Privacy Policy

Campus Coin Journey is an educational web application for the Central Islip My Brother’s Keeper (MBK) × Campus Coin Invest program. It is operated by Impact-Focused Tech Solutions LLC (“we”, “the vendor”) on behalf of the District.

Students

• First name, last name, preferred name and grade, as provided by the District or program staff.
• Unique account identifiers and sign-in/activation credentials.
• Session attendance and check-ins.
• Assessment responses (for example, baseline and final self-ratings).
• Goals, reflections, career interests and saved opportunities.
• Portfolio and activity records created during the program.

Staff

• Name, work email address and role (instructor/admin or educator).
• Authentication information needed to sign in.

Students should not enter sensitive personal or financial information (such as Social Security numbers, bank or card details, home addresses or health information) into reflections, goals or any other field.

Technical information

Application error reporting can include error messages, stack traces and page paths. Lovable Cloud documentation describes authentication events and operational logs, including requests and database operations. These documented capabilities do not establish every field collected or retained for this application.

Owner review needed: Confirm whether IP addresses, device/browser information, authentication metadata or request contents are retained for this application; identify recipients, purposes and retention periods. Actual log contents and provider collection settings have not been verified.

Information is used only to deliver the educational program: to let students take part in sessions, track their own progress and portfolio, and to let authorized program staff and District educators support students and report on program participation.

We do not sell student personal information, and we do not use it for advertising, marketing or building profiles unrelated to the program.

• Students: current database rules scope individual activity records to the signed-in student's identifier. Students may create, update and delete their own permitted records and read shared program content. These rules do not close the separate public roster described below.
• Educators: read-only access to student profiles, attendance, check-ins, assessments, goals, reflections, career interests and portfolio/activity records for the cohorts they are assigned to. Educators have no administrative write access.
• Instructor/Admin: authorized administrators can manage student access, program content, cohort records and reporting. Administrative write operations are role-gated; students retain their own permitted activity writes.
• The public and families: general program pages are public. The current demo student activation flow also exposes roster display names, grades and activation status to signed-out visitors. This is an unresolved privacy vulnerability, not an intended protection for real student data.

Owner review needed: Remove and test the public roster lookup and exposed demo access credentials before any real student information is loaded. The separate security draft has not been accepted. Verify student-to-student isolation, educator read-only access within assigned cohorts, admin authorization and existing-account sign-in before describing those changes as active.

The application is built and hosted using Lovable, which provides application hosting. Data and sign-in accounts are managed through Lovable Cloud. This description identifies the current service arrangement; it does not establish a separately executed provider agreement or a complete list of subprocessors for this application.

Lovable publishes a Data Processing Agreement, subprocessor information and Cloud documentation. Available provider documents are not evidence that the vendor or District has accepted particular terms or that every listed provider receives this application's data.

Owner review needed: Confirm applicable agreements, provider roles and subprocessors, and this application's data storage location. Published HTTPS access does not verify encryption at rest or all service-to-service connections. Project-specific encryption settings and contractual assurances remain unverified; no encryption or legal-compliance assurance is made here.

Parents, guardians and eligible students may request to review or correct student information through the District. The vendor will work with the District to respond to verified requests.

The District and vendor must agree the student-record retention period and procedures for verified export and deletion requests before real student onboarding. No automatic retention or complete secure-deletion process has been verified. Resetting access or deactivating a student retains their history; it is not deletion.

Lovable Cloud documents daily database backups retained for up to roughly 14 days and a database export capability that includes account data. Backups and database exports do not include storage files. These are provider capabilities, not a verified backup inventory or a promise of record-level deletion from backups. No student-facing export or complete secure-deletion workflow was found in the application.

Owner review needed: Agree the retention period, request verification, export format and secure delivery, deletion procedure and timeline, and backup expiration. Verify available backups and restore behavior. Deletion from provider logs and backups, and any preservation exceptions, remain unresolved; no data has been exported or deleted during this review.

Proposed notification commitment: we will notify the District in the most expedient way possible, without unreasonable delay, and no later than seven calendar days after discovery of a breach or unauthorized release of covered personally identifiable information. Notification will not wait for an investigation to be completed.

8 NYCRR § 121.10(a) uses seven calendar days, not seven business days, for third-party contractor notification to an educational agency. This draft uses that stricter deadline for review; it does not claim legal compliance.

Owner review needed: Confirm the District's executed agreement, incident contact, notification method, escalation process and required notice contents. Apply any earlier contractual deadline. The District-specific procedures and contract have not been verified.

We will update the effective date when this policy changes and inform the District of material changes.

Impact-Focused Tech Solutions LLC · bevon@campuscoininvest.com