Privacy policy

• Name, grade level, and academic year.
• Region and the mentor and coordinator the student is assigned to.
• Behavioral ratings recorded by the student's mentor across multiple dimensions.
• Attendance records for events the student is invited to.
• Book completion logs and Quran or Khatm assignments.
• Weekly logs (Çetele) and daily prayer logs.
• Points, streaks, and leaderboard standings earned from these logs.
• Tasks assigned to or by the student, with completion status.
• Notes recorded by mentors and coordinators about the student's progress.
• An anonymized internal ID (for example, student-abc12345) so we can refer to students in logs without exposing their names.

Mentors, coordinators, regional managers, super admins, students, and parents each have a platform account. For each account we collect:

• Username, password (stored as a salted hash; we never see the plaintext), and the region you belong to.
• Audit log entries for sensitive administrative actions you perform.
• Notifications routed to you, and your notification and language preferences.
• If you turn on push notifications, a push address for each device you enable them on.
• Feedback you submit through the Send Feedback form in Settings, and our replies.

• Real-time location or GPS data.
• Microphone, camera, or screen-recording access.
• Cross-site browsing history outside of Steward LMS.
• Marketing tracking pixels or third-party advertising identifiers.
• Information about race, health, political opinion, sexual orientation, or other sensitive categories beyond what is inherent to a student's enrollment in a religious-academic program.

Access is enforced both in the application code and in the database itself (row-level security). Your visibility depends on your role:

• Mentors see their own students plus students they co-mentor. In the Social Graph view they can also see peer-student names and relationship structures at the region level, but not those students' profiles or records.
• Coordinators see every student in their team (every student of every mentor reporting to them).
• Regional managers see every student in their region.
• Super admins see all students across all regions. Their administrative powers are limited to the regional-manager layer; coordinators and mentors remain under their regional manager's authority.
• Students see their own records. Parents see the records of the children linked to their account.
• Leaderboards shared with students and parents show participants' names and standings to the others on the same board. Staff can choose to blur names.

Staff can use Login As to see the app exactly as someone they manage sees it, to help with support questions.

We never sell data, share it with advertisers, or send it to data brokers.

• All data is encrypted in transit (HTTPS/TLS) between your device, our app, and the database.
• The database and file storage are encrypted at rest (AES-256) on Supabase's AWS infrastructure.
• Supabase is SOC 2 Type II audited, and AWS holds ISO 27001 and SOC 2 certifications.
• Passwords are stored only as salted hashes, and the sign-in page is protected by a CAPTCHA and by lockouts after repeated failed attempts.
• Every request is checked against your role by the database itself (row-level security), so the app cannot show you records you are not allowed to see.

Steward LMS records data about minors as part of normal mentoring activity. We comply with the principles of the Family Educational Rights and Privacy Act (FERPA) regarding educational records and the Children's Online Privacy Protection Act (COPPA) for users under 13.

If you are a parent or legal guardian and want to review, correct, or request deletion of your child's records, contact your child's mentor or coordinator. They can use the Send Feedback option in Settings to escalate your request. We will act on it within 30 days.

The platform runs on the following infrastructure providers:

• Supabase hosts the database, authentication, and file storage. They process the data we collect on our behalf, under their data-processing agreement. They do not use our data for their own purposes. Supabase runs on Amazon Web Services (AWS) data centers, which are protected physically and audited independently.
• Vercel hosts the web application. They receive request URLs and the user's IP address as part of normal traffic, and store access logs for short periods to protect against abuse.
• Sentry receives error reports when the application crashes. We strip student names and IDs from error messages before they reach Sentry, but the scrub is not perfect; assume Sentry may occasionally see internal identifiers.
• Cloudflare Turnstile runs the CAPTCHA on the sign-in page to block automated sign-in attempts. It sees your IP address and basic browser signals while it checks.
• Your browser's push service (Apple, Google, or Mozilla, depending on your device) delivers push notifications if you turn them on. It carries each notification's short title and text.

We do not use Google Analytics, Facebook Pixel, advertising trackers, or third-party social-login providers.

We use cookies to keep you signed in (Supabase auth session) and to remember your language preference. The sign-in CAPTCHA may set its own cookie. We do not use marketing or analytics cookies.

We use the browser's local storage to remember the last region code you entered on the login page, your display choices (such as theme and calendar view), and a copy of the data you recently viewed so the app opens quickly. That copy is cleared when you sign out.

We keep records as long as your account or your student record exists in the system. Archived students remain in our records until a coordinator or above explicitly deletes them. We do not auto-purge on a schedule because educational records often need to be referenced years later.

When an archived student is deleted, their behavioral ratings, attendance records, notes, and tasks are removed immediately. Audit-log entries about the deletion itself are retained for forensic purposes.

To have a student record fully removed, ask your coordinator or regional manager to delete the archived account.

To reach us about anything in this policy, use the Send Feedback option in Settings, or ask your coordinator or regional manager to forward your request through the same channel. We aim to respond within 7 days.