Privacy Policy

1 Overview & Our Commitment

BullyAlert is a mobile application operated by Sentinel Beacon Labs ("we," "us," or "our") that enables students to anonymously report bullying incidents and empowers school staff to respond effectively. We are deeply committed to protecting the privacy of every user — especially students.

This Privacy Policy explains what information BullyAlert collects, how it is used, and the choices available to users and schools. By using the BullyAlert app, you agree to the practices described in this policy.

2 Information We Collect

BullyAlert is designed with a minimal data collection philosophy. We collect only what is necessary to operate the service safely and effectively.

Information collected automatically:

• Device identifier: A randomly generated, anonymous device ID is created the first time the app is launched. This ID is not linked to your name, email address, phone number, or any other personally identifiable information.
• School code: The school code you enter during onboarding, which associates your device with a specific school for routing reports and confirmations.
• App role: Whether you are using the app as a student or a staff member.
• Push notification token: If you grant permission, a device push token is stored to deliver alerts. This token is not linked to your identity.

Information you provide voluntarily:

• Incident reports: Location within the school (e.g., hallway, cafeteria) and optional free-text notes describing an incident. Notes are anonymous and should never include your own name or the name of any student.
• Confirmation responses: Whether you confirm or deny witnessing an ongoing incident.

3 How We Use Information

We use the information collected solely to operate and improve the BullyAlert service:

• To route incident reports to the appropriate school's staff dashboard.
• To calculate credibility scores for reports based on anonymous crowdsourced confirmations.
• To send push notifications to staff when a report crosses a credibility threshold, and to students selected for confirmation prompts.
• To award in-app badges to students who participate in the confirmation system.
• To generate anonymized aggregate statistics for school administrators (e.g., total incidents by location, resolution rates).
• To diagnose technical issues and improve app performance.

We do not use your information for advertising, marketing profiling, or any purpose unrelated to the operation of the bullying reporting service.

4 Student Anonymity & Identity

Protecting the identity of students who report bullying is the foundational principle of BullyAlert. The system is architected so that staff members cannot identify which student submitted a report.

• Reports are linked internally to an anonymous device ID, never to a name or login credential.
• Staff dashboards display only the incident details (location, notes, credibility score) — the reporter's identity is never shown.
• Credibility scores are computed from the aggregate of anonymous confirmations; no individual confirmer is identified to staff.
• We do not provide any mechanism for staff to de-anonymize reports, and we do not respond to requests to identify reporters except where required by a valid court order.

5 Information Sharing

We do not sell, rent, or trade your information. We share information only in the following limited circumstances:

• With your school: Incident reports submitted through the app are shared with the designated staff members at the school you enrolled in. This is the core function of the service.
• Service providers: We use third-party infrastructure providers (cloud hosting, database services) to operate the app. These providers process data on our behalf under confidentiality agreements and are not permitted to use your data for their own purposes.
• Push notification services: Apple Push Notification Service (APNs) and Google Firebase Cloud Messaging (FCM) are used to deliver notifications. Only the device push token is transmitted; no incident content is sent through these services.
• Legal requirements: We may disclose information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the safety of any person.

6 Data Retention

We retain incident data for as long as the associated school account is active and for a reasonable period thereafter to support record-keeping and dispute resolution. Schools may request deletion of all data associated with their school code at any time by contacting privacy@bullyalert.app.

Anonymous device IDs and associated activity records are retained for the lifetime of the school's subscription. Upon account termination, all associated data is deleted within 30 days.

Push notification tokens are deleted when a user logs out of the app or when the token is invalidated by the operating system.

7 Children's Privacy (COPPA)

BullyAlert is designed for use in school environments and may be used by students under the age of 13. We comply with the Children's Online Privacy Protection Act (COPPA).

Because BullyAlert does not collect any personally identifiable information from any user — including children — we do not require parental consent for a child to use the app. The anonymous device identifier we generate is not considered personal information under COPPA because it cannot be used to identify, contact, or locate a specific child.

Schools deploying BullyAlert are responsible for obtaining any necessary parental consents required by their own district policies or applicable state law. We encourage schools to include BullyAlert in their standard technology use notification to parents.

If you believe a child has provided us with personally identifiable information, please contact us immediately at privacy@bullyalert.app and we will take steps to delete that information.

8 FERPA Compliance

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. BullyAlert is designed to operate as a school safety tool without creating or maintaining education records as defined by FERPA.

Because reports are submitted anonymously and cannot be linked to a specific student's identity, they do not constitute education records under FERPA. Schools that choose to incorporate BullyAlert incident data into a student's official disciplinary record do so under their own FERPA obligations and policies.

Sentinel Beacon Labs acts as a school official under FERPA's legitimate educational interest exception when processing data on behalf of schools that have executed a data processing agreement with us. We do not use school data for any purpose other than providing the BullyAlert service.

9 Data Security

We implement industry-standard technical and organizational measures to protect the information we hold:

• All data is transmitted over encrypted connections using TLS 1.2 or higher.
• Data at rest is stored in encrypted databases with access controls limited to authorized personnel.
• Staff access to school dashboards is protected by PIN authentication and session management.
• We conduct periodic security reviews and promptly address identified vulnerabilities.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you discover a security vulnerability, please report it responsibly to security@bullyalert.app.

10 Your Rights

Because BullyAlert does not collect personally identifiable information, most traditional data subject rights (access, correction, portability) do not apply in the conventional sense — there is no profile linked to your identity to access or correct.

However, you have the following rights:

• Opt out of push notifications: You may disable push notifications at any time through your device's system settings.
• Reset your device ID: Uninstalling and reinstalling the app generates a new anonymous device ID, effectively severing any link between your new activity and your prior activity.
• School data deletion: School administrators may request deletion of all incident data associated with their school by contacting privacy@bullyalert.app.
• California residents: If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). Because we do not sell personal information and do not collect personal information as defined by CCPA, most CCPA provisions do not apply. Contact us with any questions.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify school administrators by email.

Your continued use of BullyAlert after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically.

12 Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

• Email: privacy@bullyalert.app
• General inquiries: outreach@bullyalert.app
• Company: Sentinel Beacon Labs
• Website: https://bullyalert.app

We will respond to all privacy-related inquiries within 10 business days.