Privacy Policy

School Task Agent is operated by Learn AI Agent LLC, a Georgia limited liability company. This policy explains what we collect, why, and how to get rid of it. It is written to be read, not to be survived.

What we collect

When you sign up, you give us:

• Your name and email address
• Your school's name
• The grade levels you are tracking

You can later add a different email address for notifications, from Settings inside the app, if you would rather task updates went somewhere other than your login address.

You do not set a password at that point. When we activate your account we email you a link to choose one, and it is stored scrambled from the moment you set it. We cannot read it and neither can anyone else.

Once you set up forwarding, we also receive:

• The school emails you forward to your School Task Agent address, including their full text
• The tasks we extract from those emails
• The sender addresses those emails came from

Some things are recorded automatically:

• The IP address your signup came from, which is what lets us stop bulk automated signups. We do not use it to work out where you are.
• Ordinary server logs. The companies that host the site and carry your mail record the usual things a web server records, including IP addresses, timestamps and which page was requested. We do not build anything out of those logs.
• If you install the mobile app and turn notifications on, a device token issued by Apple or Google. It identifies the handset, not you, and it is removed when you sign out. Notification delivery itself is not live yet, so nothing is currently sent to that token.
• Nothing about your face. If you turn on Face ID in the iPhone app, the check is done by your iPhone and we never receive, see or store anything from it. So that Face ID can sign you back in, your password is kept in your iPhone's Keychain, locked behind Face ID and tied to that phone. It is never sent to us or to anyone else. Turning Face ID off in Settings, or deleting your account from the app on that phone, removes it.
• A record of each time the pipeline ran for you: which of your task lists it ran for, and how many emails and tasks it handled. These records hold no task text and no message content.

A forwarded email is encrypted the moment it reaches us, before it is stored anywhere. It is decrypted only while we are pulling tasks out of it, and the encrypted copy is deleted as soon as that has worked. How long any readable copy lasts is set out under How long we keep it, below.

Cookies and tracking

We set a sign-in cookie to keep you logged in. Your browser may split it into more than one piece if it is large, but it is a single cookie doing a single job, not several different ones. There is no cookie banner here because there is nothing to consent to.

This product contains no analytics package, no advertising code, and no third party tracker of any kind. Nothing here follows you to other websites, builds a profile of you, or reports your behaviour to anyone. We are not measuring you. That is unusual enough to be worth saying plainly.

We also use your browser's local storage for a few small preferences that never leave your device: which task view you last used, whether you have dismissed the install prompt, and, briefly during account deletion, a summary of what was removed so the confirmation page can show it to you. None of this identifies you to us or tracks you anywhere.

Information about children

This is a service for parents, and only a parent holds an account. We deliberately do not ask for your child's name, date of birth, photo, or student ID, or anything else that identifies them individually within their school. The only things we ask for are your school's name and your child's grade level, which is what tells us which emails matter to you.

This service is not aimed at children and no child signs in, so we never collect anything from a child. Anything we hold about your child reached us because you sent it to us. That is what the Children's Online Privacy Protection Act is concerned with: collecting information from a child. The account is yours, and so is the choice about what arrives here.

School emails do sometimes name children, including yours. Where that happens the name can end up in a task, or in the copy of the message we hold while that task waits for your review, so that we can show you where it came from. It is kept and deleted on exactly the terms set out below. We do not build profiles of children, and we do not use this content for anything other than producing your task list. If we ever find we are holding more about a child than a name that arrived inside a school email, we delete it rather than keep it.

We are not your school

Worth being clear about, because it is the question schools ask. We have no relationship with your school and no contract with your district. We are not a school official, we hold no student records, and nothing here is supplied to or paid for by a school.

You are simply pointing a tool at mail that was already sent to you. Laws written for education technology, such as FERPA and the state student privacy acts, govern schools and the vendors they hire. They do not change what your school owes you, and using this does not hand any school data to a vendor. Your copy of your own mail stays yours.

How we use it

We read your forwarded school emails, pull out deadlines and requests, and turn them into tasks you can see. We send you a summary of new tasks if you have notifications switched on. That is the whole purpose. We do not sell your data, we do not share it with advertisers, and we do not use your emails or your tasks to train AI models.

The reading is done by software, not by a person. An AI model works through the text of each email and proposes tasks from it. No human at Learn AI Agent LLC reads your school mail, and the service is built to keep it that way: mail is encrypted on arrival with a key that our database and our staff accounts do not hold, so getting into either of those does not produce readable school email.

Who else touches your data

We use a small number of service providers to run the product. Each one only sees what it needs to do its job. We are a US company and your account and your tasks are stored in the United States. Two of these providers run global networks, so a request or a message can pass through equipment nearer to you on its way in.

• Supabase: stores your account and your tasks, holds forwarded email while it waits to be processed, and handles sign-in. Email content arrives there already encrypted.
• Anthropic: reads the text of a forwarded email to extract tasks. Anthropic does not train its models on this content.
• Cloudflare: receives mail sent to your School Task Agent address and encrypts it before it reaches our database.
• GitHub: runs the software that decrypts your mail and extracts the tasks. The work happens on their servers on a schedule, several times a day.
• Resend: sends the emails we send you.
• Vercel: hosts the website and app.
• Apple and Google: issue the device token if you install the mobile app and turn on notifications, ahead of that feature going live.

How long we keep it

Different things last for different lengths of time, and it is worth being precise about which is which.

• The email you forward is held encrypted until the next time the extractor runs, and the encrypted copy is deleted as soon as it has pulled the tasks out. The extractor runs five times a day, so in practice that is anywhere from a few minutes to about ten hours depending on when your school sent it. If a run fails, the message stays encrypted and waits for the next one rather than being lost. The one exception is mail from a sender we do not yet recognise: we hold that encrypted while you decide whether to add or ignore the sender, which can be longer than ten hours, and it is deleted the moment you tell us to ignore that sender.
• If you have chosen to review tasks before they are added, we keep a readable copy of the message body so you can see what a pending item refers to. It is deleted as soon as you approve or dismiss that item, and in any case within 10 days, whether you have looked at it or not.
• Your tasks, and the subject lines of anything sitting in your review inbox or waiting on a sender you have not yet recognised, are kept for as long as your account exists.
• Signup records, meaning the address and IP an attempt came from, are deleted after 7 days. If a signup was blocked as suspected automation, that record is kept for 30 days so a mistake can be spotted and undone.
• Run records, described above, last as long as your account.

When you delete your account, we delete all of it. There is no quiet retention period and no archive copy kept for our own use.

Deleting your account

You can delete your account yourself, at any time, from Settings inside the app. No email to support, no waiting on us.

Deleting your account removes:

• Your account and sign-in credentials
• Every task we have created for you
• Any forwarded email we are still holding, and any readable copy kept for your review inbox, including its subject line
• The sender addresses associated with your account
• Any device registered for notifications
• The run records described above, and your original signup record
• Your forwarding address, which stops working immediately

This is immediate and cannot be undone. Ordinary server backups may hold a copy for a short period before they age out.

We send one final email confirming what was deleted, so you have a record of it. If your notification address is different from the address you sign in with, it goes to both. That is the last thing we will ever send you.

Your rights

Wherever you live, you can ask us to do any of the following, and we will not treat you differently for asking:

• Tell you what we hold about you, and why
• Give you a copy of it
• Correct anything that is wrong
• Delete it

Deletion is built into the app, so you never have to ask us for that one. For anything else, email us and we will reply within 30 days. If we turn a request down, tell us and a person will look at it again.

We have never sold personal information and we do not share it for advertising. There is nothing here to opt out of, because we do not do it in the first place.

You do not need an account to ask. School mail names teachers, office staff and sometimes other families, so we end up holding a little information about people who never signed up for anything. If that is you, write to us at the address below and you have the same rights as anyone else here. Tell us the address the mail came from and we can find it.

Legal requests

If we are required by law to hand over information, by a court order or a valid legal demand, we will comply. We will tell you when that happens unless we are legally prohibited from telling you. We do not volunteer your data to anyone who has not compelled it.

If the business changes hands

If Learn AI Agent LLC is ever sold or merged, your data could transfer with it. If that happens we will tell you first, this policy continues to apply until you agree to a new one, and you can delete your account before the change takes effect.

Security

School email you forward is encrypted the moment it arrives, with a key that is not kept in the database holding it. Access to that database alone therefore does not produce readable school email.

Your tasks are a different matter, and we would rather say so than let the paragraph above imply otherwise. They are stored in readable form, because we have to show them to you and be able to help when something goes wrong.

Your data is held in an access controlled database with row level security, so one account cannot read another's. Traffic is encrypted in transit. No system is perfect. If a breach ever affects your data we will tell you directly and without undue delay, and in any case within the time the law requires.

Changes

If we change this policy in a way that matters, we will update the date at the top and tell you by email before it takes effect.

Contact

Learn AI Agent LLC, Georgia, USA.
support@schooltaskagent.com