Privacy Policy

IEPPY (“IEPPY,” “we,” “us,” or “our”) helps parents and guardians organize and prepare for their child's IEP (Individualized Education Program) and 504 plan. We understand that the information you keep here is sensitive — it concerns your child's education, health, and development. This Privacy Policy explains what we collect, how we use it, and the choices you have.

By creating an account or using IEPPY, you agree to this Privacy Policy. If you do not agree, please do not use the service.

1. Who this is for

IEPPY is designed for parents, guardians, and the advocates they choose to invite — the adults responsible for a child's special-education planning. IEPPY is not directed to children, and children are not permitted to create accounts. Any information about a child is entered by an adult account holder acting on that child's behalf.

2. Information we collect

Information you provide

Account information: your name, email address, and a hashed password.
Child profile information you choose to enter: such as first/last name, date of birth, grade, school, district, plan type (IEP/504), eligibility category, and case-manager contact details.
Plan content: goals, accommodations, progress notes, meetings and prep checklists, deadlines, and notes you add.
Documents you upload: files such as IEP/504 documents, evaluations, and correspondence.
Sharing information: the email addresses of co-guardians or advocates you invite.

Information collected automatically

Basic technical data needed to operate the service, such as your session cookie and standard server logs (e.g. IP address and request timestamps).

We do not sell your personal information, and we do not use your child's records for advertising.

3. How we use your information

To provide and maintain the service and your account.
To store and organize the plans, documents, and deadlines you add.
To send you service communications — deadline reminders, co-guardian invitations, and password-reset emails. These are functional messages tied to your use of IEPPY, not marketing.
To secure the service and prevent abuse.
To comply with legal obligations.

4. How your information is shared

We share information only in these limited ways:

With people you invite. When you invite a co-guardian or advocate to a child, they can see that child's information within IEPPY. You control who is invited and can revoke access.
With service providers who process data on our behalf strictly to run IEPPY — currently our database host (Neon), file storage (Cloudflare R2), hosting (Vercel and Cloudflare), and email delivery (Resend). They are permitted to use the data only to provide services to us.
When required by law, or to protect the rights, safety, and security of users and the public.

5. How we store and protect your information

Passwords are stored only as salted, hashed values — never in plain text.
Access to a child's data is enforced per-account: a user can only reach a child they own or have been explicitly invited to.
Uploaded documents are stored in a private bucket and served through short-lived, signed links rather than public URLs.
Data is encrypted in transit (HTTPS).

No system is perfectly secure, but we work to protect your information using reasonable technical and organizational measures.

6. Data retention and deletion

We keep your information for as long as your account is active. You may delete individual children, documents, goals, meetings, and deadlines at any time from within the app. If you would like your entire account and associated data deleted, contact us at the address below and we will delete it within a reasonable period, except where we must retain certain records to meet legal obligations.

7. Your choices and rights

You can access and edit your information within the app.
You can revoke a co-guardian's access at any time.
You can request a copy or deletion of your data by contacting us.
Depending on where you live (for example, California or the EU/UK), you may have additional rights over your personal information. We honor applicable rights requests.

8. Children's privacy

IEPPY accounts are for adults. We do not knowingly allow children to create accounts or knowingly collect personal information directly from children. Information about a child is provided by the responsible adult account holder. If you believe a child has created an account, please contact us and we will remove it.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you. Your continued use of IEPPY after a change means you accept the updated policy.

10. Contact us

Questions about this policy or your data? Email us at privacy@ieppy.app.