Privacy & Data Safety

Effective date: May 6, 2026 • Last updated: October 19, 2026

We do not sell personal information or use school data for targeted advertising. We process information to provide the services your school enables, including through service providers described below.

Who We Are

BlueBird Alerts ("we," "us," or "our") provides an emergency alert platform for schools and organizations. Our service is operated by BlueBird Alerts LLC. For privacy inquiries, contact us at [email protected].

What Data We Collect

We collect the information needed to run the features a school uses:

Account information: name, email address, and role (e.g., teacher, administrator) provided during account setup by your school administrator.
Device tokens: push notification tokens issued by Apple (APNs) or Google (FCM) to your device, used solely to deliver emergency alerts.
Location data: only when you voluntarily activate the "Share Location" feature during an active emergency. Location is never collected passively or in the background.
School records and content: rosters, class assignments, parent/emergency contacts, accountability checks, messages, and signage media supplied by authorized school users or connected systems.
Billing records: purchaser contact information, subscription and invoice references, and payment status. Payment providers handle card entry; this is separate from the billing records used to manage school access.
Usage data: basic in-app activity (e.g., alert acknowledgements, hall pass activity) used to operate and improve service reliability for your school.

How We Use Your Data

To send emergency alerts and notifications to your device
To display real-time emergency status to authorized users within your organization
To support hall pass and student accountability features
To troubleshoot technical issues and ensure service availability

We do not use your data for advertising, analytics sold to third parties, or any purpose outside of operating BlueBird Alerts for your school.

School-managed device monitoring

Some schools separately enable managed-device monitoring. This is not part of the standard Alerts trial. It is deployed by school IT administrators to school-managed Chromebooks and devices. It is never installed on personal devices without explicit administrator action.

Monitoring data

When installed on a school-managed device, the Guardian extension may collect the following on behalf of the school:

URLs and domains visited: web addresses accessed in the Chrome browser, recorded to support internet safety policy enforcement and review by school administrators.
Google Workspace account email: the signed-in Google account email address, used to associate browsing activity with a student or staff account within the school's organization.
Device identifiers: a randomly generated installation ID and device hostname, used to identify the device in the school's management console.
Policy match metadata: when a browsing event matches a school-configured safety keyword or content policy, the keyword tier (e.g., "critical" or "standard") and the matched domain are recorded. Recorded URLs and keyword metadata can contain personal information.
DLP event metadata: if the school enables Data Loss Prevention rules, metadata about a rule match (rule name, site URL, element type, action taken) is recorded. The content that triggered the match is never stored.
File upload details: on every enrolled device, Guardian records when a web page sends a file to a different website than the one the student is on. It records the destination address, up to 10 file names, the number of files, their total size and the signed-in account email. It does not read file contents. Uploads to core Google Workspace services and to the school's own Google Workspace domain are not recorded. There is currently no separate setting to turn this off; it stops only if the Guardian extension is removed from the device. These records follow the school's retention window.
Screen captures: for schools with Guardian, signed-in school staff with Guardian console access (including teacher and staff accounts) can request a screenshot of the tab a student is viewing. They can also start a class monitoring session that takes screenshots automatically until they end it. There is currently no separate setting to turn this off. Screenshots skip Google, Microsoft and Apple sign-in pages and any sites the school excludes, and otherwise show whatever is visible in that tab. They are encrypted at rest and deleted by a daily cleanup once they are 24 hours old.
Extension heartbeat data: version number, last active timestamp, and policy version, used to confirm the device is receiving updated policies.

Monitoring purposes

School access is restricted by role and school scope; authorized support processing is described below.
Data is used solely to enforce the school's internet safety policies, flag potential student safety concerns, and generate activity reports for school administrators.
Monitoring data is not sold or used for advertising. Access is limited to authorized school users and service/support processing needed to operate the feature.
Activity data is deleted automatically once it is older than the school's configured retention period (default 90 days); screenshots are deleted after 24 hours. Deletion after a school's account ends follows the Data Retention section below.

Service providers and sharing

Depending on the features enabled, hosting and network providers process service traffic and stored data; push providers process device tokens and notification payloads; SMS and email providers process recipient details and message content; error monitoring processes diagnostic information; and billing providers process purchaser and transaction details. Cloudflare, Apple APNs, Google FCM and Sentry support these functions. Messaging and billing providers depend on the school's configured services. Contact support for the applicable provider list, or see the Trust Center.

Some optional features send text to an AI provider (Anthropic): signage announcement drafts an administrator types, text from a public web page imported into Legacy Wall, and incident summaries. In our current setup, Guardian's optional AI features for student browsing data run on a model BlueBird hosts rather than a third-party AI service.

Authorized school users can publish signage content to displays and share reports or notifications. Schools should select content appropriate for the intended audience. We do not sell personal information or share it for third-party targeted advertising.

Data Retention

We keep your account data while your school's subscription is active. Our policy is to delete personal data within 30 days after the account ends and to delete emergency incident records after one year. Deletion after an account ends is currently a reviewed manual process, and automatic one-year incident deletion is still being built. Some records, such as audit and billing records, are kept longer where needed.

Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting your school administrator or emailing us at [email protected]. We will respond within 30 days.

Security

All data is transmitted over encrypted HTTPS connections (TLS 1.2+), routed through Cloudflare's global network for DDoS and WAF protection before reaching our servers. We use industry-standard security practices including salted PBKDF2 password hashing, session token authentication, and optional passkey sign-in.

Safeguards

BlueBird uses school-scoped access controls, administrator authentication, encrypted HTTPS connections, activity logging and backup mechanisms. These controls reduce risk; no system can guarantee that a security incident will never occur.

Privacy requests and school direction

BlueBird is a US-based school service. Contact your school administrator or BlueBird support about access, correction, deletion, or the agreements applicable to your school:

Data collected: we collect what the features a school uses need. Guardian, if a school enables it, records the browsing, upload, screenshot and per-student baseline data described above; these are separate from emergency alert delivery.
Purpose limitation: data collected for emergency alert delivery is not repurposed for any other use.
Right of access: you may request a copy of all personal data we hold about you at any time.
Right to rectification: incorrect personal data will be corrected promptly upon request.
Right to erasure: you may request deletion of your personal data; we act on verified requests, subject to records your school must keep. Our retention policy and its current status are described under Data Retention above.
Data breach notification: in the event of a breach affecting personal data, we will notify affected schools without undue delay and within any timeframe your agreement or state law requires.
Automated tools: Guardian uses automated rules, plus optional AI features a school can turn on, to flag and rate possible safety concerns, to alert the contacts a school chooses, and to block sites under the school's filtering settings. School staff review flags and decide what to do about a student; BlueBird does not decide discipline or other consequences for a student.

School and student information

The standard Alerts platform is operated by school staff and administrators. Schools supply student records directly or through connected systems. Separately enabled managed-device features collect the monitoring information described above. Schools direct the use of school records and should communicate their enabled services and monitoring practices to their community.

Contact your school administrator about a student's records, or contact BlueBird support for assistance routing a request. We verify authority before disclosing records or acting on a deletion request.

Changes to This Policy

We may update this policy from time to time. We will post the updated policy at this URL and update the effective date. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy? Email us at [email protected].