Privacy Policy

ShortHand is a documentation tool for teachers. When you create an account, you are the user. Student data, parent or guardian contact information, and any IEP, 504, RTI, or other accommodation information you enter is entered by you, the teacher, and is stored under your account only. Students do not create ShortHand accounts.

Your account: Your email address and, if you use email sign-in, your password (managed securely by Supabase Auth). ShortHand also supports Google sign-in and Sign in with Apple. Sign in with Apple is available in the native iOS app and may provide an Apple Private Email Relay address instead of your personal email. We store your name when Google, Apple, or your profile provides it.

Billing and subscription information: If you buy ShortHand Pro or another paid feature on the website, Stripe processes the payment. We do not store your card details ourselves. We store subscription or entitlement status and Stripe's reference IDs for your account. The native iOS app offers ShortHand Pro as an optional subscription through Apple's in-app purchase system. Apple processes that payment, and we do not receive your card details. We use RevenueCat to confirm the status of an Apple subscription. RevenueCat receives your ShortHand account ID, details of the Apple purchase such as the product and its renewal date, and basic technical information about the app and device. We do not send RevenueCat student records, notes, or parent information. We store the resulting subscription status with your account. A Pro subscription bought on the web will also work in the iOS app.

Student data you enter: Information you type or import about your students, which may include names, class periods, notes, behavior tags, goals, attendance, shoutouts, birthday information, calendar-related data, photo URLs, and parent communication logs.

Parent and guardian contact data: Parent or guardian names, email addresses, and phone numbers, when you enter or import them so you can use parent-communication features.

Disability-related and special-education information: If you enter IEP, 504, RTI, or other accommodation information, that is stored with the student record. This can include disability-related information you choose to record for your own teaching and documentation.

Google Classroom (optional): If you connect Google Classroom, we access your course list and student names, emails, and profile photos to help you import your roster. We store a token to keep you connected. You can disconnect at any time.

Optional website emails: If you leave your email on getshorthandapp.com to request a resource or restore a purchase, we store that email to send what you asked for.

AI features: Some features use AI to help with tagging, drafting, summaries, import, and similar tasks. See the “How ShortHand Uses AI” section below for full details.

Some ShortHand features can send the information needed for that request to third-party AI providers. ShortHand uses OpenAI as the primary provider. If an OpenAI request fails, is rate limited, or times out, the same request goes to Groq, an approved fallback. Both providers are configured so your data is not used to train their models.

What may be sent depends on the feature you use. That can include notes, first names, and other content needed for the selected feature. Roster and birthday imports send the text you paste, which can include full student names and parent or guardian names, email addresses, and phone numbers. Anything you type into a note, including accommodation or goal details, is part of that note's text. ShortHand does not limit AI input to first names only.

Automatic tagging. When you save a note without choosing tags yourself, ShortHand sends that note's text to the AI provider in the background so it can suggest tags. This happens for each such note unless you are offline.

Voice dictation on the web. If you tap the microphone in the web app, your browser's built-in speech recognition turns your speech into text. Depending on your browser, the audio may be processed by the browser maker, such as Google or Apple, and not by ShortHand. ShortHand receives only the resulting text, which is then handled like a typed note.

In the native iOS app, AI consent is explicit and fails closed. Before AI data is shared, ShortHand asks for your permission and names the providers. If you decline, that request is not sent. You can withdraw consent later in Settings, and no further AI requests are sent until you allow them again. If the approved providers are unavailable, the AI request is not sent to another unapproved provider.

We never send student or parent data to AI for advertising, and we don't sell your data.

The ShortHand website and the web app at app.getshorthandapp.com use Google Analytics (GA4) and Vercel Analytics to understand how pages and features are used. The web app also uses Sentry for crash reporting, and first-party usage analytics and marketing attribution so we can see which features are used and how people found ShortHand. These tools may use cookies or similar identifiers. They are used to operate and improve the service, not to advertise to students or parents.

PostHog, on the public website only. The public website at getshorthandapp.com also uses PostHog for website analytics and session replay. Session replay records how a visit to the website looks and moves (page layout, clicks, and scrolling) so we can find and fix confusing pages. PostHog is not used inside the ShortHand app at app.getshorthandapp.com or in the native iOS app, so it does not record your classroom records, student notes, or parent communications.

Session replay is set up to hide what you enter. Anything typed into a form field is masked on every page of the website. On the free tool pages (the report card comment generator, the report card comment library, the back-to-school toolkit, and the tools pages such as the parent communication log), all on-screen text is masked as well, so a student name you type there is not readable in a recording. On other pages, the public page text is recorded as it appears. We do not send your name or email address to PostHog to identify you. PostHog does receive standard technical information such as your IP address, browser, device type, and the pages you view, and it stores an identifier in your browser to recognize a returning visit. PostHog also records when a visitor takes one of a few actions on the website: following a link to the ShortHand app or its app store listing, downloading a free PDF, finishing a free tool, copying a free tool's result or a free prompt, copying an example from a blog post, pausing on a suggestion to try ShortHand inside a blog post, or interacting with the sample Quick Grid demo, including starting or completing a practice note or following its links. The demo uses fictional students, and practice notes are not saved. These records note which tool, file, link, or kind of example was involved, and never include anything that was typed, generated, or copied. We sometimes show two versions of a page, or of part of one, to different visitors, chosen at random, to learn which one is clearer. When we do, PostHog records which version your browser was shown and whether it appeared on your screen, using the same browser identifier described above. For the home page, the version is picked on your first visit and remembered in a small cookie, so you see the same one each time.

These analytics and crash-reporting systems are web behavior. They are not used in the native iOS app. See the next section.

ShortHand is available as a native iOS app on the App Store and as the web app at app.getshorthandapp.com.

The native iOS app stores the same classroom and account data you enter, but it is set up more tightly than the web app:

Google Analytics, Vercel Analytics, Sentry, and first-party usage analytics and attribution are turned off.

The app does not write presence records or AI token-usage records.

The in-app voice dictation controls are hidden.

There is no advertising SDK, no Identifier for Advertisers (IDFA) tracking, no location collection, no access to device contacts, and no access to the iOS photo library.

The only in-app purchase is the optional ShortHand Pro subscription, sold through Apple's in-app purchase system. Subscription status from the web is also read, so Pro features you already have continue to work.

ShortHand does not use data for advertising tracking on iOS or anywhere else.

We do not sell your data or student data to anyone. Ever.

We do not use student data for advertising.

We do not use data for advertising tracking, including IDFA-based tracking.

We only share data with service providers when needed to operate ShortHand, provide requested features, or maintain the service.

No other teacher can access your students' information. As the operator, I can access the database directly if needed for support, but I will never do so without your request.

All student data is stored on Supabase, which is SOC 2 Type II certified and encrypts all data at rest with AES-256.

All data is stored with Row Level Security (RLS) enabled, meaning every query is scoped to your account only: no other teacher can see your data. As the operator, I technically have access to the database, but I commit to never looking at your data unless you ask me to (for example, to help fix a problem).

All communication between the app and our servers uses HTTPS encryption.

API endpoints that read or write your account data require authentication. Your session token is verified on every request. The free public tools on getshorthandapp.com do not require an account and are rate limited instead.

You can delete all your data at any time from within the app (Settings → Danger Zone → Factory Wipe).

You can permanently delete your account, your notes, and your student data from within the app (Settings → Danger Zone → Delete My Account). Billing and subscription records may be retained after deletion where needed for accounting, disputes, fraud prevention, or legal compliance; see our account deletion page for details.

An Apple subscription is managed by Apple. Deleting your ShortHand account does not cancel it. You can cancel in your Apple ID settings.

You can export a copy of all your data at any time (Settings → Your Data → Export My Data).

In the native iOS app, you can turn AI features off in Settings. After you turn them off, ShortHand does not send further AI requests until you allow them again.

You can disconnect Google Classroom at any time, which removes your stored Google tokens.

If you cannot sign in to the app, you can also request account deletion by emailing info@getshorthandapp.com from the email address associated with your ShortHand account. For account security, we may ask you for additional verification before processing the deletion. See all account deletion options →

ShortHand uses the following third-party services to operate:

Supabase: database and authentication (privacy policy)
Stripe: payment processing for web purchases and Pro subscriptions (privacy policy)
OpenAI: primary AI language model processing (privacy policy)
Groq: fallback AI language model processing, used if an OpenAI request fails (privacy policy)
Vercel: hosting, and web analytics on the website and web app (privacy policy)
Google: Google sign-in and optional Google Classroom integration (privacy policy)
Apple: Sign in with Apple in the native iOS app, including Apple Private Email Relay when you hide your email, and payment processing for in-app subscriptions (privacy policy)
RevenueCat: confirms Apple subscription status for the native iOS app. Receives your ShortHand account ID and Apple purchase details, not student records (privacy policy)
Google Analytics: website and web-app analytics. Not used in the native iOS app (privacy policy)
PostHog: website analytics and session replay on the public website (getshorthandapp.com) only. Not used in the ShortHand app or the native iOS app (privacy policy)
Sentry: crash reporting for the web app. Not used in the native iOS app (privacy policy)
Resend: transactional email, such as purchase-restore messages (privacy policy)
Upstash: rate limiting for API routes (privacy policy)

ShortHand follows the principles of the Student Privacy Pledge. This means:

We will never sell student data to anyone, for any reason.

We will never use student data for targeted advertising, not to students, parents, or anyone else. ShortHand does not use data for advertising tracking.

We will never share student data with third parties beyond the services required to operate the app.

We will always allow teachers to delete their student data at any time.

Need a Data Processing Agreement (DPA) for district approval? View our DPA →

Canadian teachers: Our DPA includes a section addressing PIPEDA and provincial privacy laws (BC FIPPA, Quebec Law 25). Data is stored on US servers. Schools with data residency requirements should contact us before signing up.

Questions about this policy or your data? Reach out anytime:

info@getshorthandapp.com

We're a small team and we'll respond personally.