Summary: We collect only the information schools need to operate the platform. Your data is hosted in Singapore, emails are sent through a provider in Japan, your data is never sold to third parties, and each school's data is completely isolated from others.
Overview
Co-Curricular HQ ("we", "us", "our") is operated by Jesse McKinnon. This Privacy Policy explains how we collect, use, store, and protect information when you use our platform at cocurricularmanager.com and related services.
We are committed to protecting the privacy of school staff and complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using Co-Curricular HQ, you agree to the collection and use of information in accordance with this policy. Schools using the platform accept this policy on behalf of their staff as part of our Terms of Service.
Data We Collect
Account and identity data
- Full name and email address
- School name and department
- Authentication credentials (passwords are stored as one-way bcrypt hashes; we never store plaintext passwords)
- Microsoft account identifier (when signing in via Microsoft 365 SSO)
Activity and participation data
- Co-curricular activities staff are registered for or coordinate
- Hour logs submitted by staff, including session dates, hours, and any notes
- Approval decisions made by coordinators and administrators
- Session notes entered by coordinators
Usage and system data
- Login timestamps and authentication events (for security audit purposes)
- IP addresses (retained in server logs for up to 30 days)
- Browser and device type (standard HTTP request data)
What we do not collect
- Student data of any kind
- Sensitive personal information (health, financial, or biometric data)
- Data from third-party advertising or tracking networks
- Payment card details (payments processed externally when applicable)
How We Use Data
We use the data we collect solely to provide and improve the Co-Curricular HQ platform for your school. Specifically:
- Platform operation — authenticating users, displaying dashboards, processing approvals, and generating reports
- Communications — sending password reset emails, email verification links, and admin invitation links
- Security — detecting and preventing unauthorised access
- Product improvement — understanding aggregate usage patterns to improve the platform (never linked to individual identities without consent)
- Support — diagnosing and resolving issues reported by schools
We do not use your data for advertising, profiling, or any purpose unrelated to delivering the platform service to your school.
Data Storage and Location
School data is stored and processed outside Australia, by the service providers below. We disclose personal information to them only so they can run the platform for your school, and we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.
- Render (Render Services, Inc.) — hosts the application and its database in Render's Singapore region. All school data (staff records, activities, hours and settings) is stored there.
- Resend (Resend, Inc.) — delivers the platform's emails (sign-in invites, password resets, notifications and weekly summaries) from its Tokyo, Japan region. For each email it receives the recipient's name and email address and the content of that email, such as an activity name or an hours decision. We delete our copy of an email's content 30 days after it is sent.
- Microsoft (Entra ID) — used only when staff sign in with their school Microsoft account. Microsoft confirms the person's identity and returns their name, email address and account identifier. No other school data is sent to Microsoft.
School Data Isolation
Each school's data is completely isolated from all other schools on the platform. This is enforced at the database level — every data record is scoped to a school identifier, and all queries are filtered by that identifier.
Staff from School A cannot access any data from School B under any circumstances. Administrators from one school cannot view or modify data belonging to another school.
Data Sharing and Disclosure
We do not sell, rent, or trade your personal data to any third party.
We may disclose data in the following limited circumstances:
- With your school's authorisation — school administrators have full access to all data within their school's account and may export or share it as they see fit
- Legal obligations — where required by Australian law, a court order, or a lawful government request
- Safety — where disclosure is necessary to prevent serious harm
- Business transfer — if Co-Curricular HQ is acquired or merged, your data may be transferred as part of that transaction, with notice provided to your school
Your Rights
Under the Australian Privacy Act 1988, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request correction of inaccurate or incomplete personal information
- Complaints — make a complaint if you believe we have mishandled your personal information
- Data export — school administrators may export all school data at any time through the platform's reporting features
To exercise these rights, contact us at jessemckinnon20@gmail.com. We will respond within 30 days.
If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Data Retention
We retain data for as long as your school's account is active. If your school's account is terminated:
- All school data will be made available for export for 30 days after termination
- After 30 days, all personal data associated with the school will be permanently deleted from our systems
- Server logs (containing IP addresses) are retained for 30 days then automatically purged
- Anonymised aggregate statistics may be retained indefinitely
Security Measures
We implement industry-standard security controls including:
- All data transmitted over HTTPS/TLS encryption
- Passwords stored as bcrypt hashes (cost factor 12) — never in recoverable form
- Password reset tokens stored as SHA-256 hashes — raw tokens are transmitted only once via email
- JWT-based authentication with short-lived tokens
- Role-based access control enforced at the API layer
- Security controls designed in alignment with ISO 27001 principles
For privacy enquiries, requests to access or correct your data, or to make a complaint:
This Privacy Policy may be updated from time to time. Material changes will be communicated to school administrators via email. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.