Privacy policy

Who we are

EdGauge is run by EdGauge, LLC, [mailing address to come]. Write to us at [email protected].

This policy covers the EdGauge application at edgauge.com (the app) and our public landing page. It explains what information we collect, why, who receives it, how long we keep it and what you can ask us to do.

EdGauge is a benchmarking platform for the business offices of California K-12 school districts, county offices and joint powers authorities, used in a work capacity. It shows public, district-level financial and staffing data, lets a district contribute its own figures, and includes an assistant (Ask EdGauge) that answers questions with cited data.

What we collect and why

Accounts and sign-in

When you register we ask for your name, your work email and a password. We store the password as a hash, never as typed. You can add a position title (we also record the catalog position it maps to), a default salary study and display preferences. If you turn on two-factor authentication or add a passkey, we store the secret, recovery codes and passkey credential; the two-factor secret and recovery codes are stored encrypted.

Your account belongs to one or more organizations, each with a role (viewer, contributor, reviewer or organization admin). An invitation stores the invitee's email, the role and who sent it. A personal API token is stored as its name, a hash of the secret, its permissions and its expiry.

We use this to sign you in and to scope what you can see to your organization and tier.

Activity records

We keep an audit log of actions in the app: sign-in and sign-out, membership changes, submissions, reviews, reports, invitations, consents and similar events. Each entry records who did it, when, from which IP address and browser (user agent), and a summary of what changed, which can include a name or email that was changed. We keep it for 24 months, to investigate problems, support you and keep the record of who did what to shared data.

When your organization accepts our data sharing agreement, we record who accepted it, when, and the IP address and user agent used. When your organization lets another organization submit data on its behalf, we record who granted it and when.

Searches that returned no result are stored as the search text only, with no link to you, for 30 days.

The assistant

When you use Ask EdGauge, we store the conversation: your questions, the model's answers with their citations, the tools the model called with the arguments it wrote, a summary of each tool result, and the model name, token counts, cost and response time. You can delete a conversation, which removes its messages and tool calls; archiving one only hides it. Our staff can see conversations in the admin console. What is sent to the AI provider is described under AI providers.

Contributed data

When your organization contributes its own figures, we store the submission: the district and period, the values, any notes you add, who submitted, attested and reviewed it, the validation and AI review results, and the reviewer's comments. Your account name is recorded on the submission as the submitter's name and title. This happens automatically, not through a form field.

Evidence documents you upload are stored in private storage. Our staff can download them to review a submission. Other signed-in users who see a published value can see the contributing district's name and the evidence file's original filename, but never the file itself. We also render page images of evidence PDFs for reviewers.

If you challenge a published value, we store your organization, your user, the reason and the outcome.

Problem reports

When you file a problem report from the app, we store your message, the page you were on (secrets scrubbed from the address), the app version, and a context snapshot: your IP address, browser, viewport and environment. The report also includes the last 200 console entries, 50 network requests (method, address, status and the first part of a failed response) and 20 pages you visited. The app keeps these only in your browser's memory and sends them only when you file a report; credential-like values are scrubbed in the browser and again on our server.

A screenshot of the visible page is attached by default. You can untick it before sending. Only password and one-time-code fields, and a few fields we mark as sensitive, are masked, so anything else on screen at that moment is captured. Check the screen before you send one.

The report is emailed to our staff with your name, email, organization, message, page address and browser, and a link to the screenshot. Your draft stays in your browser's session storage until the tab closes.

Reports, saved views, subscriptions and notifications

We store the reports you define and generate (name, template, parameters, who created them, and the rendered PDF, PPTX or XLSX files), salary studies and peer groups, saved views (shared with your organization if you choose), email digest subscriptions with an unsubscribe token, in-app notifications, and any report you file about a wrongly mapped position title. Your organization downloads report files through the app with a short-lived link.

Server logs

Our web server logs each request: your IP address, the page requested with its query string, the referring page and your browser (user agent). Application and database logs record errors and slow queries, which can include values such as an email address or a question. We use these logs to run, debug and secure the service.

Email we send

We send email through Amazon Simple Email Service: password resets, email verification, invitations, a notice to your old address when you change your email, insight digests you subscribe to, the outcome of a position-mapping report, and problem reports to our staff. We keep no delivery or open tracking. Amazon's own sending logs hold recipient addresses under Amazon's retention, not ours.

The landing page interest list

If you join the interest list on our landing page, we store your name, work email, district, optional district code, optional role, optional note, the source tag from the link you used, how many times you submitted the form, and when you signed up and last updated it, in Cloudflare's D1 database. To check that you are not a bot, the form sends a Cloudflare Turnstile token with your IP address to Cloudflare; we do not store your IP address. Signing up sends no email. We use the list to contact you about EdGauge and will move it into the app when the product launches.

Public records that name people

EdGauge collects public records about organizations, not people. The public records we collect can still include public employees' names, in salary records and directory listings among others:

• Transparent California's per-agency salary exports name every employee.
• The California Department of Education's school directory names school and district administrators and gives their phone numbers.
• Public documents such as audit reports, salary schedules, board and guidance documents name officials, board members, auditors and signatories.

We do not put employee names in our database. Our payroll loader reads a fixed set of columns and never the name, and the compensation table has no column for one. The school directory loader reads codes, school and district names, status, location and website only. Public documents are stored as passages of text, as published, so an official's name can appear in a passage.

We keep the original source files, unchanged and names included, in private storage as the record of where our data came from. We do not delete them. Only our staff can reach the salary exports and directory files. Public documents we archive, such as guidance documents and salary schedules, are shown to signed-in users as published.

One more caveat. We publish positions, not people, but a title held by one person in a district, such as superintendent or chief business official, shows that person's pay. The source publisher already publishes that pay by name.

Student information

We do not collect student records, by design. The product never asks for, loads or derives a record about an individual student. Enrollment, absenteeism and unduplicated-pupil figures are stored as district and charter aggregate counts only, and no table has a column for a student. The product is not designed to receive student records and is not offered for that purpose under California's student privacy laws.

Several channels accept whatever a person types or uploads, including assistant questions, submission notes, evidence documents, review comments and challenge reasons, and problem-report messages and screenshots. Nothing scans them for student information. Do not enter student information anywhere in EdGauge. If you think you did, write to [email protected] and we will work with you to remove it from what we store.

AI providers

The assistant, the plausibility review of contributed data, the position title mapper, text embeddings and our document pipeline use models from outside providers. OpenAI is the default provider for chat, review briefs, embeddings, guidance extraction and district prose. Anthropic is an alternative provider for chat and for the document pipeline, including the extraction of findings from public audit reports. OpenRouter routes the title mapper and the plausibility review to the model behind each route it picks. Which provider runs is set by our configuration.

What is sent:

• With an assistant question: your question, up to the last 20 messages of the conversation, the results of the tools the model calls, your organization's kind and numeric id (not its name), your entitlement tier, your typed position title and the catalog position it maps to, and your own district's name and code. Not your email or IP address, and not your name except as described for contributed values below. A title with a single holder in a named district can still identify you.
• With a contributed value: for the plausibility check, the district's type and size band (not its name), the measure, the value, its history and cohort statistics, and your notes with emails and phone numbers redacted and cut to 500 characters. If a submission is flagged, the chat model writes a review brief from the full context, including the district's name, the contributor's account name and the notes unredacted. When a tool returns evidence details, the contributor's account name and the evidence file's original filename can go to the chat model too, and a filename can contain a person's name.
• Evidence document contents are never sent to any model.
• For title mapping: the employer's name and county, the job title, department, number of positions and salary range, and the employer's other titles. Never a person's name.
• For embeddings: measure definitions, public guidance passages, position names, payroll titles, and the search text the model writes from your question.
• Public documents: passages and pages of public documents, which can name officials.
• When our staff run the service: our staff use Anthropic's Claude as a tool to operate and maintain EdGauge. The results of the database queries and logs they read with it, which can include account details, problem reports and IP addresses, are sent to Anthropic.

No request the app sends to a model provider carries a user id field, your email or your IP address. The app's requests to OpenAI's Responses API are sent with store: false, asking OpenAI not to store the responses. Under their commercial API terms, OpenAI and Anthropic do not train on API data by default, and they may keep API data for a limited time to monitor for abuse. We turn off OpenRouter's prompt logging for our account; the terms of the model host behind each route OpenRouter picks apply to that host. Each provider's own terms govern what it does with what it receives. If you connect our tools to your own AI client through MCP, your client's model receives the results and is outside our control. More on how we use AI.

Cookies and browser storage

The app sets only strictly necessary and preference cookies.

The app also uses your browser's local storage for your theme, which navigation groups are open and your last five searches, and session storage for a draft problem report and the ids of report runs already announced to you. This stays on your device and is not sent to us, except a draft problem report when you file it.

There are no advertising cookies and no third-party scripts in the app. Fonts are self-hosted. The landing page sets no cookies of its own and loads only self-hosted fonts and Cloudflare's own scripts.

Analytics

The landing page uses Cloudflare Web Analytics. It uses no cookies, does not track you across sites with fingerprinting, and involves no advertising technology; we see aggregate page-view data.

The app uses no analytics today. If we add analytics to the app, it will be a cookieless tool with no advertising technology, and we will update this policy first. Analytics data is not sold or shared for cross-context behavioral advertising.

We do not sell or share personal information

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

Who we disclose information to

Service providers that process data for us (our subprocessors page keeps the current list):

• Amazon Web Services: hosting, database, file storage, email sending and logs, in the US West (Oregon) region.
• Cloudflare: the landing page, the interest list, bot checks, web analytics and DNS.
• OpenAI, Anthropic and OpenRouter (and the model behind each route OpenRouter picks, whose own terms apply): the AI uses described above.
• Microsoft 365: our own mailboxes, which receive the messages you send us, in the United States.

People in your organization. Organization admins see the names, emails and roles of their organization's members and open invitations. Members see the saved views, reports and submissions their role allows. When a contributed value is published, any signed-in reader can see the contributing district's name and the evidence file's original filename.

Legal requirements. We disclose information when the law requires it, for example in response to a valid legal request, or to protect the rights, safety or property of our users, the public or EdGauge, LLC.

Business transfers. If EdGauge, LLC is sold or merged, or its assets are transferred, your information may go to the new owner under this policy.

How long we keep information

Periods we have set today (staff can change the audit, problem-report and report-file periods; a change will update this policy):

Password reset links work for 60 minutes, invitation links for 7 days and personal API tokens for at most 365 days, but the records of them are not yet deleted on a schedule.

We have not yet set deletion periods for everything else, including accounts, conversations, contributions and evidence, agreement acceptances, notifications, open problem reports, the interest list, database logs, failed background jobs and copies of problem reports emailed to our staff. We keep that information until we set those periods, and will publish them in this policy when we do. Archived public source files are kept as described under Public records that name people.

Your choices and rights

You can edit your name, email and position title in Settings. You can unsubscribe from email digests with the link in each digest. You can clear your in-app notifications, delete your saved views and reports, and delete or archive conversations.

Write to [email protected] to ask for access to the personal information we hold about you, a correction, a copy of it, or deletion. There is no self-service export; we send a copy on request. We will respond within a reasonable time.

Settings has a Delete account option. It deletes your account with its memberships, conversations, saved views and subscriptions, but it cannot yet delete an account that has accepted an agreement, contributed, reviewed or challenged data, granted consent or saved a peer group, among other shared records. For those accounts, or to ask about anything it leaves behind, write to [email protected].

Some records are kept after an account is deleted: the record that your organization accepted the data sharing agreement, contributions you made and published values that others rely on, audit records for up to 24 months (which can include your name and email), problem reports you filed (for the periods above), personal API tokens, MCP sign-in tokens and notifications, and backups until they expire. We will tell you what we keep and why.

We will not treat you differently for exercising any of these rights.

California residents

If you are a California resident, you may have rights under California law to know what personal information we collect, to have it deleted or corrected, and to opt out of its sale or sharing.

Categories of personal information we collect:

• Identifiers: name, email, IP address.
• Sensitive personal information: your account password, stored as a hash and used only to sign you in.
• Professional or employment information: your organization, role and position title.
• Internet or network activity: the IP address and browser recorded in audit entries, web server logs (including the pages you request) and problem reports.
• The content of messages you send: assistant questions, submission notes, evidence documents, problem reports, and what you email us.
• Inferences: none.

Sources: you; your organization (an admin who invites you, or a submission that records you); and public records, for the names of officials in archived source files and public documents.

Purposes: running the service, signing you in and scoping access, publishing and reviewing contributed data, answering your questions, support, security and the audit record, sending email you asked for, and contacting people on the interest list about EdGauge.

Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising.

How to make a request: email [email protected]. We may need to verify your identity, for example by writing back to the email address on your account. An authorized agent may ask on your behalf; we may ask for proof of the authorization.

Do Not Track

Some browsers send a Do Not Track signal. The app does not respond to it differently, because it does no cross-site tracking in the first place. We do not allow third parties to track you across sites through our service. The app loads no third-party scripts; the landing page loads only Cloudflare's bot check and analytics, described above.

Security

Traffic between your browser and EdGauge is encrypted with HTTPS. Passwords are stored as hashes. You can add two-factor authentication or a passkey to your account. The admin console requires a verified email and two-factor authentication. The service is hosted in Amazon Web Services' US West (Oregon) region. No system is perfectly secure. More on our security page.

Where we operate

EdGauge is a United States service for California school districts. We store your information in the United States. Some service providers may process it elsewhere, such as Cloudflare's global network and the model hosts OpenRouter routes to. The service is not intended for use outside the United States.

Children

EdGauge is not directed at children under 13 or at anyone under 18. Accounts are for adult professionals acting for their organization. We do not knowingly collect personal information from children. If you think we have, write to [email protected] so we can remove it.

Changes to this policy

Each version of this policy is numbered and dated at the top. We will post changes here. For a material change we will notify account holders by email or in the app before it takes effect.

How to contact us

Email: [email protected]

Mail: EdGauge, LLC, [mailing address to come]