Privacy & consent
Facial recognition off by default. A photo is only available to buy when permission allows.
The yearbook industry quietly turned picture day into a face-recognition data business: a child’s portrait is sent to a vendor’s AI cloud, matched by face or fingerprint data, and sold far from the school. Homeroom is built differently. Facial recognition is off by default; finding a child is a student-list lookup, not a face match. Face matching is not wired in the shipping product and cannot be switched on from it: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. A portrait is sellable only when permission allows. This page explains exactly how — in plain language.
Four things this architecture guarantees
Facial recognition is off by default
Finding a child is a student-list lookup, not a face match — so normally no face data is created at all. Face matching is not wired in the shipping product and cannot be switched on from it: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. Shipped
“Find my child” is a student-list lookup
A parent finds their child by the school’s own student list — name, grade, homeroom — not by a face match. It is a look-up a school already trusts, not a surveillance feature. Shipped
Student photos and data are never sold
Neither student photos nor student records are ever sold to advertisers, data brokers, or any other third party — by anyone in this platform. A portrait is only available to purchase when permission on file says it may be; no other monetization of a student image is possible. Shipped
Permission gates the sale
A photo becomes purchasable only when the permission on file says it may be — enforced in the code itself, not by a checkbox someone might forget. No permission, no sale. The consent gate is enforced in code today; the parent portrait store it guards is in early access. Consent gate shipped Parent portrait store in early access
How the pipeline keeps student photos out of the data business
- Student photos are never sold or shared with advertisers. No student photo is ever sold to a data broker, used in an ad network, or shared with a party whose purpose is to profit from the image. A portrait becomes purchasable only when permission allows.
- Identity is by the student list, not by face. A photo is matched to a student through the student list the school provided — the same trusted source the gradebook uses — so there is never a need to run face recognition.
- Permission is checked before anything is sellable. The permission check reads the permission record before a portrait can appear in a store. A photo without sale permission is simply not offered.
- The school stays in charge. The school — not a photo vendor — remains the authority over its students’ images. The platform is the party legally responsible for the permission flow, and the in-app policy spells out the exact terms.
Where any face data is handled at all — for example, to help an operator crop to the eyes — face detection returns only boxes and key points, never sent to an outside company, and it runs inside our own private system. That is detection geometry, not identity: it does not tell anyone who is in the frame. The consent machinery for face matching follows state law — off in New York, opt-in in several states, and the careful opt-in everywhere else — and the matching capability behind that machinery is not wired and cannot be switched on from this product, so there is no face-matching helper running for you to permit or refuse. Withdrawing permission stops the matching at the gate — a withdrawn or missing permission is refused. What we can show you end to end is the publication side: a student marked do-not-publish drops out of the digital edition, the online reader, and the print run.
A single-school wall the database enforces
Privacy isn’t only about picture day. Homeroom keeps schools apart as a hard rule inside the database: an adviser, a student staffer, or a studio sales rep tied to one school cannot read another school’s student rows. It is enforced one layer below the screens, not in the app, and it is proven against a real database across the full student record — a cross-school view returns zero student rows even with both schools in scope. This is how Homeroom is built to fit the federal student-records law (FERPA).
A studio or sales rep sees totals, adult contacts, and money reconciliation — and never a student row — under the same kind of rule. That is what makes a genuinely resold product possible without anyone outside the school ever touching a child’s record.
The frameworks this design answers to
Homeroom is built to fit how schools are already required to handle student data — FERPA for education records and COPPA for children’s data — rather than bolting compliance on afterward. We describe here what the architecture does; the binding terms, the data-controller relationship, and the exact retention and deletion commitments live in the in-app policy your administrator agrees to. We’d rather show you the mechanism than wave a badge.
We’re honest about what’s shipped
The picture-day pipeline with consent-gated sales and facial recognition off by default, the permission check that gates every sale, student-list “find my child,” the single-school privacy wall, and the sales-rep privacy wall are live today. The parent portrait store the permission check guards is building now on top of that shipped gate, and a few photo-arm helpers — face-assisted matching with templates kept in our own private system, and the encrypted face-data vault — are in early access. The privacy guarantees above describe what the platform does today; they are not a regulator’s certification, and the binding policy lives in the app.