Legal

Privacy Policy

Effective Date: July 21, 2026

Phone Tree is a school volunteer communication platform that helps coordinators and room parents organize and send class communications to families. We take privacy seriously — especially because the information we handle often involves schools and families.

This Privacy Policy explains what information we collect, how we use it, and your rights. Questions? Email us at privacy@phonetree.fyi.

1. Information We Collect

Information you give us directly

• Waitlist sign-ups: your first name and email address.
• Account registration: your name, email address, and school or organization name.
• Google Sign-In: your name, email address, and profile photo from Google.

Information coordinators provide on behalf of their school

• Family contact lists (names and email addresses) imported to send class communications.
• Room parent assignments and classroom information.

Information we collect automatically

• Basic usage data: which features you use and when.
• Device and browser type, for debugging and compatibility.

We do not use tracking pixels, behavioral ad targeting, or third-party analytics that build profiles of our users.

2. How We Use Your Information

• Create and manage your account.
• Send class communications on behalf of coordinators and room parents.
• Deliver waitlist confirmation emails and product updates.
• Improve and debug the product.
• Respond to support requests.

We do not sell your information. We do not use it for advertising. We do not share it with third parties for their own marketing purposes.

3. Information We Share with Third Parties

We share information only with vendors who help us run Phone Tree:

• Supabase — database provider, stores account and communication data.
• Resend — email delivery service, transmits messages to family inboxes.
• Vercel — hosting provider, serves the Phone Tree application.
• Google — authentication via Google Sign-In.

Each vendor is contractually required to protect your data and may not use it for their own purposes. We do not share your information with anyone else unless required by law.

4. Google User Data

Phone Tree uses Google Sign-In (OAuth 2.0) to allow users to create and access their accounts. The following explains exactly how we handle data received from Google.

What Google data we access

When you sign in with Google, we request the following OAuth scopes:

• openid — confirms your identity with Google.
• email — your Google account email address.
• profile — your display name and profile photo URL.

We do not request access to your Gmail, Google Drive, Google Calendar API, Google Contacts, or any other Google Workspace data. The only Google data we receive is your name, email address, and profile photo, provided at sign-in.

How we use Google user data

We use the data received from Google exclusively to:

• Create and authenticate your Phone Tree account.
• Display your name and photo within the Phone Tree interface.
• Associate your account with your school or organization.

We do not use Google user data for advertising, analytics, profiling, or any purpose beyond operating your Phone Tree account. We do not use Google user data to train AI or machine learning models.

With whom we share Google user data

Google user data (name, email, profile photo) is stored securely in our database and shared only with the following infrastructure providers who help us operate Phone Tree:

• Supabase — stores your account record, including name and email.
• Vercel — hosts the Phone Tree application and processes authentication requests.

These vendors are bound by data processing agreements and may not use your data for their own purposes. We do not sell, rent, trade, or otherwise disclose your Google user data to any other third parties, advertisers, or data brokers.

How we protect Google user data

• All data is transmitted over HTTPS/TLS — never over unencrypted connections.
• Your Google data is stored in Supabase with encryption at rest.
• Access to account data is restricted to authenticated users and protected by Row-Level Security policies in our database — no user can access another user's data.
• We do not log raw OAuth tokens or store your Google password or refresh tokens beyond what is necessary to maintain your session.
• Access to our production database and infrastructure is restricted to authorized team members and protected by role-based access controls.

Retention and deletion of Google user data

Your Google-derived account data (name, email, profile photo) is retained for as long as your Phone Tree account is active. If you delete your account:

• Your name, email, and profile photo are deleted from our database within 30 days.
• Any communications sent under your account may be retained in anonymized form for the school's records, but will no longer be associated with your personal information.

To request deletion of your account and all associated Google user data, email privacy@phonetree.fyi. We will confirm deletion within 30 days.

Phone Tree's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. School and Family Data

When a coordinator uploads a family contact list, that information is:

• Used only to send communications through Phone Tree.
• Never shared with other schools, organizations, or third parties beyond the vendors listed above.
• Not used for advertising or profiling.

Phone Tree acts as a data processor on behalf of the school or organization. The coordinator retains responsibility for ensuring they have appropriate authorization to share family contact information with Phone Tree.

If you are a family member who received communications through Phone Tree and want your email removed, contact the room parent or coordinator at your school directly, or email us at privacy@phonetree.fyi.

6. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where required by law.

Family contact lists are retained for the duration of the school year or until removed by the coordinator, whichever comes first.

7. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to restrict how we use it. To exercise any of these rights, email privacy@phonetree.fyi. We will respond within 30 days.

8. Children's Privacy

Phone Tree is intended for adults — coordinators, room parents, and administrators. We do not knowingly collect personal information from children under 13. If you believe we have done so inadvertently, contact us at privacy@phonetree.fyi and we will delete it promptly.

9. Security

We use encrypted data storage, HTTPS for all data in transit, and access controls to protect your information. No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Changes to This Policy

We may update this policy from time to time. We will update the effective date and notify users of material changes by email or prominent notice on the site.

11. Contact Us

Email: privacy@phonetree.fyi
Website: phonetree.fyi

We are a small team and take privacy questions seriously. We will respond within 3 business days.