Privacy Policy

Who we are

PTO Kit is a set of free tools and paid software for parent groups — PTOs, PTAs, PTSOs and booster clubs. It is operated by Talent Bottle, Inc.. Where this policy says “we”, that is who it means.

This policy covers the PTO Kit website and every tool and product on it.

What we collect

It depends entirely on which part you are using, so we have split it that way rather than giving you one list that is true of nobody.

The free tools, if you never make an account

Most of what is on this site — the Budget Builder, the Handoff Binder, the Bylaws Builder, the Staff Favorites Collector and the rest — works with no account at all. You fill something in, and we give you a private link to come back to.

• What you typed into the tool. Your PTO's name, your budget lines, your bylaws answers, whatever the tool asked for. We store it so your link works.
• An email address, but only if you asked for your link by email. We use it to send you that link.
• That is all. There is no account, no password and no profile. We do not know who you are, and anyone holding the link can see what is behind it — so treat it like a door key.

If you subscribe to the newsletter

Your email address, and optionally your school name and your role, so the newsletter can be about the job you actually have. Every issue has an unsubscribe link and it works immediately.

If you create an account for a paid product

• You: your name, your email address and a password, which we store only as a one-way hash and cannot read. We also keep when you were last in your workspace — to the hour, not what you clicked.
• Your organization: its name, type, timezone, billing email, and the logo you upload if you upload one. And how you found us: the page of ours you arrived on and the site that sent you there, kept when you create an account. Never the address of a private link, and nothing if you never sign up.
• Billing: handled by Stripe. Card numbers go from your browser to Stripe and never touch our servers. We keep the fact that you have a subscription and when it renews.

What your organization puts into a product

This is the part that matters most, and the part we hold on your behalf rather than for ourselves. Depending on which products you use, it can include staff names and school email addresses, mini-grant requests and the receipts attached to them, lost-property descriptions and photographs, messages between a PTO and a teacher or a family, and alumni contact details.

Your organization decides what goes in. We hold it, keep it working, and delete it when you ask. We do not mine it and do not use it to train anything. To run the service we look at counts and totals — how many requests a program has had, how much of its budget is committed — and never at the requests, receipts, names or messages themselves, unless you ask us to help with a specific problem. We keep a record of each time one of us opens a workspace's summary.

Usage counts

We keep a count of how often each tool gets used — literally an event name such as budget.started and the time it happened. There is no IP address in it, no browser fingerprint, no cookie, no session identifier, and nothing that could be traced back to a person or a device. It tells us which tools are worth continuing to build and nothing else.

Analytics

We use Google Analytics to see how many people visit and which pages they read. It is the only third-party script on this site. It loads when you visit, and you can turn it off for your browser from the cookie page, after which nothing is sent to Google.

While it is on, Google receives:

• The kind of page you viewed, not its address. We send the shape of the address — /c/{collection}, say — and never the address itself, so a private link, a record number or a school's name in an address stays on this site.
• What you clicked and scrolled, the time, your browser and device, and the site you arrived from.
• An approximate location. Your browser contacts Google directly, so Google sees your IP address the way any site you visit does, and works out a rough location from it. Google states that Analytics does not store the IP address.
• A random number kept in two cookies, so that two page views by the same browser are counted as one visitor. The cookie page lists them.

We do not send Google your name, your email address, or anything you type into a form, and we have switched off the parts of Google Analytics that feed advertising (Google signals and ad personalisation).

Analytics does not run on the pages built for students to play on, on a display screen — the Spirit Screen TV and the lost-and-found lobby display — or in a document you print or download.

What we do not do

• No analytics beyond counting visits. Google Analytics, described above, is the only one. There is no Meta pixel, no Hotjar, no session recording, no heatmaps.
• No advertising, and no ad networks.
• No selling or renting personal information, and no “sharing” it for cross-context behavioural advertising as California defines that term.
• No IP address logging. Your IP is used in memory to rate-limit abusive traffic and is not written to our database.
• No advertising profile. The parts of Google Analytics that tie a visit to advertising are switched off, and nothing else on this site reports to an ad network. The typeface is served by Bunny Fonts, which logs no IP addresses.

Children

PTO Kit is built for adult volunteers and school staff. It is not directed to children, and we do not knowingly collect personal information from a child.

The product's design does most of this work rather than a promise doing it:

• Students never have accounts. Neither do teachers — a teacher reaches their mini-grants page through a private link precisely so that no child or staff member has to create a login to take part.
• Where information about a child can appear — a lost-property claim naming the child whose coat it is, a thank-you story about a classroom, a receipt for a field trip — it is entered by an adult, is visible only to that organization, and is covered by the controls below.
• Photographs of lost property are stripped of metadata on upload, so a phone photo taken at home does not carry its GPS coordinates into our database, and they are deleted automatically on a schedule the school sets.
• Nothing about an individual's grant is ever published. A public impact page can name a teacher who agreed to be named, but never the amount they received.

If you believe a child's information has reached us and should not have, write to nirav@talentbottle.com and we will delete it.

Schools, FERPA and student records

A PTO is usually an independent nonprofit and not part of the school district, even though it works alongside one. PTO Kit is a service for that parent group. We are not a school official, we are not acting under a school's direct control, and this product is not designed to hold student education records.

If your district needs a vendor agreement, a data processing addendum, or answers to a security review before your PTO can use this, write to us and we will work through it with you.

Your organization's data, and who decides about it

For an organization's own product data, your organization decides what is collected and why; we process it on your instructions. In data-protection language, you are the controller and we are the processor. For your account and billing details, and for this website, we decide, and so we are the controller.

We do not have a use for your data beyond running the product for you. When your subscription ends, you can export what is yours, and we delete it on request.

Who else can see it

We share personal information with the companies below, only so far as they need it to do their job for us, and never for their own purposes.

Who	What they do	What they can see	Where
Stripe	Takes the payment when an organization subscribes.	Billing name, email and card details. Card numbers go straight to Stripe and never reach our servers.	United States
Our hosting provider	Runs the servers and the database.	Everything stored in the product, at rest.	United States
Our email provider	Delivers the emails the product sends — a teacher’s link, a decision, a receipt reminder.	Recipient addresses and the contents of those emails.	United States
Google (Google Analytics)	Counts visits to the site.	Which kind of page was viewed and when, what was clicked, the browser and device, an approximate location Google works out from the IP address, and a random number kept in a cookie. We do not send it a name, an email address, the address of a private link, or anything typed into a form.	United States
Bunny Fonts	Serves the typeface. Chosen instead of Google Fonts specifically because it does not log IP addresses or set cookies.	Nothing that identifies a visitor.	European Union

Beyond that, we disclose personal information only if the law requires it, and we will tell you before we do unless we are forbidden from telling you. If Talent Bottle, Inc. were ever sold or merged, your data would move with the product and this policy would travel with it; we would tell you first.

How long we keep it

• Anonymous tool documents: for as long as the link is useful to you. Delete one yourself whenever you like, from its own page.
• Newsletter: until you unsubscribe.
• Accounts and organization data: while the account is open, and then for a short wind-down period so an accidental cancellation is recoverable. Delete it sooner by asking.
• Lost-property photographs and claimant contact details: deleted automatically on the schedule your school sets, because a bin of unclaimed coats should not become a permanent record of which families lost what.
• Financial records — what a grant paid, and to whom — are kept for the school year and its history, because that is the point of a ledger a treasurer can be audited against.
• Usage counts are not personal information and are kept indefinitely.
• Analytics is held by Google for up to 14 months.

How it is protected

• Everything travels over HTTPS.
• Passwords are stored only as salted one-way hashes. Nobody here can read yours.
• Receipts and lost-property photographs are held on private storage and served only by code that checks who is asking. They have no public URL.
• Photo metadata, including GPS coordinates, is stripped on upload.
• Private links use long random tokens. They do not expire by design — that is what makes them work for a teacher — so treat one like a key, and ask us to reissue if one goes astray.
• Each organization's data is isolated from every other organization's.

No system is perfect. If you find a security problem, please tell us at nirav@talentbottle.com before telling anyone else, and we will work with you.

Deleting something you made, yourself

Every free tool on this site has a “Delete it and everything in it” link on its own page — the one you reach through your private link. Use it and the record is gone from our database immediately, along with anything inside it: a Favorites collection takes every staff member's answers with it, a Sponsorship Kit takes its sponsor list. Every link you shared stops working at once. We keep no copy.

Backups roll off within 30 days and nobody goes looking in them. If you need that confirmed in writing for a school board, ask us.

Lost the link? Email nirav@talentbottle.com from the address you used and we will find it and delete it for you.

Your rights

Different laws give different people different rights. Rather than make you work out which ones apply to you, we offer all of them to everybody:

• Know what we hold about you and why.
• Get a copy of it, in a format you can use elsewhere.
• Correct anything wrong.
• Delete it.
• Object to, or restrict, a particular use.
• Be treated the same either way. Asking will never get you a worse service or a higher price.

Email nirav@talentbottle.com from the address in question and say what you want. We aim to answer within a week and will not take longer than 45 days. We may need to check you are who you say you are, and for data an organization put in, we will point you to that organization, because it is theirs and not ours to hand over.

If you are in California

We do not sell personal information and do not share it for cross-context behavioural advertising, including for anyone under 16. We do not use it for automated decision-making or profiling. The rights above are the ones the CCPA gives you, and you may use an authorised agent.

If you are in the UK, EU or EEA

We rely on your consent for the newsletter, on performance of a contract to run an account you pay for, and on legitimate interests to keep the site working and safe. You may withdraw consent at any time and complain to your data protection authority. Our servers are in the United States; where we transfer personal data out of the UK or EEA, we do it under Standard Contractual Clauses.

Cookies

We set three that are strictly necessary. Google Analytics adds two more when you visit. The cookie page lists every one, what it does, and how to turn analytics off.

Changes to this policy

When we change something that matters, we will change the date at the top of this page and — for anything that materially affects you — email account holders before it takes effect. We will not quietly broaden what we do with your data and leave you to notice.

Contact

Write to nirav@talentbottle.com. A person reads it.