Privacy policy

Who operates Hallway Hero

Hallway Hero is operated by Andrew Hall in Florida, United States. Contact hello@hallwayhero.app for privacy, security, support, or school agreement requests. This notice applies to the public website and the classroom service.

Information in the service

Adults provide account email, display name, classroom and school details, authentication credentials, and account settings. The service keeps account, security, email-delivery, billing, and administrative activity records needed to operate it.

Authorized educators supply student short names, stable internal student identifiers, optional school student numbers, class membership, and classroom settings. Hall-pass records include destinations, queue and request activity, departure and return times, and reporting history. Private classroom settings can reveal sensitive information in context; do not enter diagnoses, medical explanations, or unnecessary personal details.

Why information is used

Student records are used to manage authorized classroom hall passes, show current availability, produce school-authorized reports, protect access, and support the service. Adult account information is also used for account communications, subscription administration, and fraud prevention.

Hallway Hero does not sell student information, use it for advertising, or build unrelated student profiles. Student information must not be submitted for unrelated commercial purposes. Students do not create customer accounts or accept these terms at the kiosk.

Who can access information

Teachers access their authorized classrooms. Authorized school administrators can access school reporting. The service operator may access information for support, security, recovery, or administration; owner troubleshooting access is controlled and recorded. Schools are responsible for the adults they authorize and the visibility of classroom screens and shared viewer links.

Service providers process limited information for hosting operations, adult payments, account email, registration protection, and any separately enabled public visitor measurement. See the subprocessors page for the scope and deployment-dependent details. Disclosure may also be necessary to comply with applicable legal obligations or protect people and the service.

Cookies and website measurement

Session cookies support sign-in and service security. Registration may use Cloudflare Turnstile to deter automated abuse. Optional Cloudflare Web Analytics is limited to clean public marketing and policy URLs when the operator enables it. It is not intended for account, classroom, kiosk, report, or token-bearing pages. No advertising pixels, session replay, or student intent tracking are part of this service.

Public measurement is optional and depends on the deployment. Contact the operator to confirm whether it is enabled.

Retention, exports, and deletion

Authorized educators control classroom records through the service's retention, export, and deletion tools. Retention varies with classroom settings and record type. Adult account, payment, security, and audit records may need separate retention for service administration and legal obligations. Ask the operator for the settings and retention applicable to your school before importing records.

Deleting active records does not immediately remove older backup generations. Backup expiry follows the operator's configured retention and recovery process. Do not assume a universal deletion deadline, independently verified offsite copy, or proven recovery interval from this notice. Exported files and printed reports are under the recipient's control and need appropriate protection.

Security and recovery

The service uses role-based access, restricted student-facing projections, protected sessions, and password and PIN hashing. Encryption of a password is different from encryption of stored student records. Storage encryption, recovery keys, and offsite backup verification depend on deployment configuration and operator checks. No claim of verified full-database encryption, end-to-end encryption, or guaranteed recovery is made here.

Report suspected unauthorized access to hello@hallwayhero.app. The operator will investigate and coordinate with the affected school and applicable legal requirements. This notice does not promise a particular response deadline or certify compliance.

School and family requests

Schools determine the authorized educational purpose and applicable notices or permissions. A teacher checkbox does not replace district approval or a required agreement. Families and students should normally request access, correction, export, or deletion through their school so authority can be verified. The operator can help the school fulfill appropriate requests without disclosing records to an unverified requester.

Changes and contact

Policy versions and adult acknowledgments are recorded. Material changes are communicated through the account notice process or direct school communication as appropriate. Historical versions remain available through the version link on this page. Contact hello@hallwayhero.app with questions or to request a school-specific agreement.