Privacy Policy

Effective date: September 26, 2026.

Who we are

VolTrack is operated by VolTrack LLC, a New York limited liability company (“VolTrack”, “we”). We provide software for schools to track student service hours and related activities. This policy covers our marketing site and the VolTrack application. Contact: [email protected]; mail: VolTrack LLC, Fresh Meadows, NY.

Information we collect

• Account data: name, email, role, organization, and (for students) graduation year.
• Usage data: service-hour submissions, opportunity sign-ups, and activity within the app.
• Technical data: IP address, device/browser info, and log data for security and reliability.
• Marketing attribution: if you arrive from a link carrying UTM campaign parameters, we store the source, medium and campaign when an administrator creates an organization, submits a demo request, or joins the waitlist. Student and member accounts carry no marketing tags.
• Cookies: a session cookie to keep you signed in (essential), and — only with your consent — analytics and advertising cookies on our marketing pages. See “Cookies” below.

How we use information

To operate and secure the service, provide support, send transactional emails (e.g., verification, approvals, reminders), and improve the product. We do not sell personal information, and we do not use student data for advertising.

Cookies

Essential cookies are required to sign in and cannot be disabled. Analytics/marketing cookies (e.g., Google Analytics, Meta Pixel) load on our public marketing pages only after you accept via the cookie banner; declining keeps them off. They never load for signed-in users, and the authenticated app contains no advertising trackers. We honor your choice on every marketing page.

Sharing & service providers

We share data only with service providers who help us run VolTrack, under contract, and when required by law. Our current vendors, what each receives, and where it is processed are listed on our Subprocessors page:

• Hosting, database & file storage — Railway, Supabase.
• Transactional email — Resend.
• Payments — Stripe (card data never touches VolTrack).
• Error monitoring — Sentry.
• AI data-import assistant — Anthropic, only when an administrator uses the optional importer. It receives an uploaded file's column headers and shape-preserving placeholder values — never real names, IDs, emails, dates or notes — and does not train on it.
• Address lookup — Google Maps loads on the student opportunity map and address fields in the app; Google receives your IP address and browser information.
• Bot protection — Cloudflare Turnstile runs a bot check at signup and receives your IP address and browser signals.
• Content delivery — jsDelivr serves some front-end libraries (icons, charts) and receives your IP address.
• Marketing-page analytics & ads — Google Analytics and Meta Pixel, only with your consent (see “Cookies”).

Emails a school sends through our Communications feature contain a small tracking pixel so the school can see whether a message was opened.

We do not sell

We do not sell personal information. If we use advertising pixels on our marketing pages, they load only with your consent; you may withdraw it by clearing the cookie_consent cookie or via the banner. We do not use advertising trackers in the app or on student data.

Communications & messaging

When a school enables our Communications add-on, we send announcements, automated reminders, and messages on the school's behalf. Email is used for transactional and school-initiated messages. Text messaging (SMS) is currently unavailable. If we offer it in the future, texts will be sent only to recipients who opt in; for a student, texting will additionally require a verified parent/guardian's consent, and any recipient will be able to reply STOP to opt out at any time.

Case studies (de-identified aggregates)

Only if a school's administrator grants explicit, revocable consent, we may share a de-identified, rounded aggregate of that organization (a participation percentage and an approximate hours total) in case-study materials shown to other schools. This never includes individual student data, names, or exact figures, and aggregates for small cohorts are suppressed entirely. Consent is off by default and can be withdrawn at any time from the school's Participation page.

Your choices & rights

You can access, correct, export, or delete your account data — for student records, requests are handled through the school. Contact us anytime to exercise these rights.

Your California and other state privacy rights

• What we collect: identifiers (name, email, IP address); education information (service hours, graduation year, school); internet activity on our marketing pages; and, for school administrators, commercial information (plan and billing history).
• Sources: you, your school, and your browser or device.
• Purposes: providing, securing and supporting the service, billing, and (with consent) measuring our marketing.
• Recipients: service providers only, listed on our Subprocessors page.
• Sale and sharing: we do not sell personal information. “Sharing” for cross-context advertising is limited to the marketing-page pixels you consent to.
• Your rights: to know, delete and correct your information, to opt out of sharing, and not to be discriminated against for using these rights.
• How to ask: email [email protected]; for student records, contact your school, which directs us. We respond within 45 days. An authorized agent may submit a request for you with your signed permission; we may verify your identity first.
• Global Privacy Control: we honor Global Privacy Control signals as an opt-out of sharing on our marketing pages.
• Shine the Light (Cal. Civ. Code §1798.83): we do not share personal information with third parties for their direct marketing.
• Nevada: we do not sell covered information.

Children's privacy

VolTrack is provided to schools for their students. The operator is VolTrack LLC, [email protected], VolTrack LLC, Fresh Meadows, NY. We handle students' information as a service provider to the school and in line with applicable laws (including FERPA and, where relevant, COPPA). For students under 13, VolTrack relies on the school to provide consent on behalf of parents under COPPA's school-consent exception; schools remain responsible for any additional parental consent their own policies require. K-8 students cannot self-register: they are added only by their school, through a roster import or a school-issued invite. Parents may review, request deletion of, or refuse further collection of their child's information through the school or by contacting us. We do not condition a child's participation on disclosing more information than is reasonably necessary, and we use student data only to provide the service to the school — never for advertising.

Security & retention

We use encryption in transit, hashed passwords, optional two-factor authentication, role-based access, and tenant isolation. We keep each kind of data only as long as our retention schedule allows; education records are kept for the duration of the school's subscription and permanently deleted 60 days after a paid subscription ends (administrators are notified with an export link when the countdown starts), within 30 days of account deletion or a school's written request, or, for organizations on the free plan, 60 days after 12 months with no administrator sign-in (administrators are emailed first, and signing in cancels the deletion), except where a longer period is required by law. We will notify the affected school within 72 hours of confirming a security breach involving its data, and no later than any period required by law (including the 7-day requirement of New York Education Law §2-d where it applies).

Changes & contact

We'll post updates here with a new “last updated” date. Questions: [email protected] · VolTrack LLC, VolTrack LLC, Fresh Meadows, NY.