Privacy Policy

1. Introduction

SPED Goals (“we”, “our”, or “us”) operates the SPED Goals iOS application (the “App”). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. By using the App, you agree to the practices described in this policy.

This App is intended for adult educators and parents supporting students. Children do not create accounts. Adults may enter personal information about students, including children, as described below.

2. Information We Collect

2a. Information You Provide Directly

• Account registration: Email address, display name, and password when you create an account. If you sign in with Google or Apple, we receive your name and email from those providers.
• Student records and attachments: Student names or aliases, grade levels, IEP goals, scores, attendance markers, notes, and photos or documents you upload. These records are stored under your educator account and may contain disability-related or other sensitive information you choose to enter.
• Purchase information: If you subscribe to SPED Goals Premium, Apple processes your payment. We store subscription status, product and transaction identifiers, expiry dates, and an account-linking identifier to provide and restore access across devices. We never receive your Apple payment card details.
• Shopify store orders:If you purchase physical resources in the in-app store, your shipping address and order details are processed by Shopify, Inc. See Shopify's Privacy Policy at shopify.com/legal/privacy.

2b. Information Collected Automatically

• Usage analytics: We use Firebase Analytics (Google LLC) to collect app-instance identifiers, general location derived from IP addresses, device and app information, screens viewed, feature interactions, and subscription events. When you sign in, we associate analytics with your account ID to measure activation and retention across devices. The 3.9 analytics update excludes student names, goal text, scores, and note contents from custom events. Some older versions can send goal identifiers and score values in progress events; older telemetry may remain in retained analytics.
• Push notification token:If you enable notifications, your device's FCM registration token is stored on our servers to deliver reminders and announcements. You can disable notifications at any time in iOS Settings.
• Crash and diagnostic data: Firebase Crashlytics collects crash traces, device and iOS information, and app-state and interaction diagnostics to help us find and fix problems.

3. How We Use Your Information

We do not sell your data. We do not use your data for advertising.

4. Student Data and FERPA

Student records you enter into SPED Goals (names, IEP targets, progress logs) are stored under your account. We act as a service provider / data processor for this data. We do not access, share, or analyze student records for any purpose other than operating the App on your behalf, including processing an AI report request through the provider described below. Teachers using SPED Goals are responsible for ensuring their use of the App complies with FERPA, IDEA, and any applicable district policies.

5. Data Sharing and Third Parties

We use the following service providers to operate the App:

• Google LLC (Firebase): Cloud storage, authentication, analytics, push messaging, crash diagnostics, and serverless functions. Google Privacy Policy
• Google Gemini:When you request an AI narrative report, our backend sends the student's first name, target and goal text, summarized progress, and selected note excerpts to the Gemini API to generate a draft. Goal text and notes may contain additional identifying or sensitive information you entered. Review that information before requesting a report, and review the generated draft before using or sharing it.
• RevenueCat: Subscription verification and entitlement updates for subscriptions managed through RevenueCat, including purchase identifiers, product, status, expiry, and the associated app user identifier. RevenueCat Privacy Policy
• Apple Inc.: In-app purchase processing and Sign in with Apple. Apple Privacy Policy
• Shopify Inc.: Physical store checkout and order fulfillment. Shopify Privacy Policy

We do not share your data with any other third parties except when required by law or to protect our legal rights.

6. Data Retention

• Account data: Stored while your account is active. In version 3.9, open Profile → My Account → Delete Account to verify your identity and delete the account. Server cleanup of student records, goals, progress, uploaded files and app order copies normally takes a few minutes. Older versions can use the email request below.
• Student records: You can delete individual student records in the App. Whole-account deletion also removes their associated uploads and records from our active Firebase databases and storage. Files you exported or shared outside the App remain with their recipients.
• Security and purchase records: We retain a deletion marker containing your account ID and minimal purchase-ownership and transaction identifiers to block stale credentials, prevent receipt reuse and handle billing disputes. These do not include your student records, name or email. Deleting an account does not cancel Apple subscriptions or Shopify orders.
• Analytics data: Retained according to our Google Analytics settings. Signed-in analytics can be associated with your account ID; it is not all anonymous.
• Push tokens: Used to deliver notifications to registered app installations. You can stop notifications in iOS Settings.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate personal data
• Request deletion in version 3.9 under Profile → My Account → Delete Account, or email us at the address in Section 10. Contact us for associated analytics data requests. See our Account Deletion Policy for full details including what is and is not deleted.
• Withdraw consent for push notifications at any time via iOS Settings → Notifications → SPED Goals
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at the address in Section 10.

8. Data Security

We use industry-standard safeguards: TLS encryption in transit, Firestore security rules that restrict access to authenticated account owners only, and least-privilege Cloud Function authentication using Firebase ID tokens. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via in-app announcement or email for material changes. Continued use of the App after an update constitutes acceptance.

10. Contact Us

If you have questions, concerns, or data requests, please contact: