Privacy Policy

Last updated: July 2026.

Note: This is a plain-language summary of our practices, not legal advice. Have your counsel review before relying on it. For how we handle student education records specifically, see our Student Data & FERPA page.

Who we are

VolTrack provides software for schools to track student service hours and related activities. This policy covers our marketing site and the VolTrack application.

Information we collect

Account data: name, email, role, organization, and (for students) graduation year.
Usage data: service-hour submissions, opportunity sign-ups, and activity within the app.
Technical data: IP address, device/browser info, and log data for security and reliability.
Cookies: a session cookie to keep you signed in (essential), and — only with your consent — analytics cookies on our marketing pages. See “Cookies” below.

How we use information

To operate and secure the service, provide support, send transactional emails (e.g., verification, approvals, reminders), and improve the product. We do not sell personal information, and we do not use student data for advertising.

Cookies

Essential cookies are required to sign in and cannot be disabled. Analytics/marketing cookies (e.g., Google Analytics, Meta Pixel) load on our public marketing pages only after you accept via the cookie banner; declining keeps them off. The authenticated app contains no advertising trackers.

Sharing & service providers

We share data only with vetted service providers who help us run VolTrack, under contract, and when required by law. These fall into a few categories: cloud hosting & database (incl. encrypted file storage), transactional email, payment processing, SMS delivery (only if a school enables Communications), error monitoring, and an AI assistant used for the optional data-import feature. The AI step receives only an uploaded file's column headers and a small sample of rows to suggest column mapping — never the full roster — and the provider does not train on it. A current, named sub-processor list is available with our DPA on request. We do not sell personal information.

Communications & messaging

When a school enables our Communications add-on, we send announcements, automated reminders, and messages on the school's behalf. Email is used for transactional and school-initiated messages. Text messages (SMS) are sent only to recipients who opt in; for a student, texting additionally requires a verified parent/guardian's consent, and any recipient can reply STOP to opt out at any time.

Case studies (de-identified aggregates)

Only if a school's administrator grants explicit, revocable consent, we may share a de-identified, rounded aggregate of that organization (a participation percentage and an approximate hours total) in case-study materials shown to other schools. This never includes individual student data, names, or exact figures, and aggregates for small cohorts are suppressed entirely. Consent is off by default and can be withdrawn at any time from the school's Participation page.

Your choices & rights

You can access, correct, export, or delete your account data — for student records, requests are handled through the school. Contact us anytime to exercise these rights.

Children's privacy

VolTrack is provided to schools for their students. We handle students' information as a service provider to the school and in line with applicable laws (including FERPA and, where relevant, COPPA). For students under 13, VolTrack relies on the school to provide consent on behalf of parents under COPPA's school-consent exception; schools remain responsible for any additional parental consent their own policies require. We use student data only to provide the service to the school and never for advertising.

Security & retention

We use encryption in transit, hashed passwords, role-based access, and tenant isolation. We retain account and educational-record data for the life of the account. On account deletion or at a school's written request, we permanently delete the associated records within 30 days, except where a longer period is required by law. We will notify the affected school without undue delay after confirming any security breach involving their data, consistent with applicable law and our Data Processing Agreement.

Changes & contact

We'll post updates here with a new “last updated” date. Questions: privacy@voltrack.app.