Privacy Policy

Last updated: July 18, 2026

SafePouchPass ("the Service") is a hall pass management application for K-12 schools, operated by Win Elements LLC ("WinElements," "we," "us"). This policy explains what information the Service handles, why, and the choices schools have. We wrote it to be readable — if anything is unclear, contact us at hello@winelements.com.

The short version

Schools own their data. We process it only to provide the Service to that school.
We do not sell data. We do not show ads. We do not use student information for marketing.
Students do not have accounts and never log in. Only school staff use the Service.
Data is encrypted in transit and at rest, isolated per school, and deleted when a school leaves.

Information we collect

Provided by schools

Staff account information: name, school email address, role (teacher or administrator), and a password chosen by the staff member (stored only as a secure cryptographic hash — we cannot see passwords). If a school enables Google Sign-In, we store the Google account identifier used to link the account.
Student roster information: student name, grade level, and an optional school-assigned student number. We do not collect student contact details, addresses, birthdates, photographs, health information, or academic records.
Hall pass records: which student left, destination, time out, time returned, the staff member who issued the pass, and optional brief notes written by staff.

Collected automatically

Session cookies: a login cookie that keeps staff signed in, and a security (CSRF) cookie that protects forms. These are strictly necessary for the Service to function. We use no advertising or cross-site tracking cookies and no third-party analytics on the Service.
Security logs: sign-in attempts, administrative actions, and IP addresses, kept in an audit log so schools can review who did what.

How we use information

Solely to operate the Service for the school: authenticating staff, recording and displaying hall passes, sending account emails (invitations and password resets), enforcing security, and producing the reports and exports schools request. We do not use school or student data to train artificial intelligence models, build advertising profiles, or for any purpose unrelated to the Service.

Student privacy (FERPA and COPPA)

Student information in the Service is provided by the school and remains under the school's control. To the extent hall pass records constitute education records under the Family Educational Rights and Privacy Act (FERPA), we act as a "school official" with a legitimate educational interest, processing records only under the school's direction and never re-disclosing them except as the school instructs or the law requires. Because students never use the Service directly and we collect no information from children, the Children's Online Privacy Protection Act (COPPA) consent requirements for operators collecting information from children do not apply; regardless, we hold all student data to the standards described in this policy. Schools may direct questions, corrections, or parent requests regarding student records to their school administrator, who can view, correct, or delete records directly in the Service.

Who can see what

Staff at a school can see that school's data only. Each school's data is isolated from every other school's.
WinElements personnel access school data only when necessary to provide support, investigate a security issue, or comply with law.
We never sell, rent, or share data with advertisers or data brokers.

Service providers (subprocessors)

The Service runs on Amazon Web Services in the United States (application hosting and managed database, US West region) and uses Amazon Simple Email Service to deliver account emails. These providers process data on our behalf under their own security and privacy commitments; they do not use it for their own purposes.

Security

All traffic is encrypted with HTTPS/TLS, including between the application and its database. Data is encrypted at rest. Passwords are hashed with bcrypt. Access is protected by rate limiting, account lockout, and per-school isolation enforced on every database query. Administrative actions are recorded in an audit log. The database is not reachable from the public internet. Backups are automatic, with point-in-time recovery.

Data retention and deletion

Data is retained while a school uses the Service. Schools can deactivate or delete students, staff, and records at any time through the administrative interface, and can export their records (CSV) at any time. When a school ends its use of the Service, we delete the school's data from the production system upon request or within 90 days, after which it ages out of backups on the backup retention schedule (currently 7 days).

Changes to this policy

If we make material changes, we will notify school administrators by email and update the date above. Continued use of the Service after changes take effect constitutes acceptance.

Contact

Win Elements LLC — hello@winelements.com — winelements.com

If you are unable to contact us, you may contact our Registered Agent:
California Registered Agent Inc
1401 21st ST STE R, Sacramento, CA 95811
Tel: (530) 232-5985
californiaregisteredagents.net · agent@californiaregisteredagents.net