Privacy Policy

1. Introduction

PE 360 ("we," "us," or "our") is a physical education management platform designed to help schools and districts manage classes, lessons, grading, and student progress. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

By accessing or using PE 360, you agree to this Privacy Policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 User Account Information

• Name (first and last), email address, phone number
• Profile photo and avatar
• Account credentials (stored securely; never in plaintext)
• Role and organizational affiliation

2.2 Student Data

• Student name, date of birth, gender, grade level
• Student ID
• Medical information and emergency contacts (provided by authorized school personnel)
• Enrollment dates, attendance records, grades, and assessment scores

2.3 Organization Data

• School and district names, addresses, and contact information
• Logos and branding assets

2.4 Technical & Usage Data

• IP address, device information, and device identifiers
• Session and login activity
• Audit logs of platform actions
• Email delivery and engagement data (e.g., delivery status)

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the PE 360 platform
• Manage user accounts, authentication, and role-based access control
• Facilitate lesson planning, attendance tracking, grading, and reporting
• Send transactional emails (invitations, password resets, notifications)
• Monitor platform security, detect abuse, and enforce rate limits
• Maintain audit trails for compliance and accountability purposes
• Improve and develop new features for the platform

4. Data Sharing & Third Parties

We do not sell your personal information. We share data only with the following categories of service providers, as necessary to operate the platform:

• Email delivery — Resend (transactional emails such as invitations and password resets)
• Security infrastructure — Upstash (session management and security enforcement)
• Hosting & infrastructure — Vercel (application hosting and image storage)

Each service provider processes data only as necessary to perform their services and is subject to their respective privacy policies. We work to establish appropriate data processing agreements with all service providers who handle user data.

We may also disclose information if required by law, subpoena, or other legal process, or to protect the rights, safety, or property of PE 360, our users, or the public.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When accounts are deactivated, records are retained for a reasonable period to fulfill legal, contractual, or compliance obligations before being permanently removed. You may request permanent deletion of your data by contacting us (see Section 11).

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data, subject to legal retention requirements
• Portability — Request your data in a structured, machine-readable format
• Objection — Object to certain processing activities

To exercise any of these rights, please contact us at privacy@pe360.co. We will respond within 30 days.

7. Children's Privacy (FERPA & COPPA)

PE 360 processes student education records on behalf of schools and districts. Under agreements with our partner institutions, we are designated as a "school official" with a "legitimate educational interest" as defined under the Family Educational Rights and Privacy Act (FERPA). Student data is used solely for the educational purposes specified by the contracting school or district.

For students under 13, we rely on the school's consent under the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13 without appropriate school or parental consent.

Schools and districts may request review, correction, or deletion of student records at any time by contacting us.

8. Security Measures

We implement industry-standard security measures to protect your data, including:

• Passwords are securely hashed using industry-standard algorithms (never stored in plaintext)
• Multi-factor authentication (MFA) support for enhanced account security
• Role-based access control ensuring users only access authorized data
• Rate limiting to prevent abuse and unauthorized access attempts
• Encrypted data transmission via HTTPS/TLS for all communications
• Industry-standard protections against common web application vulnerabilities
• Comprehensive audit logging of sensitive operations
• Session management with automatic token expiration and rotation

9. Cookies & Session Management

PE 360 uses secure, short-lived session tokens for authentication. These tokens are automatically refreshed during active use. We do not use advertising or tracking cookies. Technical session data (IP address, device information, and device identifiers) is stored for security purposes including fraud detection and session management.

We may track email delivery status (e.g., whether a transactional email was delivered) to ensure reliable communication. This data is used solely for service reliability and is not shared with third parties for marketing purposes.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or email. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of PE 360 after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: privacy@pe360.co
• Support: support@pe360.co