For a school's IT department
Where the student photos go:
nowhere.
A page you can forward as-is to a school's IT department: what the five ClassPhoto Suite apps send, what they never read, and how to verify all of it yourself instead of taking our word for it.
The short statement
What to tell the school.
Every ClassPhoto Suite app runs entirely in your web browser. Student photos and roster files are read on your own computer and never uploaded anywhere. The only outside connection any app makes is to check a license key, and it sends the key, never a photo or a student's name. You can verify all of this yourself, from the app's own response headers, without taking our word for it.
What actually goes out
What the apps send.
The one thing an app sends anywhere is your license key, to api.lemonsqueezy.com, to confirm it is still valid. A trial key, the one behind "Try the sample," sends nothing at all. Each app's pages load their fonts from Google Fonts, and that request carries a font file, never any student data. None of the five apps run analytics of their own.
The marketing site you are reading right now, classphoto.net, is a separate thing from the apps. It does use Google Analytics and Lemon Squeezy's checkout pages, but neither of those ever sees a student's photo or name, because neither one runs inside the apps that touch them.
The only copy
What stays on the computer.
Photos and rosters are read into that browser's memory on that one machine, and nowhere else. ClassPhoto autosaves your project as you work, with a visible banner if a save fails, and ClassPhoto IDs and the Principal's Book keep a project between visits the same way, all inside that browser's own storage. ServiceStix and List Fixer do not autosave a project between visits; either way, nothing is ever written anywhere but that machine. Clearing that browser's site data removes whatever was stored there. No copy exists anywhere else, because nothing was ever sent anywhere else to make one.
By design
What is never read.
The Principal's Book never reads addresses, phone numbers, birthdays, guardian names or medical fields. They are not mapped, not stored and not exported, by design, not merely left off the printed page.
List Fixer's output is built to exactly the column set GotPhoto's names list uses: name, identifier, group, teacher, an expiry date, and a parent's email and phone. Whatever else a school's spreadsheet happens to include has no field to land in, so it does not reach that file. Date of birth, home address, medical, lunch status, IEP/504, gender, race/ethnicity, discipline, logins and internal notes are listed as not exported on its mapping screen; they reach a file only if someone switches them on.
Do not take our word for it
How to verify it yourself.
Open any app's page, open your browser's developer tools, and watch the Network panel while you import a zip and export a file. You will see the license check to Lemon Squeezy and nothing else: no request carrying a photo or a name ever leaves the page.
The same claim is enforced by the app's Content Security Policy, in the connect-src line of its response headers: connect-src 'self' https://api.lemonsqueezy.com. That line is the complete list of addresses the page is allowed to contact at all, itself and Lemon Squeezy, and a browser refuses any other outbound connection on its own, whether or not anyone is watching. That is what makes this a claim you can check, rather than a promise you have to accept.
Why it matters
Why this matters to a school.
Because nothing is uploaded, there is no vendor copy of student photos or records anywhere for a school to govern, request deleted, or worry about in a breach. The only copy that exists is the one on the photographer's own computer, the same as it always was before any of this software existed. This is a statement about how the software behaves, not legal advice, and it does not replace whatever agreement a school already has with its photographer about student images.
FAQ
Privacy questions.
Is this legal advice?
No. This page describes what the software does and how to verify it. It is not a substitute for whatever contract or agreement a school already has with its photographer, and it is not written by a lawyer on the school's behalf.
Does this apply to classphoto.net itself, or just the apps?
Just the apps: ClassPhoto, ServiceStix, ClassPhoto IDs, the Principal's Book and List Fixer, the software that actually touches student photos and rosters. This marketing site, classphoto.net, uses ordinary Google Analytics and Lemon Squeezy's checkout, the same as most small business sites, but it never handles a student photo or roster.
Does the free trial send anything?
No. A trial license ("Try the sample") is checked entirely on your own computer and sends nothing anywhere. Only a paid license key is sent to Lemon Squeezy, to confirm it is valid. See for yourself: open the sample mode and watch the Network panel while you use it.
Can I forward this page to our IT department?
Yes. That is exactly what it is for. If they have a follow-up question this page does not answer, write to us and a real person will answer it.
If nothing is backed up anywhere else, can I lose my work?
Yes, if you clear that browser's site data or switch computers without exporting first. The privacy this page describes is a direct trade for that: the only copy of anything is the one you control, which means you are also the only one responsible for keeping it.
More questions are answered in the main FAQ, or write to us and a real person will answer.