Privacy Policy

1. Introduction

This Privacy Policy describes how 25 Alpha LLC (“Company,” “we,” “us,” or “our”) collects, uses, and discloses information in connection with NoteVUE (the “Platform”), a national K-12 teacher appreciation platform accessible at notevue.ai. This Policy applies to all visitors, students, teachers, and other users of the Platform.

We designed NoteVUE with student privacy as a first principle. Students do not need to create accounts, supply their names, ages, or any personally identifying information to use the Platform. The architecture of our system deliberately prevents the accumulation of student personal data.

By accessing or using NoteVUE, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Platform. This Policy may be updated from time to time; material changes will be communicated via notice on the Platform and, for registered teachers, via email to the address on file.

2. Information We Collect

From Students

NoteVUE does not collect any personally identifiable information from students. No account creation is required, and we do not ask for a student’s name, email address, age, grade level, school enrollment status, or any other identifier that could be linked to a specific child. Students interact with the Platform purely anonymously.

To enable rate limiting and prevent spam or abuse, we assign a temporary, randomly generated session identifier to each browser session. This session hash is cryptographically derived and is not linked to any individual. It contains no personal information and cannot be reverse-engineered to identify a user. Session hashes are automatically purged from our systems after 90 days.

From Teachers

Teachers may voluntarily provide personal information when they choose to claim their appreciation wall. This information includes: full name (as they wish it to appear on the Platform), professional email address (used only to deliver a one-time magic link for authentication and subsequent notifications), school affiliation, and optionally their subject area or grade level. Teachers are never required to claim their wall; doing so is entirely voluntary.

Once a teacher claims their wall, their name and school affiliation become publicly associated with their wall page. Their email address is never displayed publicly and is used solely for authentication and platform-related communications.

Automatically Collected Information

When you visit NoteVUE, our servers and third-party service providers automatically collect certain technical information, including: Internet Protocol (IP) address, browser type and version, operating system, pages viewed, time spent on pages, and referral URLs. IP addresses are hashed immediately upon receipt using a one-way cryptographic function; the raw IP address is never stored in our database. Hashed IP data is purged after 30 days.

We use Google Analytics 4 in aggregate-only mode. We do not use Google Analytics features that collect user-level data, and we have configured the service to anonymize IP addresses, disable advertising signals, and disable ad personalization. Analytics data is used solely to understand overall traffic patterns and improve the Platform.

3. COPPA Compliance

The Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, imposes requirements on operators of websites and online services directed to children under 13 years of age. NoteVUE is designed to allow use by students of all ages, including children under 13, without collecting personal information from them.

We do not knowingly collect, use, or disclose personal information from children under 13. No account creation is required for students, no persistent tracking of individual students occurs, and no behavioral profiling of students is performed. Because we do not collect personal information from children under 13, no verifiable parental consent mechanism is required for students to use the Platform’s core features.

If a parent or guardian believes that a child under 13 has inadvertently submitted personal information through the Platform, they should contact us immediately at info@25alpha.ai. We will investigate and promptly delete any such information from our systems.

Schools and districts that deploy NoteVUE as part of a school-sponsored activity should review this Policy and consult with their legal counsel regarding any additional obligations under COPPA or applicable state law.

4. FERPA Compliance

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, protects the privacy of student education records. NoteVUE does not create, receive, or maintain “education records” as that term is defined by FERPA. No information submitted through the Platform connects a note of appreciation to a specific, identifiable student.

Because the notes on NoteVUE are fully anonymous—with no mechanism to link a note to a particular student—they do not constitute education records under FERPA. Schools are not required to enter into a formal agreement, data sharing arrangement, or memorandum of understanding with 25 Alpha LLC as a condition of students using NoteVUE. Teachers interact with NoteVUE voluntarily and independently, not as a mandatory school activity.

However, we recognize that some school districts may have broader privacy policies that govern any technology used on school networks. We encourage teachers and administrators to consult with their district’s technology or privacy officer prior to school-wide adoption.

5. How We Use Information

• Platform operation: To display teacher appreciation walls, process and deliver notes, and maintain the leaderboard rankings.
• Authentication: To deliver one-time magic links to teachers who claim their walls and to maintain authenticated teacher sessions.
• Teacher notifications: To notify teachers, at their election, when new notes are added to their wall.
• Content moderation: To automatically screen notes for harmful, harassing, or inappropriate content before they are published on a teacher’s wall.
• Analytics and improvement: To understand aggregate usage patterns, identify technical issues, and improve the Platform’s features and performance.
• Legal compliance: To comply with applicable law, respond to legal process, and protect the rights, property, and safety of 25 Alpha LLC, its users, and the public.

We do not use any information collected through NoteVUE for advertising, behavioral profiling, or sale of data. Teacher email addresses are not used for marketing without explicit opt-in consent.

6. Data Sharing and Third-Party Services

We do not sell, rent, or trade personal information. We share data only with the following categories of service providers who process it strictly on our behalf and subject to confidentiality obligations:

• Neon (database): Our primary serverless PostgreSQL database provider. Teacher account data and anonymized note content are stored in Neon’s infrastructure. Neon encrypts data at rest and in transit.
• Upstash (rate limiting): Used to enforce rate limits on note submissions and API requests. Only hashed session identifiers and request counts are processed.
• Resend (email delivery): Used to deliver transactional emails such as magic links and wall notification emails to teachers. Teacher email addresses are shared with Resend solely for delivery.
• Anthropic (AI generation): Appreciation note content is generated using Anthropic’s Claude API. The prompt content includes the selected vibe and any optional personal addition provided by the student, but does not include any student identifiers. Anthropic processes this data subject to its own privacy policy and API terms.
• Google Analytics: Aggregate, anonymized usage data is transmitted to Google Analytics 4 as described in Section 2. No personal student data is transmitted.
• Vercel (hosting and deployment): The Platform is hosted on Vercel’s infrastructure. Vercel receives standard server request logs, including hashed IP addresses, as part of normal hosting operations.
• Sentry (error monitoring): Application errors are reported to Sentry for debugging. Sentry receives technical error context; we configure Sentry to scrub personally identifying fields from error payloads.

We may also disclose information when required by law, court order, or other governmental authority, or when we believe disclosure is necessary to protect the rights, property, or safety of 25 Alpha LLC, the Platform’s users, or the general public.

7. Data Retention

• Teacher account data (name, email, school, wall settings) is retained while the teacher’s account is active and for two years after account deletion, after which it is permanently purged, unless earlier deletion is requested.
• Anonymous appreciation notes are retained indefinitely on the teacher’s wall as part of the public record of appreciation. Because notes contain no student personal information, their retention does not implicate student privacy rights.
• Student session hashes are purged automatically after 90 days from the date of creation.
• Hashed IP addresses are purged from server logs and rate-limiting stores after 30 days.
• Authentication tokens (magic links) expire after 24 hours and are deleted upon use or expiration, whichever comes first.

8. Security

We implement technical and organizational safeguards appropriate to the nature and sensitivity of the information we process. These include:

• Transport Layer Security (TLS 1.3) for all data in transit between users and the Platform.
• Encryption at rest for database contents via Neon’s managed infrastructure.
• Rate limiting on all note submission and API endpoints to prevent abuse and denial-of-service attempts.
• Automated content moderation to screen all submitted notes before publication.
• Access controls limiting database and infrastructure access to authorized personnel only.
• Regular dependency updates and security patch application.

No system is perfectly secure. While we work diligently to protect user information, we cannot guarantee that unauthorized access, disclosure, alteration, or destruction of data will never occur. In the event of a security incident affecting personal information, we will notify affected users as required by applicable law.

9. Your Rights

For teachers: You may request deletion of your account and all associated personal information at any time by contacting us at info@25alpha.ai. We will process deletion requests within 10 business days. Note that anonymous appreciation notes submitted by students are not considered your personal information and may be retained separately.

For parents and guardians: If you believe your child under 13 has submitted personal information through the Platform, contact us at info@25alpha.ai and we will investigate and delete any such information promptly.

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Because NoteVUE does not sell personal information and does not process significant quantities of personal data for commercial purposes beyond platform operation, many CPRA requirements do not apply. Nonetheless, California residents may contact us at info@25alpha.ai with any privacy inquiries.

State-specific student privacy laws: Several states have enacted student online personal information protection laws (e.g., SOPIPA-style statutes) that place additional restrictions on educational technology providers. We are committed to complying with applicable state law and will work with school districts to address any state-specific requirements.

10. Contact Information

For questions, concerns, or requests related to this Privacy Policy or NoteVUE’s data practices, please contact:

We will respond to privacy-related inquiries within 10 business days. For urgent matters involving potential harm to minors, please mark your email “URGENT — Child Safety” and we will prioritize your request.