Privacy policy

1. Browsing without an account

You don't need an account to search for a school, view a supply list, print it, or follow a product link. We don't ask who you are, and we don't build advertising profiles.

When you tick items off a list, that progress is stored in your own browser's session storage. It never reaches our servers, it isn't tied to you, and closing the tab clears it.

2. Teacher accounts

If you register as a teacher, we store:

• Your name — shown publicly on your classroom list.
• Your email — used to sign in, confirm your address, and reset your password. It is never shown publicly.
• Your school, grade, room number, and class name — shown publicly so parents can find you.
• A hashed password — hashed with bcrypt, so we can't read it and can't tell you what it is.
• Sign-in timestamps — so you and we can spot unexpected access.

Anything you type into a supply list, including notes to parents, is published publicly. Don't put student names or private information there.

3. Contact form

When you message us we keep your name, email, the message, and your IP address. The IP is there to help us block spam. We use this to reply and to fix whatever you told us about. Messages are deleted once they're resolved and no longer useful.

4. Click and usage data

When someone follows a product link we record which item was clicked, which school and grade page it was on, and when. We use this to see which supplies matter and to improve the standard lists.

These records aren't linked to a person or an account. We can tell that a pencil link was clicked 40 times; we can't tell who clicked it.

5. Cookies

We keep cookie use minimal:

• Session cookie — set only when you sign in to a teacher or admin account, so the site remembers you between pages. It expires when you close your browser.
• Session storage — not strictly a cookie, this holds your checkbox progress on a supply list. It stays on your device.

We don't set advertising or cross-site tracking cookies. Amazon may set its own cookies once you follow a product link, under Amazon's policies rather than ours.

6. Amazon affiliate links

Product links are Amazon affiliate links. Following one tells Amazon you arrived from this site, which is how any commission is credited. It doesn't tell Amazon your name, and it doesn't tell us what you bought.

What happens on Amazon is governed by Amazon's privacy notice.

7. Email we send

We send transactional email only: address confirmation, password resets, security notices such as a password change, and replies to your messages. We don't run a marketing list and we don't sell or share your address.

8. How long we keep things

• Teacher accounts — until you delete them. After deletion we hold the account for 30 days so it can be restored, then remove it permanently.
• Supply lists — deleted with the account on the same 30-day schedule.
• Contact messages — until resolved and no longer useful.
• Spam-prevention records — automatically cleared after 24 hours.
• Click data — kept in aggregate; it doesn't identify anyone.

9. Your choices

If you have a teacher account you can, from your dashboard:

• Change your name, room, and class name at any time.
• Unpublish a list so it disappears from public pages immediately.
• Delete your account, which unpublishes everything and starts the 30-day removal.

You can also ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA, and we'll honor those requests regardless of where you are.

10. Children

This site is for parents, guardians, teachers, and school staff. It isn't directed at children, and we don't knowingly collect information from anyone under 13. If you believe a child has given us personal information, contact us and we'll delete it.

11. Security

Passwords are hashed with bcrypt and never stored in readable form. The site runs over HTTPS, sign-in attempts are rate-limited, and account sessions use secure, HTTP-only cookies. No system is perfectly secure, so please use a strong, unique password and tell us promptly if you think your account has been accessed by someone else.

12. Who else sees your data

We don't sell personal information. A small number of service providers necessarily handle it:

• Our web host — stores the site and its database.
• Our email provider — delivers confirmation and reset messages.
• Amazon — only when you choose to follow a product link.

We may also disclose information if the law requires it, or to investigate fraud or abuse of the site.

13. Changes and contact

If we change this policy we'll update the date at the top. Significant changes affecting teacher accounts will also be emailed to account holders.

Questions or requests about your data? Use our contact form.