Careful with young children, said honestly
Everything here runs on our own private systems. A young child’s records and photos are owned by the school and are never sold to or shared with advertisers, data brokers, or any outside company. A minor’s photos are never made public, never handed to an outside search engine to index, and never sold.
Find-my-child is a permission-checked roster lookup, not a face scan. A parent finds only their own child by the roster tag a person with permission applied, the same way you would look up a name in a directory — it does not scan a crowd of children for a face by default. Face matching is not available in the shipping product: it holds no face-recognition model weights and computes no face template. Photo finding uses a permission-checked roster lookup instead. Withdrawing the opt-in stops the matching, on the spot. It is consent-gated and owned by the school.
One thing we will not overstate. The step that actually destroys a stored template is not finished, and we are not going to tell a parent it runs on a schedule when it does not. The cleanup job is built to refuse rather than pretend: when it cannot truly destroy a template, it stops and raises an alert instead of marking the job done. We would rather leave that alert standing than write down a deletion we cannot show you, and when it can be demonstrated end to end this page will say so plainly. What does already work, end to end, is the part most families are really asking about: mark a child do-not-publish and their pictures and their name drop out of the digital edition, the online reader, and the print run.
This page is deliberately careful about two things it does not claim. It does not promise that a picture can never leave the building — a picture-day order routed to an outside print lab does leave it, and we say so. Face matching is not available in the shipping product: it holds no face-recognition model weights and computes no face template. Photo finding uses a permission-checked roster lookup instead. The claims we make are the narrower, keepable ones: private systems, never sold, face-matching off by default, templates walled and never handed back, a withdrawal that stops the matching, and a minor’s photos never made public, indexed, or sold. An adviser or office manager can read that posture in plain words and hold us to it.