Privacy policy

Accounts come by invitation. Your school or district sends most invitations. A league commissioner can invite a school’s athletic director and coaches. We invite a district’s first administrators and staff when we set it up, and our support staff can invite staff and league commissioners after that.

There is no public sign-up, and a public link can’t create a student, parent or staff account. It can create a few limited records, all described below: a guest coach record, the entries a visiting coach sends in, a swimmer’s request to enter events, and a volunteer sign-up. Most of what we hold comes from the school, not from you.

Name and preferred name, birth date, gender, the email address the school’s roster lists for them, student ID, USA Swimming ID, grade and graduation year, teams and seasons, and team details like level, jersey number, position and captain status. The email is usually a school address, but it can be a personal or family one.

If an athlete attends a different school than the one they swim for, we keep that school’s name too. A profile photo is optional. Our servers can store pronouns, but no screen asks for them today. The birth date comes from the school’s roster. It’s how we check that a new student account is at least 13.

We don’t keep current students’ phone numbers on their accounts or rosters. If one arrives in a roster file or an invitation, we drop it. We started this in September 2026. A current student’s number saved before then is cleared when they join a team, and we cleared the rest in October 2026. A number saved earlier for someone who is no longer a current student isn’t cleared.

Nothing in Hajos calls or texts a student account, and no screen made for students asks for a phone number. Anyone holding a coach’s entry link can add one when signing up for meet updates, and once text reminders are switched on, the meet volunteer sign-up below will ask for one too.

Name, email, phone number, a profile photo if you add one in the phone app, and the roles, teams and seasons you hold. Our servers can store a preferred language and pronouns, but no screen asks for them today. If a roster file lists a birth date on a parent’s row, we keep that too.

Your app settings. The phone app saves the color theme you pick with your account, unless you pick the plain KeepUp light or dark one, which stays on the phone. It also saves the conversations you mute. On the websites, your theme, text size and language stay in your browser. The KeepUp website saves which school opens first, and your progress through its getting-started guide, with your account.

If you use a password, we store it scrambled, so we can check it but never read it.

Sign in with Microsoft is built into the KeepUp and Touchpad websites but switched off today. Turning it on is one switch for all of Hajos, not one per district.

Once it’s on, Microsoft never creates an account. It can only sign you in to a Hajos account that already uses your email, or take you to an invitation waiting for that address. We store which Microsoft account is yours and nothing else. We never keep anything that would let us into your Microsoft account.

Channel messages, direct messages, replies, reactions, the photos and files you attach, announcements, team documents, calendar events, an athletic director’s notes on a team, like facility, budget or staffing notes, and anything you write when you report a message or raise a concern.

The phone app re-saves a photo before it uploads it, whether you attach it or make it your profile photo. That drops most of the hidden details your phone stores in a photo.

We don’t strip anything on our side, so a school or team image uploaded from the website keeps whatever is inside it, which can include where it was taken. A profile photo picked on the KeepUp website isn’t uploaded at all. It stays in that browser.

Attendance and attendance notes, practice plans, event details and report times, bus requests, meet entries and which athletes won’t swim a meet, heat sheets, results and times.

Coaches and athletic directors also record things about an athlete: notes, and a status like Injured or Academic hold. Our servers can store a short note with a status, but no screen asks for one today. Coaches write notes in their own words, and a status can touch on health or grades, so we treat both as sensitive.

Any coach at the athlete’s school can see coach notes, not only the swim coaches, and so can its athletic director and administrators. The athlete’s own coaches and school staff see statuses. The coaches of a co-op team the league commissioner puts the school in can see those coach notes too, even if they work for another district. Coach notes from a swimmer’s earlier seasons in the same sport can be seen at the school that wrote them, and nowhere else: a coach at a later school doesn’t see them, even in the same district. District administrators and our support staff can see attendance notes and statuses, but not coach notes.

A status, like Injured, can also reach a league commissioner or the people running a meet, for example when one of them tries to enter that athlete. They never see the notes. When someone sets a status on an athlete entered in an upcoming meet, the swim team’s head coaches get an email naming the athlete and the status.

When a direct message was delivered and read. We record that for every direct message. It drives unread counts, and read receipts where your district allows them. The last time you read each channel, so unread counts work. Anyone a student blocks. And who you follow on Streamline.

A coach from a school that isn’t on Hajos can use a meet invite link to manage entries and get meet updates, giving a name and email. Anyone holding one of a team’s entry links can sign up for meet updates the same way and add a phone number. Only the coach link’s page offers that sign-up today. That’s a limited guest record. It isn’t on any team, holds no role, and can’t be signed into. If that email address is later invited or added to Hajos, the guest record becomes that person’s account. Accepting an invitation doesn’t carry over a name or phone number typed on the guest record. If staff add that email directly, or a roster file lists it, the account keeps that name and phone number until someone changes them.

The entries a visiting coach uploads become records too: each swimmer’s name, gender, grade and seed time, kept on that school’s roster. Birth dates in the file aren’t kept.

A results file a league or a host school uploads names swimmers from every school at the meet, including schools that don’t use Hajos. For those swimmers we keep a name, school, grade, gender and times, on a roster for their school, and we publish their results like any other. Their school has no account to restrict a listing with, so the school or a family can email us to restrict one.

A coach can share a swimmer entry link with their own swimmers, and the meet’s host school or the league commissioner can make one for any team in the meet. Anyone holding it sees the team’s roster with names and grades, leaving out restricted athletes. A swimmer picks or types their name and picks events, and for a medley relay can say which strokes they could swim. Nothing is entered until a coach, the host school or the league commissioner approves it. It creates no account and asks no age.

Your name, email and the school you sign up under. Staff at every school in the meet, the league commissioner and district administrators over those schools see your name and email on the crew sheet.

Text reminders aren’t switched on yet, so the form takes no phone number today. When they are, a phone number will be optional. We’ll use it for those texts, the same people will see it, and we’ll keep the time you agreed and the consent text you saw. The form has no age check, and a child under 13 should be signed up by a parent.

The school year ends on July 31. Your email and phone are deleted by the end of August, unless a legal hold covers them, and your name stays in the meet’s crew record. A copy that matches your own Hajos account can stay, since your account holds it anyway.

If you join the officials list without signing in to a Hajos account, your contact details stay on it until you ask us to remove them or two years pass since you last signed up. If you sign up while signed in to your own account, the list uses the contact details on your account instead of keeping a copy. Your name and any certifications you listed stay on that list.

A meet’s sign-up page shows who signed up: first name and last initial to anyone with the link, and full names to anyone signed in to Hajos.

Delta isn’t open yet. If you join its waitlist on this website, we keep your email address and, if you give them, what you swim, where you swim and what you’re training for. One entry per address, however many times you join. We use them to tell you when Delta opens and to shape what it writes first, and for nothing else. Nothing is passed to anyone else, and you get no other mail from it. Each signup also sends a note to our own mailbox, which runs on Google Workspace, as section 08 explains. The entry stays until you email us to take it off.

Which parent goes with which student, guardian verification, parent view requests, and any request to link two accounts.

On an iPhone or iPad, a code that lets Apple deliver notifications, one per device you sign in on. Signing out turns it off on all your devices, wherever you sign out, as long as you’re online when you do. A phone that’s still signed in to the app turns it back on the next time the app starts up online. Deleting your account turns it off too. If you sign out while offline, notifications to that phone stop when that sign-in would have run out. A sign-in on the phone app lasts 30 days from when you signed in or the app last started up with an internet connection, whichever is later. Switching back to the app while it’s still running doesn’t count. When a sign-in runs out, notifications to that phone stop. Signing in to the app on another phone or iPad ends the old sign-in too, because an account can be signed in to the app on only one device at a time. Rarely, if the connection drops while the app is starting up, notifications can keep coming for up to 30 days after the app has signed you out. Phones that turned on notifications before our October 2026 update switch over the next time the app starts up online. Until then, they can keep getting notifications for up to 30 days after the app last started up online or you last signed in on them.

The phone app keeps the key that signs you in inside the phone’s secure keychain. It also keeps a copy of your own profile, your team and conversation lists, attendance you marked while offline, which attendance reminders you dismissed, your theme, which team you last opened and which team documents you’ve opened. It never keeps message text. Photos you pick to send can stay in its temporary files until the phone clears them. Notifications already on the phone stay in its notification list until you clear them, even after you sign out. A team announcement’s notification shows its text.

The app stops using the team and conversation lists after 12 hours, and offline attendance marks after seven days, and deletes them the next time it opens. These copies stay out of phone backups and are deleted when you sign out. Photos in its temporary files are not. If the app is deleted and installed again, it starts signed out.

Your phone’s own network cache no longer keeps anything private our servers send, photos and files included. What it kept before that change stays until the phone clears it, even after you sign out.

On the web, a sign-in cookie keeps you signed in until you’ve been idle for two hours. A KeepUp or Touchpad page left open keeps checking for notifications, and that counts as activity, so sign out when you walk away.

Your browser keeps a few things to save you time, like your theme, language, the profile photo you picked on the KeepUp website and an unfinished meet form. Signing out of KeepUp clears that photo, your text size and your other KeepUp settings. Your theme and language stay, and so does an unfinished Touchpad meet form. On a shared computer, clear the browser’s site data.

Server logs and the codes that keep you signed in. Server logs record the IP address of every request, which is the internet address your device connects from. We keep them 30 days. We deleted the logs from our older hosting setup in October 2026. We limit sign-in attempts per email address and per IP address, to stop password guessing.

When school or district staff start a safety review, the audit log keeps their IP address. When they export every conversation at the schools they oversee, it keeps their IP address and browser details. Exports of one conversation or a set of them are logged too, but without either. We remove both after 18 months, unless a legal hold covers the entry.

A record of who looked at what, and of other sensitive actions. Every safety review, every parent view, every Records Archive export. It exists to hold adults accountable.

Your teams, your messages and notifications, practices, meets and results.

Screen messages, get reports to the right adults, and keep the audit log of who opened private conversations and other sensitive student records. A safety review also records why the reviewer is looking.

Some staff screens aren’t in the audit log yet, like attendance history and the notes and statuses staff keep on athletes. Opening the review queue and alerts in the phone app isn’t logged either, though the decisions and escalations made there are. Nor are records we pull by hand at your district’s request, or most working files staff download, like a roster or a heat sheet. Approving a parent’s request to see a conversation isn’t in the audit log either, though the request itself keeps who approved it and when.

Answer your questions and fix what you report. Our support staff use a support console to set up districts, schools, accounts and staff invitations. There they can see names, emails, roles and settings.

Creating, changing and removing accounts there goes in the audit log, and so do erasures and new invitations. Other setup there isn’t in the audit log yet, like creating a district, changing a school’s settings, switching an AI feature on or naming a league commissioner. Your district’s Audit Log screen also doesn’t yet show some of what the log holds. That includes when we change or remove one of your accounts or invite someone at the district level, and when one of our support staff starts or ends a safety review. It also includes retention deletion runs, changes to an athlete’s directory restriction, and meet files exported with restricted athletes in them.

Our support staff also hold an administrator role across every district in the apps. They can open any school’s rosters with contact details and birth dates, approve a parent’s request to view a conversation and raise an erasure. They can also set an athlete’s public listing, though today they do that by hand. If a support person needs to open a conversation, they go through the same safety review as a school administrator. Each conversation they open is logged with their name and the reason they gave, but your district’s Audit Log screen doesn’t yet show when their review started or ended, as above.

That’s it. We don’t build a profile of you for advertising, advertise to you, or sell anything we hold. Beyond running, securing and supporting the service, we touch this data only when we have to: to investigate abuse, keep backups, or meet a legal obligation.

Every message runs through a keyword check on our own servers as it’s sent. Nobody is notified and nothing goes out live until the check is done. The message is saved a split second before the check finishes. Anyone whose screen loads that conversation in that instant could see it first. That includes a chat already open, or a list that previews the latest message.

The check reads text. Photos and files aren’t scanned, so if you see one that worries you, report the message it came with. What happens next depends on who wrote it.

Each check gives the message a score. Reviewers see it only as Low, Medium or High, never as a number. For a message, three words mean three things. A flagged message is delivered with a visible mark and goes into the review queue. A held message is hidden from everyone except its author and the staff who see the review queue, until a reviewer decides.

When the keyword check blocks a message, it isn’t delivered unless a reviewer clears it, apart from the split second described above. A reviewer can also block a message that was already delivered. It then stays hidden. Clearing a held or blocked message delivers it. Clearing one that was already delivered just removes its flag, and it isn’t sent again. A direct message’s recipient is notified about it once at most.

A low score delivers the message. A medium score flags it. A medium score from the keyword check, or from Claude on an announcement, also alerts the head coach in KeepUp. In a group chat opened on the KeepUp website’s Family Groups page, others see who sent a flagged message and when, but not what it says. Nothing there marks it as flagged. The same chat in the phone app shows it with a flag mark. A high score from the keyword check alerts the head coach and athletic director right away. It also blocks the message, unless it’s one of the few kinds delivered with their flag instead, as below.

Claude’s answer usually comes back after the message is delivered, so people may already have seen it. A high score from Claude then holds the message for a person to decide and alerts the head coach and athletic director.

Nobody is alerted about a message they wrote themselves. If the head coach wrote it and the team has no other head coach, a high score alerts the athletic director in their place. A medium one isn’t alerted to anyone, but it still waits in the athletic director’s review queue. If a high score lands on the athletic director’s own message and the school has no other one, or there’s no athletic director to stand in for a head coach who wrote it, the district’s administrators are alerted instead. If the district has nobody on Hajos either, the alert is recorded as reaching nobody, and our support staff are told that a high-score alert at that school did, so somebody follows up.

An announcement written on the KeepUp website that the keyword check would block is refused before it posts. Its writer is told why, and nobody else is alerted. One posted from the phone app is blocked like any other message, but the team’s coaches and administrators still see it on the KeepUp website’s announcements page. The same goes for an announcement Claude holds.

AI never blocks a message. It can only hold one for a person to check. Apart from a reviewer’s decision, the only thing that blocks a message is our keyword check: a short list run on our servers, with no AI involved. Its blocking entries are threats worded like “I’m going to hurt you”, slurs about race, ethnicity, sexuality or disability, and words about weapons or sexual violence. A threat or insult worded another way can get a medium score and be delivered with a flag. Some entries are single words, like gun or knife, so a message about a starting gun is blocked too. A few high-scoring entries deliver the message with its flag instead. These are words about self-harm, so a student in crisis still reaches their coach, threats about someone else, which are usually frustration, and phrases like “keep this between us”. A message that also has a blocked word, like knife, is still blocked. Asking to move off the app or for a photo is flagged and delivered the same way, unless an athlete on the team wrote it.

Where AI message review is on, a low score from Claude can also clear a medium flag on an adult’s delivered message without a person looking, as long as nobody has reported or reviewed it yet. It never clears the flag from a high keyword score, like one about self-harm or “keep this between us”, and never unblocks a blocked one. A high score from Claude can still hold such a message until a reviewer decides.

Every AI feature is off until your district asks for it. There are four: AI message review, meet summaries, access-pattern review and practice-set drafting.

We switch the last three on or off, only at a district’s request. Our software lets a district administrator switch AI message review directly, but the KeepUp website has no screen for that yet, so today a district asks us. Turning a feature off for a district turns it off for every one of its schools. With all four off, none of them runs for your schools.

Sends the sport, the meet’s schools and score, the date and venue if the app has them, and each highlighted athlete’s name, event, time and whether it was a personal best, so Claude can write a recap. Only coaches and staff at the team’s own school, and our support staff, can ask for one, and no screen in the apps offers it yet. Before anything is sent, we keep only athletes whose names match someone on that team’s roster, so a swimmer from the other school is left out unless they share a name with one of the team’s athletes. We also remove any athlete whose public listing is restricted. Each coach has to opt in too.

Today this looks at when parents open their child’s conversations. Whether it runs is decided by the setting for the conversation’s school. Each view sends Claude the date and clock time of that view and of up to 50 of that parent’s earlier views of conversations at that school. No names and no message text go with them. Claude looks for unusual patterns. It doesn’t review staff access on its own yet.

Sends what the coach types to ask for a set, the length and kind of set if the coach picked them, and whether to write the set in yards or meters. We add nothing about athletes. What the coach types goes as written, so coaches should leave athletes’ names out.

Hajos builds software for schools and districts. The records your schools keep in it belong to your district, not to us.

Federal law, FERPA, lets a school share student records with a company that does work its own staff would otherwise do, as long as the school stays in control. FERPA calls that company a school official, and a district’s annual FERPA notice sets out who counts as one. Where your district names us one, that’s how we work with it: under its direct control, and only for what it authorizes.

Meet results are shared records. The league commissioner can remove a meet your swimmers swam in, and its results. The school that hosted it can remove the meet in some cases, like an invitational whose results aren’t official yet.

Until the commissioner approves a results upload that isn’t tied to a meet in Hajos, a coach or staff member at either school in it, or our support staff, can delete it.

That matters most when you want something gone. We can end your access. Erasing someone’s records is your district’s call. Staff at your district raise an erasure request, or ask us to, and we carry it out, unless a legal hold or the district’s retention period says the material must stay for now. Section 12 explains both.

Nobody, including us, can edit a sent message. If a parent or student thinks a note, an attendance mark, a status or a meet absence is wrong, they ask the district. Its own staff can fix notes and attendance in the app while the athlete is on this season’s team. A status belongs to the athlete rather than the season, so an athletic director or administrator can change it even after an athlete with an account leaves the team. Once an athlete without an account is off all of the school’s teams, staff can’t change their status in the app. Until the meet’s entries close, staff at the athlete’s school can take back a meet absence in the app. So can the school hosting the meet and the league commissioner. It also ends when staff put that swimmer in a lane on the heat sheet by hand, even after entries close, once the swimmer is actually in that lane. While an absence stands, staff can’t enter the swimmer or approve a request to enter them. Entries files don’t enter their individual swims. Seeding leaves them out of the heats and leaves their relay leg empty. If the heats were made before they were marked out, they stay in their lane until the meet is seeded again or staff change it. Seeding and exported files leave their existing entries in place. An entries file brought in for their team replaces the team’s entries, so it removes their individual swims. An absence also ends when results uploaded for the meet give the swimmer a time or a disqualification. The entries file exported for Meet Manager leaves out their individual swims but keeps them on their relay leg, so the other legs stay in order. Whoever exports a Meet Manager file is told which swimmers in it are marked as not swimming, but not why. When the host exports the whole meet, they see this for every team.

A fix replaces the old entry, and the app doesn’t show what it said before. Our daily backups hold it for up to 14 days, and our server logs can keep the request that set it for up to 30 days. An email we already sent about it, like one telling a head coach an athlete can’t compete, still says what it was. A status set before our September 2026 update can also stay in an older database field after it’s fixed.

Some coach notes belong to the swimmer, not the season, like ones written before late August 2026 or at a school that uses only Touchpad. A note on a KeepUp team doesn’t replace them, and they can show again next season at the same school. They don’t show at a later school, and once a swimmer has been on another school’s roster they stop showing at the earlier one too. If staff can’t fix a note, an attendance mark, a status or a meet absence in the app, the district asks us to.

Outside the schedules on this page, the clean-up of student phone numbers in section 01 and a district’s exit, we never delete a district’s records on our own. One of them is a nightly clean-up. A one-day status, shown as Ineligible today, stops applying the moment it runs out. The next clean-up deletes it, and any note stored with it, unless a legal hold covers it.

Some of what Hajos holds is public on purpose. Swim results go on the pool wall, in the meet program and on the state association’s site. Hajos publishes that same record so families, fans and college coaches can follow a season.

Public meet pages show each swimmer’s name, school, events, times and class year, like SR. School pages show the roster, which team each swimmer is on, and the names of the coaches and athletic director. Tap a swimmer’s name there and you see their graduation year, like Class of 2028, and their best time in each event.

Rankings show names, schools, graduation years and times. Record boards show names, schools, times and the year the record was set. None of it shows a birth date, an age, contact details, messages or attendance.

The results file anyone can download for meet software carries each swimmer’s name, school and gender, and their grade when the roster has one, because that software needs them.

Individual athlete profile pages are switched off on Streamline right now. A swimmer’s name on a results page is plain text and links nowhere.

Most of what a profile showed is still public, though. A school page shows a swimmer’s best times when you tap their name. And anyone who asks our servers for a profile by its number can get it. That includes a swimmer’s name, school and its town, their times, and every public meet they swam with its date and their places. A restricted athlete can’t be looked up that way.

We treat all of it as public until we switch it off too. We also tell search engines not to crawl profile addresses.

Parents are never published on Streamline. Neither is anyone’s personal contact information. The only email it carries is the one a state association lists for itself.

Two links made for sharing outside Streamline show names to anyone who has them. A meet’s volunteer sign-up link shows who signed up, and volunteers are often parents. A team’s swimmer entry link lists the team’s swimmers by name and grade, leaving out restricted athletes.

Your school can restrict an athlete’s public listing. FERPA calls this a directory opt-out, and a family might ask for it when they don’t want basic details like a name and team published.

The athletic director sets it on the Public identity screen in KeepUp. A district administrator is allowed to as well, but that screen doesn’t open for them yet, so for now they ask the athletic director or us. Our support staff can set it at a school’s request, though no screen offers it to them yet either, so they do it by hand. For a school not on Hajos, a family can ask us.

A restricted athlete is left off public rosters, rankings and the downloadable results file. On meet results, heat sheets and entry sheets, their swims still show, but the name is replaced with the format set for your district: a meet-only number, initials, or first initial and last name. The default is the number, and your district can ask us to use another. That covers what we publish. Sheets and files that staff print or export to run a meet still show the name, and those can go to the other teams, the officials and the pool wall.

It works by matching each swim and record to the athlete, through their roster record or their KeepUp account. One that carries only a name is matched by that name within the school first, and then against every restricted athlete anywhere when the name is theirs alone, so a namesake can be hidden too.

Every student on the school’s swim teams is on the Public identity screen, including one whose only way onto the team was a KeepUp invitation. Restricting one of those also puts them on the school’s Touchpad roster, which is where the restriction is kept. A name a coach types in Touchpad still has to match their account, or it makes a separate record that doesn’t cover their swims.

A swim filed under a name that doesn’t match the roster, like a nickname, doesn’t match either. That name can show on results, and on the school’s public roster, in rankings and in the results file. Results uploaded as a file are matched by name against every restricted athlete, whichever school the file lists them under, so a co-op partner’s file, or a meet their own school isn’t in, still hides the name. The exception is a name that two restricted athletes share, which matches neither unless the file names the right school.

Record boards have a smaller gap. A record that carries only a name still shows it when that name doesn’t match the roster, or when the record lists no school or a different one. If any of that matters for your athlete, ask your athletic director.

Nothing else about a person is public. Messages, attendance, notes, contact details, documents. None of it.

School images are the one other public thing. Crests, banners and team emojis are public by design, so whatever a banner shows is public too.

For staff, opening someone else’s conversation takes a safety review. A reviewer doesn’t need a flagged message first. The steps below are what stop casual looking.

A head coach can review their own teams. An athletic director or school administrator can review their school. A district administrator can review their district. Assistant coaches can’t. Our own support staff can, through the same steps. Section 02 says how their reviews are logged. A parent asking to see their child’s conversation goes through a different process, below.

To start one, the reviewer re-enters their password, types in a code we email them, and writes down why they’re looking. The review ends after 5 idle minutes or 30 minutes total. Every conversation they open is recorded with their name and their reason.

Coaches and athletic directors see flagged and held messages from team channels and group chats in a review queue, with the sender named. School and district administrators can open it too, though their menu doesn’t link to it yet.

Flagged direct messages appear in a queue only in the KeepUp phone app. On the KeepUp website, they show on the Alerts page instead, and can be reviewed inside a safety review. Head coaches see those from their own teams, and athletic directors those from their schools. School and district administrators and our support staff are allowed them too, but the phone app doesn’t open that queue for them yet. An assistant coach can’t see them in a queue, open one, or find them on their Alerts page. A reviewer’s own messages never appear in their review queue or on their Alerts page, on the KeepUp website or in the phone app. Only someone else can review them.

A parent can ask to see one of their own child’s one-on-one conversations with another student. Group chats and conversations with a coach can’t be viewed this way. For a coach conversation, a parent can ask the school to review it instead. The request goes to the school’s athletic directors and school administrators, but never to the coach it’s about. If nobody else at the school holds one of those roles, it goes to the district’s administrators. Every district administrator can also see the request on the KeepUp website’s Alerts page. Any of them can open the conversation through a safety review. For a conversation with another student, a parent can also ask the athletic director to review the whole conversation.

The athletic director, a school or district administrator, or our support staff approves a parent’s request to see a conversation, and it lasts 48 hours. Every view is logged. The other student isn’t named, and their messages are withheld unless the district asks us to show them.

On the student’s 18th birthday, a parent can no longer read the student’s one-on-one conversations, going by the birth date on the school’s roster. The parent can still see that each conversation exists, and the name of any coach in it. When the roster has no birth date, we go by graduation year instead. A student two or more years from graduating is treated as under 18. A senior, a graduate, or a student with no graduation year on file either is treated as 18 or older, and the phone app tells the parent that the birth date is what’s missing, so the school can add it from the roster.

Past 18, the view continues only if the student says so. A student who is 18 or older, or whose age we can’t tell, can answer from their own account whether a parent may keep viewing, and can change the answer. Until they answer, it continues only where the district decides the law still allows it, for example because parents still claim students as tax dependents, and asks us to turn that on. That district setting covers a whole school or district; the student’s own answer covers only them, and wins.

Coaches, athletic directors, and school and district administrators see attendance rates, absence counts and each athlete’s attendance history for their teams.

A league commissioner can see every athlete on the teams in their league, across schools and districts: name, grade and graduation year, teams, jersey number, level, position, captain status and status, like Injured.

They don’t see an athlete’s contact details, birth date or student ID, which parent belongs to which athlete, or any messages. The team lists our servers send them also carry the names of the parents on each team, with no contact details, though their screens don’t show them.

Two limits live on our servers, not just in the app. First, a parent can never message another family’s child one on one. A parent can only join a group chat with that child when one of the child’s own parents is there too, still on the team and with an active account. We check that when a group is created and whenever someone joins, is invited or added, in the app or on the KeepUp website, or leaves. We also check it again every time a parent opens the group or posts in it. If a parent is taken off the team, loses their link to the child, or has their account deactivated, the group’s membership isn’t changed, but a parent the rule no longer allows can’t read or post in it, and it drops off their list. The group is put right when someone leaves, which removes anyone the rule no longer allows, or when someone tries to add a member, which is refused unless the addition puts the group right.

Second, a parent’s view into their child’s messages never reaches a conversation the child isn’t in. Neither limit applies to team-wide channels. Every team starts with channels like general that include the whole team, parents, coaches and athletes.

Coaches and staff can message a student one on one. Those messages get the same screening as every other adult message, and a safety review can open them.

When a parent views their child’s conversation, we record the parent’s name and the time. A view from the KeepUp phone app also sends the child a notification. Tapping it shows the parent views of that conversation, from the child’s 50 most recent. That notification is the only way into this list today.

A view from the KeepUp website is recorded the same way but sends no notification, so the child sees it only by tapping a notification from a phone view of the same conversation. The other student in the conversation isn’t told.

When staff open a private conversation in a safety review, the people in it see an eye icon in the KeepUp phone app for seven days. The website doesn’t show it. Neither does a direct message between two students where one has blocked the other, because it drops out of both of their lists. A team-wide channel like general, or a public room anyone on the team can join, shows no icon when opened in a review either.

Athletic directors and school and district administrators can also read private messages in the Records Archive, the staff screen for finding and exporting conversations. They can open or export one conversation, or export every conversation at the schools they oversee. That takes the same safety review and is logged the same way, but shows no icon.

The log keeps a digital fingerprint of each export, so a copy can be checked against it later. The export screen doesn’t yet ask who the records are going to, so for now your district keeps that part itself.

Coaches and administrators also see flagged messages in the review queue, with no icon. The website logs that. A district administrator’s Audit Log screen shows it when the reviewer holds a role in that district, though for now it reads like a profile view. An athletic director’s or school administrator’s screen doesn’t show it yet. Opening the phone app’s review queue or alerts isn’t logged yet. Decisions and escalations made there are. The audit log entry is permanent.

The athletic director is told when a student blocks another student, and when anyone deactivates their account with the Delete my account button, parents and coaches included. The notice goes to the athletic directors at the person’s school. If the school has no athletic director on Hajos other than the person leaving, nobody is told. An account deactivated any other way, like by staff or when a role ends, sends no notice.

A deactivation is also missed when we can’t tie the person to a school, usually because they hold no role at a school and aren’t on a current team. Two examples are a student between seasons and a district administrator. Someone with roles at more than one school is reported to one school’s athletic directors at most.

When a student raises a concern about a staff member, the notification goes to the school’s athletic director and school administrators, never to the person it’s about. If nobody else at the school holds one of those roles, it goes to the district’s administrators. A parent’s request to review a coach conversation goes to the same people. The request, with the child’s name and the parent’s note, also shows on the KeepUp website’s Alerts page to every district administrator in the district. If the district has no one on Hajos either, the concern or request is still recorded and marked as reaching nobody, and our support staff are told that one was raised at that school and what kind it was, never who raised it, who it’s about or what was written, so that somebody follows up. Whoever next holds one of those roles at the school sees the concern or request marked that way on the KeepUp website’s Alerts page.

When a reviewer escalates a message from a safety review, a review queue or the phone app’s alerts, they can send it to parents, to the district administrator, or both. From a safety review, it goes to the parents of the student being reviewed. From a review queue or an alert, it goes to the parents of whoever wrote the message. So from there, a message from a coach, staff member or parent reaches no parent, unless the writer is or was a student on Hajos with parents linked, like a student who also coaches. Parents of a student known to be 18 or older are told only if the student has said a parent may keep viewing, or, until they answer, where the district has kept parent access on after 18, as section 06 explains. When we can’t tell a student’s age, their parents are still told.

Each person it reaches gets an alert in KeepUp and an email. In the phone app, the alert is pushed as New safety review. The email names the student being reviewed in a safety review, and otherwise the person who wrote the message, and carries the note. The messages themselves stay behind sign-in. The Notify parents, Notify AD and Alert district admin buttons on the KeepUp website’s Alerts page escalate the same way, with a note from the person who presses them. Notify parents reaches the parents of whoever wrote the message, under the same rules. Notify AD reaches every athletic director at the school, and if that leaves no one, the district’s administrators. No escalation ever goes to the person who wrote the message or the person sending it, and nobody can escalate a message they wrote. Each person is told about a message once, whichever screen it’s sent from, and an escalation that would reach nobody is refused. When one that asked for parents reaches no parent, the reviewer is told so. In the phone app’s alerts, a message can be escalated only while it’s still blocked.

When someone reports a message, it goes to the review queue. Nobody is sent a notice about it, and the reporter isn’t named. Unless it’s already blocked, the message is held until a reviewer decides, and reviewers see it tagged Reported, with a score shown as Medium or High. A blocked message stays blocked.

A reported announcement is also different: the team’s coaches and administrators still see it on the KeepUp website’s announcements page. Copies already delivered stay where they landed: a reported announcement keeps its text in the team’s notification list and in any email already sent.

The phone app’s Report a safety problem button is different. It opens an email to us, not the review queue. Section 08 says what happens to it.

Our hosting, database, file storage, websites and outgoing email, all in the United States. Our servers, the database and file storage are in Oregon. Email is sent from Ohio. The websites are stored in Virginia and reach you through Amazon’s content delivery network. In October 2026 we deleted the server logs left from our older hosting setup and the extra database copies we had kept from our September 2026 move.

Photos of people and message attachments open through links that stop working after a short time. School crests, banners and team emojis are public images by design. AWS also hands push notifications to Apple, and will send volunteers’ text reminders once we turn those on.

Push notifications, so they reach your iPhone. A push about a direct message never contains the message. It shows the sender’s name and “New message”. An escalation, or a parent asking the school to review a coach conversation, pushes “New safety review” and names no one. The automatic alert when a message is flagged stays inside KeepUp and isn’t pushed. Ordinary channel and group chat messages don’t create pushes at all.

A team announcement or a posted result does carry its text, because those go to the whole team anyway. So does a reminder, with the event, its time and place, a volunteer’s role, and any note about what to bring. So does a bus request, which names the coach, the event and how many athletes are going. So does a note asking a league commissioner to verify qualifying times, which names the schools that swam and the championship, and a note telling a commissioner that official results were uploaded, which names the meet.

Every other push says only “KeepUp” and “Open KeepUp to see this.” Every push also carries a label for the kind of notice it is, like a student’s concern about staff, and internal numbers so the app opens the right screen. Apple handles those too.

We don’t ship an Android app yet, so Google gets no push data. The Touchpad and Streamline sites, our support console and this website load their fonts from Google Fonts. Google’s font servers see the ordinary web request: your IP address, your browser type and which of our sites asked. On Windows, the Touchpad desktop app downloads a spelling dictionary from Google, which sees your IP address and your computer’s language.

Tapping Directions opens Google Maps with the venue’s address. In KeepUp it also sends the venue’s name. In Touchpad it also sends your school’s name, city and state as the starting point.

Our own email runs on it. When you write to us, your message sits in that mailbox, outside the app, its audit log and its retention schedule. That includes a safety report a student sends with the phone app’s Report a safety problem button, and the note each Delta waitlist signup sends us. We pass anything about a student to the district.

The Touchpad desktop installer is hosted there. The download page asks GitHub for the latest version, so GitHub sees the ordinary web request: your IP address, your browser type and that it came from the Touchpad site.

The desktop app’s update check also contacts GitHub, which sees your IP address, a random ID the updater keeps on that computer, and which version downloads when there’s an update. The ID is only used to stage updates and isn’t linked to any Hajos account. No meet or account data goes with either.

Nothing today. Sign in with Microsoft is switched off. When we turn it on, Microsoft gets only the sign-in handshake, and we never create an account from it.

Only for the AI features in section 03 that your district has turned on. Never anything a student wrote on their own team. What Anthropic may keep, and for how long, is set by our agreement with it, and we share those terms with any district that asks.

A coach can email a team announcement to the roster’s addresses, including students and parents who don’t have an account. Every one carries a link to stop these emails. Opening the link changes nothing by itself. It shows the address and an Unsubscribe button, so a link scanner that opens it can’t unsubscribe anyone. Some mail apps show their own Unsubscribe button next to the sender. Where the app supports it, that button unsubscribes the address in one step. Once an address unsubscribes, it gets no more team announcements from any school. Other email can still reach it, like an invitation, a password reset, a safety escalation or a meet notice.

A spam report is different. When an email provider passes one on to AWS, which sends the app’s email, AWS stops all our email to that address, as it does for an address that doesn’t exist, even a password reset or a safety escalation. We don’t yet record emails that were delayed or couldn’t be delivered, or spam reports. AWS keeps its own list of the addresses it stops sending to.

That’s the whole list. No analytics company, no ad network, no data broker. Beyond these and what we publish on purpose in section 05, we hand over data only under a subpoena or court order, when the law requires us to report something, or when your district directs us to. Inside Hajos, some records also reach people outside your district, as sections 01 and 06 explain.

If we believe someone is in danger, we tell the district at once and follow its instructions. If the law requires us to report something ourselves right away, we do that without waiting.

Hajos is built for high school athletics. Your school or district decides which students and families get an account. We never ask a parent for consent to create one, because we don’t allow student accounts for anyone under 13. Accounts come by invitation, and our support staff and a league commissioner can also invite staff, as section 01 explains. A public link never creates a student account.

A student account needs a birth date from the school’s roster, never from the person holding the invitation. Under 13, or no birth date on file, and the account is refused.

That check runs whenever an account joins a team as a student: a new account made from an emailed invitation, or an existing account joining by invitation or a roster import. It doesn’t look back at student accounts opened before it covered all of those paths, in September 2026.

The apps take a birth date only from a roster file. There’s no field for staff to type one in.

If we learn that a student is under 13 anyway, we deactivate the account right away and ask the district to erase the records. Today that erasure waits out the district’s retention period like any other. The district can shorten that period for all its schools, but not below one year after the student’s newest message.

The apps are built for a setting that includes minors. That’s why adult oversight is designed in. The KeepUp phone app also shows a student some of the times an adult has looked, but not every time. Sections 06 and 07 explain both, and say which looks a student isn’t told about.

Everything between your device and our servers travels over HTTPS, the encrypted connection behind the padlock in your browser. The phone app refuses anything else, and the websites and our servers send any unencrypted request straight to HTTPS. The desktop app can reach only our servers, GitHub for updates and, on Windows, Google for a spelling dictionary.

Email our apps send is always encrypted on the way, and isn’t delivered to a mail server that can’t receive it that way. Mail we write ourselves, like replies from our privacy address, is encrypted on the way only when the receiving mail server supports that.

The database, its daily backups and file storage are encrypted where they’re stored.

Everything that needs you to be signed in is checked on our servers against who you are and what your role lets you reach.

Public results pages are open to anyone. Some other things work by link or code instead: volunteer sign-up links, meet invite links, coach and swimmer entry links, invitation links, password reset and email change links, the codes that sign staff into the desktop app, the league’s results upload code, the expiring links that show photos and files, email unsubscribe links, and the run codes that let a timing operator record one meet. Each of those reaches only the meet, team, league, person or file it was made for, and we limit how often any of them can be tried.

Opening a student’s private conversation takes the extra steps in section 06.

Most sensitive actions go in the audit log, but not all of them yet. Sections 02 and 07 give examples of what isn’t logged.

Passwords are stored scrambled and sign-in attempts are limited, as section 01 explains.

The KeepUp, Touchpad and Streamline websites also tell browsers to block other sites from showing our pages inside theirs, and to block code slipped into our pages.

No system is perfect. We treat student data as the most sensitive thing we hold and build like it.

If personal data is lost, exposed or reached by someone who shouldn’t have it, we tell the affected districts. We do it without delay, and within 72 hours of confirming it. We keep them updated as we learn more.

We’ll say what happened, what data was involved, whose, what we’ve done, and what we recommend. Your district decides how and when to notify families, and we give it what it needs to do that.

Some data doesn’t come through a district we work with, like the officials list and a guest coach’s record. If that data is involved, we tell those people ourselves wherever we have a way to reach them.

Where the law requires us to notify a regulator or the people affected directly, we do.

Your district decides how long we keep communications and team documents. If it hasn’t, the default is seven years, counted in school years, with the year that’s starting counted as one of them. So with seven years, the start of 2026-27 deletes 2019-20 and earlier. The deleting happens when your school rolls its teams over to a new school year in KeepUp, so a school that never rolls over keeps everything until it does.

Files attached to messages go too. Two copies aren’t removed yet. One is files embedded inside a team document. The other is the notification copies on our servers, which keep the start of each delivered direct message, up to 140 characters, and the text of announcements. Pushes to your phone still never carry direct message text.

Anything under a legal hold stays. A legal hold is when a district must keep records for a lawsuit or an investigation. A reported message, or one Claude held, also stays while it waits on a reviewer, unless the keyword check had already blocked it. Flagged and blocked messages are otherwise deleted with the rest, reviewed or not. The entry for a flagged message on the website’s Alerts page isn’t deleted with it, and keeps the reason reviewers saw, which for a Claude flag is a sentence describing the message. Each deletion run goes in the audit log, though the Audit Log screen doesn’t show it yet.

Other records have no deletion schedule, apart from three things set out in sections 01 and 04: a one-day status, a meet volunteer’s email and phone, and contact details on the officials list. A legal hold keeps the first two. It can’t keep the third, because the officials list keeps a copy only when someone signs up without signing in, and it names no school, so nothing ties that copy to a hold.

Some short-lived data also clears by itself. Copies of messages used to deliver live updates, direct message text included, are deleted after about a day. Sign-in codes for our support console are deleted after a day, and spent permissions to download the Records Archive after a week. A staff role with an end date switches off on that date, and an account left with no active role and no current team is deactivated then too.

Rosters, birth dates, invitations, attendance, notes, statuses, results and uploaded results files stay until school staff, a league commissioner, an erasure or a district’s exit removes them, or your district asks us to. An erasure and a district’s exit each keep some of them, as below. Guest records belong to no district, so ask us to remove one.

The database is backed up every day, and each backup is kept 14 days, so erased data leaves the backups within 14 days. Server logs are kept 30 days.

The audit log is the exception to all of this. It’s never deleted on a schedule, and our software has no screen for deleting it. After 18 months we strip the IP address and browser details, unless a legal hold covers the entry.

Staff actions can add to an entry, like a note that a message was escalated. What an entry says about who looked and when doesn’t change. When a district leaves, its entries are unlinked from its schools and teams. A record of who looked should outlive what they looked at.

The Delete my account button in the phone app, under You, doesn’t erase anything. It deactivates the account, ends your sign-in on every device right away and switches off push notifications to your phones. The athletic director at your school is told, except in the cases section 07 lists. Your records stay, because they belong to your district.

There’s no such button on the website yet. To have records erased, ask your district, as below.

Real erasure takes two steps. Staff at your district raise the request and we carry it out. Our support staff can also raise one, so raising one only when your district asks is our practice, not a lock in the software.

Today a request covers a student on an active roster at your school. A parent, a coach, or a student no longer on an active roster can’t be put through it yet, so the district asks us. There are two kinds: messages, or messages and the account. The request button on the website asks for the second, and only for an athlete with an account, so for a student without an account, or for messages only, the district asks us.

Retention comes first: we can’t carry out a request until the district’s retention period has run out on the newest message the student sent, and the district can shorten that period. A legal hold can delay it longer, as below. By then retention has usually cleared the messages, so what the account kind mostly adds is the account, the notes, and the athlete’s name on heat sheets and on results from meets set up in Hajos.

Erased messages stay in the thread with their text swapped for the word removed, so the conversation still reads in order. Erasure skips any message still waiting on a reviewer, whether it was flagged, held or blocked, so it keeps its text until the retention rules above remove it. Both kinds delete the other person’s notification copy of each erased direct message.

Both kinds also clear attendance notes marked while the student had an account. Erasing the account also removes coach notes and the reason a parent gave when asking to see the student’s conversation. A status, and any note stored with it, isn’t erased by either.

Competition times survive both. With the account kind, the athlete’s name comes off heat sheets and off results from meets set up in Hajos, wherever the swim is tied to their roster record. It also comes off school, pool and state record boards where the record came from those swims or their account. A lane a coach filled in by hand during a meet can still show it. It still shows on meet entries, a swimmer’s requests to enter events, results a coach uploaded without picking a Hajos meet, uploaded results files, a school’s relay records, records someone typed in by hand, and district, conference and meet record boards.

Both kinds delete files attached to erased messages, and the account kind also deletes the current profile photo. The request isn’t marked complete until those files are gone from current storage. An earlier profile photo can stay in storage, and so can uploads that were never sent. A file that a team document or another kept message also uses stays, and the request stays open. A request that includes a file whose stored address points at our storage from before the September 2026 move also stays open until we close it by hand. Erasing the account also deletes the notifications in KeepUp that name the student over a safety escalation, a concern about staff, a parent’s request to review a coach conversation, a block or a deactivation. One stays if a legal hold is placed on the account of the person who received it, even a hold that hasn’t started yet. The same goes for the other person’s copy of a direct message. The messages kind leaves those notifications, and emails already sent keep what they said. Entries on the KeepUp website’s Alerts page aren’t erased either. A parent’s request to review a coach conversation still shows the student’s name there, and a flagged message keeps the reason reviewers saw. The audit log’s record of a student’s concern about staff also keeps their name and note. What a student wrote when reporting someone else’s message in a team channel or group chat is removed from that message too. It stays if no reviewer had ruled on the message yet when the erasure ran, because the reviewer needs that explanation, or if a legal hold covers the conversation, even one that hasn’t started yet. It then stays until retention deletes the message or a later report replaces it. What a student wrote when reporting a direct message someone else sent always stays, until retention deletes the message or a later report replaces it. The sender can report a direct message too, and we don’t record which of the two wrote the explanation. We keep a permanent record that each erasure happened.

A legal hold beats retention and erasure. Messages, files, team documents and accounts under hold can’t be deleted by the retention schedule or erased, even when the district asks. A person can still deactivate their own account with Delete my account, and our support staff can deactivate one, but the records stay. A hold on someone else can stop a student’s erasure too, when they share a conversation, like a coach in a team channel the student wrote in. Then we can’t carry out any of the request until the hold is released. When a hold is on a team channel or group chat the student didn’t write in, even one that hasn’t started yet, erasure goes ahead. It leaves their reactions and report reasons there. A direct message conversation under a legal hold that the student is in stops the whole request, even if they never wrote in it.

A legal hold can be set to start on a later date. No screen offers that yet, so a district asks us. A hold set that way already stops a student’s erasure, a district’s exit and permanently deleting a team document it covers from the moment it is placed. Until it starts, the retention schedule and our other scheduled clean-ups go ahead as usual. A district administrator can release a hold before it starts, and the audit log records that it never took effect.

The Touchpad desktop app keeps the meets you download on that computer so a meet can run with no internet. They’re encrypted with the computer’s own secure storage. The app stops opening a meet 30 days after it was last downloaded, and opening a meet while online downloads it again. Signing out deletes them, and so does signing in as someone else.

Two cases skip that. A timing operator who joins with a run code never signs in or out, and a sign-in can simply run out. In both, the meets can stay on the computer, still encrypted, after the meet is over. A meet past its 30 days can’t be opened, even while it’s still there.

When a district ends its agreement with us, its data is returned or deleted the way that agreement says. Our tool for deleting a district removes its schools, teams, messages and rosters, the files attached to messages and uploaded results files. Files inside team documents, and school images like crests, banners and team emojis, stay in storage. The tool won’t run while a legal hold covers anything in the district or anyone in its records, wherever the hold was placed. It also won’t run while the district shares meets, championships, results, records or teams with another district, or while an account from outside it uses one of its school color themes, because it never deletes or changes another district’s data. In those cases we do the deleting by hand.

It keeps each person’s identity record, including name, birth date and student ID, and their account, because one Hajos account can span districts and products. An account left with no role or team anywhere else is deactivated. It also keeps the audit log, KeepUp notifications, including copies of messages, and state record boards and best times with the athlete’s name. Alerts in the phone app about flagged messages go with the messages. The audit log keeps its entry for each one, with the reason reviewers saw. Results that a school outside your district posted keep your athletes’ names too. If your agreement needs more removed than that, we do it by hand.

Turn push notifications off on your device any time.

Students can block other students on their team in the phone app, which stops direct messages between them. Group chats and team channels they already share aren’t affected, though neither can pick the other when starting a new chat. The athletic director is told, if the school has one on Hajos. Students can’t block coaches, staff or parents.

If your child’s coach or the athletic director makes your child uncomfortable, your child can raise a concern from their direct messages with that person in the phone app. Students can’t start a conversation with the athletic director, so for the athletic director this works only after they have messaged your child. It goes to the athletic director and school administrators, or to the district if the school has no one else, and the person it’s about gets no notification.

For any other adult on the team, like another parent, report the message or tell the athletic director.

Parents can ask to see a one-on-one conversation their child has with another student. See section 06.

Families can ask their school to restrict an athlete’s public listing, or ask us for a school not on Hajos. See section 05.

Want to see or fix what we hold about a student? Ask your school district. Those records are the district’s, and we help it answer. For your own details as a parent, coach, volunteer or guest coach, email us. A parent or coach can also ask their district administrator.

We’d rather tell you than have you find out. These are gaps between how Hajos is meant to work and how it works today. Each one is explained in the section it points to.

Erasure leaves any flagged, held or blocked message still waiting on a reviewer, with its text and files. A status isn’t erased either. What a student wrote when reporting someone else’s message stays with it if no reviewer had ruled on it yet or a legal hold covers it, and on a direct message someone else sent. See section 12.

When an erasure request includes a file whose stored address points at our storage from before the September 2026 move, it stays open until we close it by hand. See section 12.

A student account opened before we required a birth date may have none. We then go by graduation year, and for a senior, a graduate, or a student with neither on file, we treat them as 18 or older and a parent’s view stops until the school adds the date. See section 06.

Our support staff can also raise an erasure request, so raising one only when your district asks is our practice, not a lock in the software. See section 12.

Messages and team documents are deleted on schedule only when a school rolls its teams over to a new school year. A school that never rolls over keeps them until it does. See section 12.

Some staff screens aren’t in the audit log yet, like attendance history, the notes and statuses staff keep on athletes, and opening the review queue and alerts in the phone app. Nor are records we pull by hand at your district’s request, most working files staff download, or approving a parent’s request to see a conversation. Some setup in our support console isn’t logged either. Your district’s Audit Log screen doesn’t yet show some of what the log holds, like account changes we make, retention deletion runs and changes to an athlete’s directory restriction. See section 02.

The export screen doesn’t yet ask who the records are going to, so for now your district keeps that part itself. See section 07.

A restricted athlete’s name can still show where a swim or record was filed under a name that doesn’t match the roster, and always shows on sheets staff print to run a meet. See section 05.

A district administrator is allowed to restrict an athlete’s public listing, but that screen doesn’t open for them yet, and no screen offers it to our support staff either. See section 05.

The retention schedule doesn’t yet remove files embedded inside a team document, the notification copies of messages, or the Alerts page entry for a flagged message, which keeps the reason reviewers saw. See section 12.

Today the request button covers a student with an account on an active roster at your school, and it erases messages and the account together. For a parent, a coach, a student without an account or no longer on an active roster, or messages alone, the district asks us. See section 12.

When a parent is taken off the team, loses their link to the child, or has their account deactivated, the group chat’s membership isn’t changed. A parent the rule no longer allows is refused when they open it or post, and the group is put right only when someone leaves or tries to add a member. See section 06.

A parent’s view from the KeepUp website doesn’t notify the child. The child sees it only by tapping a notification from a phone view of the same conversation. See section 07.

The athletic director is told only when someone deletes their own account. They aren’t told when we can’t tie the person to a school, and someone with roles at more than one school is reported to one school’s athletic directors at most. See section 07.

Once an athlete without an account is off all of the school’s teams, staff can’t change their status in the app. A status set before our September 2026 update can also stay in an older database field after it’s fixed. See section 04.

Your phone’s own network cache no longer keeps anything private our servers send, but what it kept before that change stays until the phone clears it, even after you sign out. See section 01.

If we learn a student is under 13, erasing their records still waits out the district’s retention period, at least a year after their newest message. See section 09.

The under-13 check doesn’t look back at student accounts opened before September 2026. See section 09.

If we change how we handle data, we update this page and the date at the top. If it’s a big change, we tell schools directly.