolBoardHQ does not run a paid bug bounty program and does not pay for security reports. We would rather be plain about that before you spend time on one than leave you to assume otherwise. If you would like credit for a report we act on, say so and we will credit you by name; if you would rather not be named, we will not name you.

Changes

If we make a material change to our security practices, we update the date at the top of this page.