Privacy Policy

1. Introduction

Philadelphia Literacy Initiative ("PLI," "we," "our," or "us") operates this platform to help volunteer tutors log tutoring sessions and help school partners track literacy progress. This Privacy Policy explains what information we collect, how we use and safeguard it, and your rights. We designed the platform with student privacy as a first-order concern and comply with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable Pennsylvania law.

2. Information We Collect

Tutor and Administrator Information

• First and last name, email address, and phone number
• Phone-verification codes (short-lived, used for login only)
• Session reports and tutoring activity you submit
• IP address, browser/user-agent, and access logs used for security and abuse prevention

Student Information (Pseudonymized)

We do not store student names, dates of birth, home addresses, or other direct identifiers. Student records in the platform are pseudonymized using an internal student code. We do, however, store the following indirect identifiers that, in combination, may allow a person within the school community to identify a specific student:

• An internal, non-public student code
• Grade level (Pre-K through 4th)
• School and classroom teacher
• Reading-level assessments (beginning, middle, end of year)
• Per-session reading progress, fluency, comprehension, and attendance
• Social-emotional learning (SEL) ratings on a 1–5 scale
• Books read and pages completed
• Free-text session notes entered by the tutor

We treat this information as an education record under FERPA and handle it accordingly.

3. How We Use Information

• Let tutors log sessions and track student progress
• Provide administrators with aggregate reporting and program oversight
• Generate reports for partner schools and funders (cell sizes below 10 are suppressed or generalized)
• Authenticate users and prevent unauthorized access
• Comply with legal obligations and respond to lawful requests

We do not use any information for advertising, marketing profiling, or commercial resale. We do not use student data to train third-party artificial-intelligence models.

4. FERPA — School-Official Status

PLI receives student records from each partner school district under a written data-sharing agreement and operates as a "school official" with a legitimate educational interest pursuant to 34 CFR § 99.31(a)(1)(i)(B). This means:

• Student records are used only for the literacy-tutoring purpose authorized by the district
• PLI does not redisclose student information except as permitted by FERPA
• Parental rights to inspect, review, and request correction of records run through the school district, not PLI directly
• On request from the district, PLI will return or delete student records covered by the agreement

5. COPPA and Children Under 13

The platform is used by adult tutors and administrators, not directly by children. No account is created for, and no information is collected directly from, any student. Where COPPA applies, PLI operates under school authorization consistent with the FTC's guidance on educational-technology providers contracting with schools.

6. Data Security

• All traffic is served over HTTPS/TLS
• Authentication is phone-based with time-limited one-time codes; no passwords are stored
• Role-based access: tutors see only their assigned students; administrators are approved individually
• Session edits are auditable, with a full edit history retained
• Rate limiting and CSRF protections are enforced on all forms
• Our production database is hosted with a reputable provider with encryption at rest

7. Service Providers

We use a small number of vendors to operate the platform. Each is bound by a written agreement limiting use of data to the services they provide to us:

• Twilio — SMS delivery of login verification codes and tutor notifications
• Benmore Technologies — application hosting and infrastructure

The platform does not send email and does not use any third-party artificial-intelligence service to process student data.

8. Data Retention

• Tutor accounts: retained while active; archived 12 months after the last session, then deleted
• Session and progress records: retained for the duration of the program plus 3 academic years for longitudinal reporting, then deleted or returned to the district
• Phone verification codes: expire after 5 minutes and are cleared on successful login
• Access logs and IP addresses: retained for up to 90 days

Partner districts may request earlier deletion at any time under the data-sharing agreement.

9. Your Rights

As a tutor or administrator, you may:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account, subject to retention obligations tied to the educational records you created
• Opt out of non-essential communications

If you are the parent or legal guardian of a student, your rights to inspect, review, and correct that student's records are exercised through your child's school district under FERPA. The district can route a request to PLI on your behalf.

10. SMS Messaging

By providing your phone number, you agree to receive transactional SMS messages from PLI, including login verification codes and tutor account notices. Message frequency is occasional. Message and data rates may apply. Reply STOP to any message to opt out. We do not use SMS for marketing.

11. Cookies

We use essential first-party cookies to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising, analytics, or cross-site tracking cookies.

12. Breach Notification

If we experience a security incident involving your personal information, we will notify affected users and partner school districts without unreasonable delay, consistent with Pennsylvania's Breach of Personal Information Notification Act and the terms of each district data-sharing agreement.

13. California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to request deletion, and the right to non-discrimination. We do not sell or share personal information as those terms are defined by the CCPA. To exercise these rights, contact us using the details below.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via in-app notice and SMS at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

15. Contact Us

Questions or privacy requests may be directed to: