Tagalong is a mobile app that helps schools run field trips — building a student roster,
assigning students to chaperones, taking photo-based headcounts, raising a missing-child
alert, messaging the group, and signing off that everyone returned safely. This policy
explains what information Tagalong handles, why, and how it is protected.
Our role. Tagalong acts as a service provider (data processor) to the
school. The school is the owner and controller of student data and authorizes Tagalong to
process it on the school's behalf under a data-privacy agreement. We do not collect children's
information for our own purposes, and we do not seek consent from parents directly — the school
is responsible for the legal basis for processing, including any notice or consent required
under COPPA, FERPA, or state law.
Information we handle
Adult account information
Name and email address of teachers and chaperones who use the app.
A device push-notification token, used only to deliver trip alerts and messages.
Student information (entered by school staff)
First and last name, and an optional photo used for headcounts.
Safety details a trip may require: allergies, medications, accommodations, and notes.
An emergency contact name and phone number.
A "do not photograph" flag.
What we do not collect
No advertising identifiers and no third-party advertising or analytics SDKs that touch child data.
No real-time GPS or location tracking of children.
No integration with Student Information Systems or third-party rostering services.
No payment information.
How we use information
To provide the trip workflow: roster, grouping, headcounts, missing-child alerts, in-app messaging, and trip sign-off.
To deliver push notifications for alerts and messages to the adults on a trip.
To synchronize trip data across the authorized adults' devices.
We do not sell personal information, and we do not use student data for advertising or to build profiles.
How information is shared
Information is accessible only to the authorized adults on a given trip, enforced by database access controls. We use a small number of service providers to operate the app:
Supabase — database, authentication, and encrypted storage, hosted in the United States.
Expo and Apple / Google push services — to deliver push notifications to devices.
These providers process data only to provide their service to us and are not permitted to use it for their own purposes.
Data minimization, retention, and deletion
We collect only the fields a trip needs, scoped to a single trip.
The on-device copy of student information is removed when a trip is completed.
As a backstop, a trip's student information is automatically purged from our servers 30 days after the trip's end date.
Adult account information is retained while the account is active and deleted on request.
How information is protected
Encrypted in transit (TLS) and at rest, including on the device (iOS Keychain / encrypted local database).
Access is enforced at the database with row-level security, scoped to each adult's assigned trips and groups.
The app blocks or obscures sensitive screens from screenshots, screen recording, and the app-switcher where the platform allows.
Where data is stored
Tagalong stores data in the United States.
Your choices and requests
Because the school controls student data, requests to access, correct, or delete a student's
information should be directed to the school, which we will support. Adults may request deletion
of their own account and associated personal information by contacting us at the address below.
Children's privacy
Tagalong is intended for use by school staff, not by children. Any student information in the app
is entered and controlled by the school under its authorization, consistent with COPPA's
school-authorization provisions and FERPA's school-official exception. Tagalong does not knowingly
allow children to create accounts or provide information directly.
Changes to this policy
We may update this policy as the app evolves. Material changes will be reflected by the "Last updated" date above.