Rollkeep
Rollkeep Privacy Policy
Last updated: November 10, 2026
Who we are
Rollkeep is an attendance and program management service for schools and before- and after-school programs. It includes the Rollkeep iOS app, the Rollkeep web console for organizations, and the Hatchlings classroom rewards display. Rollkeep is operated by Chase Hewitt ("Rollkeep", "we", "us").
Rollkeep was previously called ATB: School Attendance. This policy replaces the earlier ATB privacy policy.
Who this policy applies to
Rollkeep is used by adult staff of schools, school districts and youth program organizations (each a "Customer"). Students do not create accounts or use the app. Student information is entered by the Customer's staff, or imported from the Customer's own systems, and stays under the Customer's control.
When a Customer is a school or school district, or runs a program under contract with one, we act as a "school official" under the Family Educational Rights and Privacy Act (FERPA) and as a contractor and operator under Connecticut's student data privacy law (Conn. Gen. Stat. §§ 10-234aa to 10-234dd). The Customer owns its student data, and we handle it only on the Customer's instructions.
Information we collect
Staff accounts
- Email address, username, display name and optional profile picture
- The teams the staff member belongs to and their role
- Sign-in details from Sign in with Apple, Google or Microsoft, if the staff member uses one
- A device token used to send app notifications, such as join requests and approvals
Student records
Entered by staff or imported from the Customer's records:
- First and last name, student ID number, room, wing and grade
- Which programs the student attends, such as morning or afternoon
- Notes, tags and any custom fields the Customer sets up
- Allergies, medications with their instructions, and medical conditions
- Emergency contacts: name, phone number, relationship, and whether the contact is allowed to pick the student up
- Whether the student has been withdrawn
Attendance
The date, program, attendance status, any note, and the staff member who recorded it.
Sign-out
The time a student was signed out and the staff member who recorded it. If a sign-out is undone, the record is kept, hidden from view, with the time it was undone and by whom, so the Customer has an accurate history.
Calendar
Program and school calendar events, such as closures, early dismissals and special events. If staff import a calendar from a photo, the text in the photo is read on the device using Apple's built-in text recognition, and the photo itself is not uploaded.
Hatchlings rewards
Reward points that staff award to students. The Hatchlings display shows students' names, rooms and grades along with their points, and only signed-in staff of that Customer can open it. Students do not sign in to Hatchlings.
Organization web console
The organization's name, its administrator accounts, the schools and programs it manages, and the email addresses of people invited to join.
SchoolDoc data
When a Customer connects Rollkeep to SchoolDoc, we receive the student details the Customer chooses to map, which may include grade, allergies, medications, medical conditions and contact names and phone numbers. We use this only to keep the Customer's student records up to date and to show care information to the Customer's staff.
Diagnostics
The app uses Firebase Crashlytics to collect crash reports, including device model, operating system version and app version. Crash reports are not linked to any student. Firebase keeps them for 90 days.
What we don't collect
We do not collect location data, do not use advertising identifiers, do not use analytics to track usage, and do not track anyone across other apps or websites.
How we use information
We use student information only to provide Rollkeep to the Customer for school and program purposes: taking attendance, managing sign-out, showing care information, running rewards, producing reports and supporting the Customer.
We will never:
- sell, rent or trade student information
- use student information for targeted advertising
- build a profile of a student for any purpose other than the Customer's school or program purposes
- use student information for any purpose the Customer has not authorized
We may use de-identified, aggregated information that cannot reasonably identify a student, school or person to improve Rollkeep.
Who we share information with
We share information only with the service providers below, which process it on our behalf under written terms that require them to protect it.
| Provider | What it does | Data involved |
|---|---|---|
| Google Firebase | Stores and syncs data, signs staff in, sends app notifications, runs background tasks, collects crash reports | All data described above |
| Cloudflare | Hosts the Rollkeep and Hatchlings websites | Pages only; student data is loaded from Firebase |
| SchoolDoc | Sends student details to Rollkeep when the Customer connects it | SchoolDoc data described above |
| Resend | Sends invitation and welcome emails | Email addresses, names, organization names |
We may also disclose information if the law requires it, such as a valid subpoena, after notifying the Customer when the law allows. We do not otherwise disclose student information.
Security
- Data is encrypted in transit with TLS and encrypted at rest by Google Firebase.
- Database security rules limit each Customer's records to the staff that Customer has approved, and administrators can remove staff at any time.
- Firebase App Check helps block requests that don't come from the genuine app.
- The optional App Lock adds Face ID or passcode protection on the device.
Data breaches
If we discover unauthorized access to or disclosure of student information, we will notify the affected Customer without unreasonable delay, and no later than 30 days after discovery for student information, or 60 days after discovery for directory information, student records or student-generated content, as Conn. Gen. Stat. § 10-234dd requires. The notice will describe what happened, what information was involved and what we are doing about it.
Retention and deletion
- Deleting a student removes the student and their attendance, sign-out and rewards records from the app and from cloud storage.
- Withdrawing a student removes them from the daily roster and keeps their history for the Customer's records.
- Deleting a school year permanently deletes all of its students, attendance, sign-out records and events.
- Deleting a staff account in Settings → Delete Account permanently removes the login, profile, profile picture and team memberships. Records that staff member entered stay with the Customer.
- Requests to join a team that nobody answers expire after 14 days.
- On request, a Customer may ask us to delete any or all of its student information, and we will do so within 30 days, except where the law requires us to keep it.
- When a contract ends, we will return the Customer's data on request and then delete it within 30 days. We do not keep student information after a contract ends.
Parent and student rights
Parents, guardians and eligible students may review student information and ask for corrections by contacting the school or program that uses Rollkeep. If you contact us directly, we will forward your request to the Customer and help the Customer respond. We do not change a Customer's records without the Customer's direction.
Children's privacy
Rollkeep is designed for and used by adult staff. Children do not create accounts, sign in or enter information. Student information is entered by the Customer's staff under the Customer's authority, so we do not collect personal information directly from children.
Laws we follow
- FERPA: when we act for a school or district, we are a school official under the Customer's direct control, and we use and redisclose education records only as FERPA allows.
- Connecticut student data privacy law: we follow the operator duties in Conn. Gen. Stat. § 10-234cc, and our contracts with Connecticut boards of education include the terms § 10-234bb requires.
- COPPA: we do not collect information directly from children.
Changes to this policy
We will post any change here with a new "Last updated" date. For a material change to how we use student information, we will notify Customers at least 30 days in advance, and the change will not apply to a Customer's existing data without its agreement.
Contact
Questions or data requests: chase.hewitt@proton.me.