Privacy Policy

1. Our role and relationship with schools

Weft provides a specialized proctoring and essay examination platform designed exclusively for use by K-12 schools and their authorized teachers and students. Schools (or their governing districts) are the data controllers with respect to student personal information. Weft acts solely as a service provider and, where applicable under the Family Educational Rights and Privacy Act (FERPA), as a "school official" that processes student data only pursuant to the school's documented instructions and only to the extent necessary to provide and improve the Service.

We do not use student data for our own marketing, advertising, profiling, or any commercial purpose unrelated to delivering the Service to the contracting school. We do not sell personal information as that term is defined under applicable state student data privacy laws or the California Consumer Privacy Act (CCPA) / CPRA.

2. Information we collect and the purposes for which we collect it

We collect and process only the categories of information described below, and only for the purposes stated. We practice data minimization at every stage.

Account information

Teacher and student email addresses and passwords. Passwords are handled exclusively through Supabase Auth using industry-standard secure practices. We use this information to authenticate users, associate them with the correct school and classes, and enable teachers to manage assignments and review work.

Essay and assignment content

Essay text stored as HTML, word counts, creation and last-modified timestamps, submission status, and any teacher annotations or grades entered through the Service. This information is stored in a Supabase Postgres database subject to row-level security policies that limit access to authorized school personnel and the individual student.

Proctoring data (collected only during active exams)

While an exam session is in progress the application collects the following information solely for the purpose of enforcing exam rules and creating an auditable record:

• The names and identifiers of running applications, matched against a list of known remote-desktop, screen-sharing, screen-recording, and remote-control software. Only the match results are recorded: application names and identifiers, never window contents or documents. While a flagged application is running, the student's writing is paused until it closes.
• Indicators that the exam is running inside a virtual machine environment (hardware model strings, CPU flags, and device-tree signals).
• The number of attached displays.
• Exam-window status events, such as the student leaving full screen or the exam losing focus, and when they resume.
• The essay text itself, autosaved as the student types so the work reaches the teacher for grading.

The application does not capture screenshots or any other image of the student's screen, and it does not collect or compare the device's IP address for network verification. If a future deployment adds a same-network check or any optional capture feature, this Policy will be updated and schools notified before it is enabled.

No proctoring data is collected or transmitted when an exam is not actively running. The application does not monitor keystrokes outside the exam editor, read the contents of other applications or browsers outside the exam context, or capture audio or video of the student or room. Monitoring ends the moment the student submits or the teacher ends the session.

Teacher-created content

Assignment prompts, attached PDF files, and lists of approved external websites (sourced from a Google Sheet managed by the school). These materials are stored to enable students to access the correct resources during the exam and are visible only to the relevant class.

Optional Blackbaud integration

If a teacher or school administrator chooses to connect a Blackbaud SKY instance, we store OAuth access and refresh tokens necessary to import class rosters and, if enabled, write grades back to the school's gradebook. These tokens are stored securely, scoped to the minimum permissions required, and used only for the explicitly requested integration. The school may disconnect the integration at any time, after which the stored tokens are deleted.

Technical and infrastructure information

App version, operating system version, and basic crash or performance diagnostics used to deliver updates through GitHub Releases and to maintain reliability of the Service. The public marketing website (hosted on Vercel) may collect standard web analytics such as pages viewed and referring URLs; no student essays or proctoring data ever reach Vercel or GitHub.

3. How we use and share information

We use the information we collect only to operate, maintain, and improve the Service for the benefit of the contracting schools. Specific uses include authenticating users, delivering exam content and collecting submissions, performing the proctoring functions described above, enabling teachers to review and grade work, facilitating optional Blackbaud synchronization, providing customer support, sending service announcements, and complying with legal obligations.

We share information only with the subprocessors listed below, each of which has entered into data protection agreements that impose confidentiality and security obligations no less protective than those in this Policy and that restrict processing to the purposes we specify.

We may also disclose information if required to do so by law, regulation, or valid legal process (such as a subpoena or court order), or to protect the rights, property, or safety of Weft, schools, students, or others. Where legally permitted, we will provide advance notice to the affected school before making such a disclosure.

4. Data retention and deletion

Default retention period: Student essay content, submission metadata, and proctoring records (check results and exam-window status events) are retained for the remainder of the current academic year plus one additional year, unless the school configures a different retention period in its account settings, after which they become eligible for automated deletion unless the school has indicated a legitimate ongoing need (for example, a pending academic integrity proceeding or litigation hold).

Account credentials and teacher-created assignment content are retained for as long as the school maintains an active subscription or pilot agreement and the relevant accounts remain in use.

School-initiated deletion: An authorized school administrator may request deletion of data for an individual student, an entire class, or all data associated with the school at any time by emailing newtheyork@gmail.com or using in-application deletion tools (when released). Upon verification of the requestor's authority, we will permanently delete or irreversibly anonymize the specified data within thirty (30) days, except to the extent retention is required by applicable law or a valid legal hold. Deletion of proctoring records from completed exams occurs on the default schedule unless a specific preservation request is received.

5. Security

We implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of the information we process. These safeguards include, but are not limited to:

• Code-signing and Apple notarization of the macOS application binary.
• PostgreSQL row-level security (RLS) policies that enforce strict isolation between schools and between roles within a school.
• Use of signed, time-limited (expiring) URLs for delivery of outlines and attached reference files.
• Encryption of OAuth tokens and other sensitive credentials at rest.
• Transport Layer Security (TLS) for all data in transit.
• Restricted access to production systems and databases, with authentication and audit logging.

While we strive to protect information, no method of transmission or storage is 100% secure. Schools are responsible for maintaining the security of teacher and student devices, local networks, and any credentials used to access the Service.

6. Rights of students, parents, and schools

Because the school is the data controller, requests to access, review, correct, or delete student educational records should generally be directed first to the school in accordance with the school's FERPA and state-law procedures.

Parents, eligible students, or school officials may also contact Weft directly at the address below for assistance with privacy requests. We will coordinate with the school to respond in a timely manner and will not charge a fee for reasonable requests that do not impose disproportionate burden. If we are unable to fulfill a request directly, we will explain why and, where appropriate, direct the requester to the school.

Teachers and students may update their email addresses or request account deletion through normal support channels. Account deletion will result in removal of the ability to log in but does not automatically delete historical essay submissions or proctoring records; those remain subject to the school's retention and deletion policies.

7. Students under 13 and COPPA

Where the Service is used with students under the age of thirteen (13), the school or district acts as the parent's authorized agent for purposes of the Children's Online Privacy Protection Act (COPPA). Collection of personal information from these students occurs only with the school's explicit authorization and under the school's direction and oversight. Weft does not knowingly collect personal information directly from children under 13 in the absence of school authorization, nor does it use such information for any purpose other than providing the Service to the school.

8. International data transfers

All student personal information processed in connection with the Service is stored and processed in the United States by Weft and its subprocessors. By using the Service, schools consent to the transfer of student data to, and processing in, the United States. Data protection laws in the United States may differ from those in the student's country of residence. Where required by applicable law, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses approved by the European Commission or equivalent safeguards.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of the Service. When we make material changes we will provide notice to schools (by email to the address on file or through an in-app announcement) and will update the "Last updated" date above. The then-current version of the Policy will govern all use of the Service after the effective date. Schools are responsible for ensuring that any additional notices or consents required by FERPA, COPPA, or state law are provided to parents and students in connection with material changes.

10. Contact

This Privacy Policy is part of, and incorporated into, our Terms of Service. Capitalized terms used but not defined here have the meanings given in the Terms of Service.