Privacy Policy
1. The short version
- We never sell personal information.
- Schools stay in control of their student records; we process them on the school’s behalf.
- You can export your data and ask to be forgotten.
- We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. See SMS / text messaging.
2. What we collect
Your contact information stays yours. Your email address, address, and phone number are used only to deliver communications you’ve chosen to receive and, in your email’s case, to sign you in. If you create a passkey, we store only its public key and a name for it; the private key stays on your device and never reaches us. If you set a password, we store only a one-way hash, never the password itself. Messages are addressed to people, and bandMajor does the delivering.
Account information (name, address, email, optional phone, and photo); roster records your program creates about its members (grade, section, sizes, guardian relationships, and (encrypted and access-restricted) medical notes); content you post (messages, photos, documents, forms); financial records your program keeps (fees, payments, and fundraiser credits, though card numbers stay with our payment processor); and technical logs (IP, device, and activity records kept for security and auditing).
3. How we use it
To run the Service for your program: deliver messages, build calendars, track instruments and payments, and keep an audit trail; to keep users safe (automated content screening, guardian visibility, abuse prevention); to secure and improve the Service; and to send transactional email you expect (confirmations, notifications you opt into).
4. Student data & FERPA/COPPA
Where a school or district adopts bandMajor, we act as a “school official” with a legitimate educational interest under FERPA, processing education records only as directed by the institution. We rely on the school or program to obtain any parental consent required (including COPPA consent where applicable), and we support state student-privacy laws that prohibit targeted advertising to students and secondary uses of student data.
5. No advertising
bandMajor carries no advertising. There are no ad units anywhere in the Service, no advertising or ad-measurement scripts on any page, and no advertising profiles. We do not sell, rent, or license personal information to anyone, and we do not disclose personal information to third parties or affiliates for their marketing or promotional purposes.
6. Cookies & tracking technologies
We use a small number of first-party cookies that are strictly necessary to run the Service: to keep you signed in, remember your active organization and your light/dark theme choice, and protect against fraud and abuse. We do not use cross-site trackers or third-party analytics that follow you around the web, and no advertising or tracking scripts load anywhere in the Service. Because we don’t track across sites, there is nothing for a browser “Do Not Track” or Global Privacy Control signal to opt out of; we honor those signals as a request to limit any optional analytics on our public marketing pages.
7. When we share
With your program, according to its roles and settings; with your district, where your program belongs to one, whose administrators see program-level totals (membership counts, instrument inventory and its value, outstanding balances) and can look up instruments across programs to arrange transfers and loans, but not individual student records, messages, or payment details; with processors that help us run the Service (hosting, email and text-message delivery, payments) under contracts that limit their use of data; when the law requires it (we tell the affected organization unless prohibited); and in a merger or acquisition, where this policy continues to apply to collected data.
Mobile numbers and text-messaging consent are narrower than the above: they go only to the provider that delivers your messages, never to third parties or affiliates for marketing or promotional purposes, and are never sold.
8. SMS / text messaging
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Sharing with subcontractors that provide support services, such as the messaging provider that delivers these messages, is permitted. All other categories in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
We collect your mobile number, your name, and the date and time you gave consent, solely to deliver the messages you asked for. Message frequency varies with your program’s activity, typically 0 to 5 messages per week. Message and data rates may apply. Reply STOP to opt out or HELP for assistance.
How consent is obtained. Texts are off until you turn them on, and only you can turn them on: signed in to your own account, you verify your mobile number by typing back a one-time code we text to it, then press the button that turns texts on. That verification code is the only text we send before consent, and only because you asked for it. We never buy or rent phone lists. Your consent is recorded with its date and time in an append-only audit log. Messages come from bandMajor and carry the announcements your director chooses to send by text (bandBlasts), schedule and call-time changes, emergency alerts, and account notices such as fee balances. The weekly summary arrives by email only and is never a text.
How to stop. Reply STOP to any message, or turn text messages off in your profile at any time. Reply HELP for assistance, or email support@bandmajor.com. Opting out of texts never affects your access to bandMajor.
Your number is passed to our messaging provider for the sole purpose of delivering these messages, under a contract that forbids any other use.
9. Security
Data is encrypted in transit and at rest; sensitive fields (like medical notes) carry additional per-person encryption; access inside a program is role-based; administrative access is logged. No system is perfectly secure. Report concerns to security@bandmajor.com.
10. Retention & your rights
We keep data while your account or program is active and as required for audit and legal obligations. You can export your data from your profile at any time. You can request erasure (“right to be forgotten”): after a grace period, personal data is anonymized in place and encryption keys for protected fields are destroyed. Schools can direct us to delete their students’ records. California, Virginia, and other state residents may have additional rights (access, correction, deletion, portability). Use the same contacts to exercise them; we do not discriminate for doing so.
11. Children
Students under 13 do not get bandMajor accounts. A parent or guardian holds the account and adds their child by name; the child never signs in, and we collect nothing from the child directly. Everything about them comes from a parent or from the program’s own records. Their director reviews and approves the child’s roster record before it becomes active, and we keep a record of which parent provided it and when.
A child under 13 still has their own roster record, because a program needs one to assign them a locker, issue equipment, and track fees. All communication about that child goes to their guardians’ accounts. There is no inbox for the child to receive it in.
Where a school or program adopts bandMajor directly, we also rely on the institution to establish any consent COPPA requires. We do not knowingly collect personal information from children outside these two paths; if you believe we have, email privacy@bandmajor.com and we will delete it.
12. Tag Day
Tag Day lets a program run a door to door fundraising day: its volunteers, many of them students, walk assigned streets with the Tag Day phone app while organizers coordinate from the web. Everything above still applies; this section covers what Tag Day adds. A program that does not use Tag Day has none of this data.
What Tag Day holds
- Who takes part: the members the program adds to a Tag Day, with their role (for example canvasser, driver or chaperone), team and car seat.
- The ground: the areas a program draws on the map and the addresses inside them, which come from OpenStreetMap, a public map, and not from any person.
- Door records: which doors were visited, when and by which team, the notes volunteers type (stored encrypted), and the flags a program keeps on an address, such as a request not to be visited.
- Money: gifts and payments in whole cents, and the donor details a program records with them, which are stored encrypted.
- Phones: a record of each signed in phone (its name and the network address it last connected from), so the program can see and sign out its devices.
- Messages: the day of message board among the program’s volunteers, and the emails the program sends about its Tag Day.
Location
- Off until the person turns it on. Location sharing is off on every phone until its user switches it on, and it works only while the app is open; the app shows when it is sharing. The app has no background location: when it goes to the background, sharing stops and the position held is deleted.
- Only on the day, and in practice runs. A phone’s location is accepted only while the Tag Day is in its main event, and before it only during a practice run the program holds, from that run’s own members. It is never accepted after the Tag Day ends. Our servers enforce this whatever a phone sends.
- Seen by few. On the day, a volunteer’s position is seen by their own team and by the program’s live staff (the people the program has given the live view permission, and the Tag Day’s managers). Teams working the same area do not see it in this release. A volunteer on no team is seen by live staff only, and a participant on no team who is not live staff sees no one’s position. What they see is the volunteer’s first name and last initial, their team and where they are. In a practice run, only that run’s members see it, on their own phones; live staff on the web do not. Guardians who are not working the Tag Day, donors and the public never do.
- Never stored. A position is held in memory for at most two minutes, on a store configured not to save to disk, and then disappears. Positions are never written to our database, our logs or our backups, so there is no location history to view, export or lose. When the Tag Day ends, every position still held is erased at once.
- Stopping. A volunteer can stop sharing at any time, which deletes their position at once. Live staff, and organizers who may change the Tag Day’s settings, can pause location sharing for the whole Tag Day: every position still held is erased at once, and none is accepted until they turn it back on. We can also switch location sharing off across the whole Service.
Guardians and students
- Guardians are told first. When a program adds a student to a Tag Day in a role that uses the phone app, each of the student’s guardians in the program is sent a notice naming the Tag Day and its date, and saying when the app shares location and who can see it. A student’s location is not accepted until that notice has gone to at least one of their guardians, so a student none of whose guardians can be reached does not share. A guardian whom the program has marked as having no access to the student is not sent one. Organizers can see when a student’s guardians could not be reached.
- Guardians can opt out. The notice carries a link that turns location sharing off for that student on that Tag Day, with no sign in, and erases any position of theirs still held. Each link works once, and stops working after 180 days or when the Tag Day closes.
- Children under 13 have no bandMajor account (see section 11), so they cannot sign in to the Tag Day app and never share a location. A program may still list them on a team.
How long Tag Day keeps data
Each deletion below runs by itself on a schedule. For most of them the clock starts when the Tag Day closes.
- Positions: at most two minutes, in memory only.
- Phone sign-in codes: deleted after one day. Phone records: deleted 30 days after the phone’s session expires or is signed out.
- 30 days after a Tag Day closes: practice runs, availability notes, car labels, seat holds, friend pairs and phone readiness reports are deleted, and so are the stored printed territory maps and the team packets.
- Driver form files: deleted a set number of days after the main day, 30 unless the program chooses another number from 7 to 90. The record that the form was completed stays.
- 13 months after a Tag Day closes: door visits and their notes, message board posts, group emails and the results of its background jobs are deleted, and the Tag Day’s encryption key is destroyed, so every donor detail sealed under it becomes unreadable in our live system (a backup made earlier keeps the key until it ages out, below). Gift amounts and door totals are kept as the program’s financial and fundraising record, with no donor details attached.
- Star donor notes: deleted 90 days after the program removes the star. A star replaced by a newer flag on the same address keeps its note for as long as the newer flag stands.
- Flags created from an address list a program imports expire 12 months after they are approved. The details of each match against that list are deleted 90 days after the check while the match waits for a decision, 90 days after the program declines it, or 30 days after the flag it led to is removed or expires.
- The reasons given when someone recommends that an address not be visited: deleted 24 months after the program reviews the recommendation. The outcome stays.
- Backups: nightly backups are kept 35 days (daily copies) and 730 days (monthly copies) and then age out. A record deleted on the schedule above can therefore remain in a backup for up to two years, and a backup made before a Tag Day’s key was destroyed still holds that key until it ages out.
Erasure and your copy
Erasure (section 10) reaches Tag Day too, in the same step as the rest of bandMajor: the person’s name is removed from every Tag Day record, their notes and phone sessions are cleared, and any position still held is deleted. Gift amounts credited to them stay, under “Deleted User”, so a program’s totals still add up. A program can also ask us to erase a person who has no account, such as a student listed only on a team. Your data export includes your Tag Days: each one’s name, your role, the gifts credited to you and the board messages you wrote.
No AI
Tag Day sends nothing to an AI provider: no name, address, note, message, photo or location. Door notes and message board posts are screened for abuse on our own servers. One limit, stated plainly: a post a program chooses to share from Tag Day to its bandMajor feed is an ordinary feed post and is screened like any other (section 3).
Where Tag Day’s data goes
- OpenStreetMap: nothing. Addresses and the street map are downloaded once a month as whole files (from Geofabrik and Protomaps) into our own storage. The phone app and the web pages never ask a map server for anything.
- U.S. Census Bureau and public boundary and map layers from local governments: nothing but the request for the file. We use a published boundary or map layer (a school attendance map, a sidewalk layer) only once we have cleared its licence.
- USGS aerial photos (The National Map): nothing but the map area requested, once per Tag Day boundary, copied into our own storage.
- Address lookup services (geocoders): none are used. Tag Day looks up no address with any outside service.
- AI services: nothing. Tag Day sends no text, photo, name, address or location to any AI provider, including the one bandMajor uses elsewhere. Door notes and message board posts are screened on our own servers only.
- Google and Apple: only a person's own sign in, as everywhere in bandMajor. Tag Day sends no push notifications in this release.
- Email delivery provider: the recipient's address and the message, for Tag Day emails such as the guardian notice.
- Text-message delivery provider: nothing. Tag Day sends no text messages.
- Payment providers (Stripe, PayPal): nothing. A donor who gives online uses the program's own donation page in their own browser. When a treasurer uploads the program's payment export to match gifts, the file itself is not kept: only the payments made around the Tag Day are stored, with donor details encrypted.
- Hosting and network (Railway, Cloudflare): all Tag Day data, as for the rest of the Service: hosting, encrypted connections and file storage.
13. Changes & contact
We will post any material changes here with a new effective date and notify organizations in the Service. Questions: privacy@bandmajor.com · Tapawingo Labs Inc., Virginia, USA.