Effective September 3, 2026. Last updated October 20, 2026.
The short version
You can read every notification and the whole calendar without giving us anything. Signing in is optional, and we ask for the least we can get away with. This policy covers both this website and the NSE PTO app, which share one account and one database.
Who runs this
Built and operated by Threefold Studio, LLC. Run by the NSE PTO. The PTO decides what gets posted; Threefold Studio keeps the system running. Neither one sells or rents your information.
What we store when you sign in
With Apple or Google: your name, email address, and profile photo, exactly as they hand them to us. With email: your email address and, if you set one, a password, which is stored only as a hash. Signing in by email sends a one time code to that address. In every case we also keep, optionally, a phone number if you add one, which grades you follow, which notifications you have opened, volunteer shifts you sign up for, anything you send through the suggestion box and the replies in that thread, and your choices for the weekly digest, event reminders, and the phone calendar.
Your PTO card, check-ins, and badges
Signing in gives you a PTO card with a QR code. The code holds a random card number, not your name or contact details. When a PTO officer or check-in helper scans it at an event, we record the event, the time, and who scanned it. Badges you earn for attending or volunteering are stored with your account and shown only to you. If you add the card to Apple Wallet, our server builds the pass with your name and the QR code and it lives in your Wallet; Apple does not receive it from us. If you add it to Google Wallet, the same name and QR code are sent to Google to create the pass, under Google’s own privacy policy.
Raffles
To enter a raffle you give your name, a phone number or email address so the PTO can reach you if you win, and a confirmation that you are 18 or older. The PTO records the tickets you buy and the amount paid. Payment happens in person at the PTO table; the app and website never take card details. Officers and PTO members can see the entry list and the winners list, which show name, phone, and email. Nobody else can.
What we store when you bid
Your name, email address, and phone number if you provide one. Everyone else sees only your bidder number and your bid amount. Never your name or contact details. The PTO can see who a bidder number belongs to; nobody else can, and that restriction is enforced by the database, not just hidden in the page.
Volunteering
When you sign up for a shift, officers and PTO members can see your name, email address, and phone number so they can coordinate the event. Other parents see only how many spots are filled. If an officer removes you from a shift, you get a push notification saying so.
The app launch list
If you leave your email address on the app page to hear when the app is out, that address goes to the PTO’s contact list in Brevo and is used only for that notice and PTO email. It is separate from your account, and every email from it has an unsubscribe link.
Push notifications
If you allow notifications in the app, your phone gets a push token from Apple or Google and the app stores that token with your account so we can reach that phone. The app also keeps a random id for the install so a reinstall replaces its old token instead of adding a second one. Tokens are removed when you sign out, delete your account, or turn notifications off. The Sunday weekly digest and category reminders are off until you turn them on in Settings. A reminder the evening before a volunteer shift you booked is on by default and can be turned off in Settings. Pushes are sent through Google Firebase Cloud Messaging.
Your phone’s calendar
On iPhone, tapping Subscribe asks for calendar access and adds the school’s events to a separate calendar named NSE PTO on your phone, then keeps it up to date. The app writes only to that calendar. It does not read your other calendars and nothing from your phone’s calendar is sent anywhere. On Android, Subscribe opens the calendar feed in Google Calendar instead and no permission is involved. Your personal feed link contains a private token; if it gets shared, you can issue a new one from Settings in the app.
Camera and photos
The app asks for the camera only when a PTO officer or check-in helper scans a PTO card, and for the camera or photo library only when an officer attaches a flyer or picture to an event. Those pictures are uploaded to our storage and are visible to everyone who sees the event. Parents are never asked for either permission, and nothing from your camera or photos is read in the background.
Crash reports
Release builds of the app send a report to Google Firebase Crashlytics when the app crashes: the crash itself, your phone model, operating system version, and app version. No name, email, account id, or anything you typed is attached. This is the only usage data the app sends, and it is off in test builds.
What we do not do
We do not sell or rent your information. We do not run advertising or analytics trackers. We do not share your details with other parents beyond what the sections above say. We do not use your data to train anything.
Text messages
Text alerts are off unless you switch them on yourself. In the app, add your mobile number in Settings and turn on text alerts. We never buy, rent or upload numbers from anywhere else. We do not sell or share mobile numbers or text message consent with anyone, for any purpose. Texts are urgent only: closures, early dismissals and safety alerts. Expect a handful a year, not a handful a week. Message and data rates may apply. Reply STOP to any message to stop them, or HELP for help, and you can switch them off again in the same Settings screen at any time. Messages are delivered through Twilio.
Services we rely on
Your account and everything above live in a database and file storage hosted by Supabase, which also handles sign in, including sending the email codes. Apple (Sign in with Apple) and Google (Google Sign-In) pass us only what you see on their consent screens. Push notifications and crash reports go through Google Firebase. Text messages go through Twilio. Google Wallet passes go through Google. The app launch list is held in Brevo. This website is hosted on Netlify. Each of these providers processes data on our behalf under its own privacy policy, and none of them is allowed to use it for anything else.
Problem reports
Report a problem in the app opens a pre-filled email to Threefold Studio with the app version and your phone model and operating system version, and nothing else. You see the whole message before it goes, and it is sent from your own mail app, so it includes your email address only because that is how email works.
Children
This site and the app are for parents and guardians. We do not knowingly collect information from children, we do not ask for a student’s name anywhere, and raffle entry requires confirming you are 18 or older.
Deleting your account
You can do it yourself, in either place. In the app, open Settings and choose Delete account. On this site, sign in and use the Delete account option on your account page. Either one removes your profile, your grade and notification preferences, your read history, your push tokens, your phone number, your PTO card, your check-ins, your badges, and your volunteer sign-ups. If you cannot sign in, email hello@nsepto.com and we will do it for you. Bid records and raffle entries tied to a completed auction or raffle are kept for the PTO’s financial records, with the bid record’s name and contact details blanked and the raffle entry detached from your account. Suggestions you have sent stay with the PTO with your name detached. A pass you added to Apple Wallet or Google Wallet stays on your phone until you remove it there. Everything else is kept only as long as your account exists.
Changes to this page
If this page changes, the dates at the top change with it. Anything new that handles your information will be described here before it ships.
Questions go to hello@nsepto.com. This page describes how the site and app work; it is not legal advice.