Privacy policy

Last updated July 5, 2026

PALY Press is an independent student project that puts Palo Alto High School's student publications in one app. It is not run by PAUSD, Paly, or the publications themselves. This page explains what the app actually collects, where it goes, and how to get rid of it. We tried to write it in plain English because we would want the same.

What we collect when you make an account

You can sign in two ways, and what we store depends on which one you pick. If you use Google sign-in, we get your name, email address, profile photo, and Google account ID from Google. We request the basic "openid email profile" scopes and nothing more. If you sign up with an email and password instead, we store your email address and a hash of your password (bcrypt) — never the password itself — and we email you a verification code to confirm the address is yours.

If you sign up with a pausd.us email, we also read the student ID number out of the address (the part before the @), since PAUSD emails are formatted that way. It's used to identify you as a Paly student.

If you turn on two-factor authentication, the TOTP secret is stored encrypted (AES-256-GCM) and your backup codes are stored hashed, the same way passwords are.

What we store while you use the app

• Articles you save and upvote
• To-dos you create and classes you add to your schedule
• Which publications you want notifications from, and a device push token if you enable notifications (issued by Expo's push service)
• Feedback you send through the feedback form
• Whether you want the weekly digest email
• When your account was created and when you last signed in

Comments are public

This is the most important part of this page. When you comment on an article in the app, the comment is submitted to that publication's website (they run on WordPress) under your display name. It becomes a public comment on their site, the same as if you had commented there directly. Deleting your account in the app does not remove comments that were already published on a publication's website. If you want one taken down, you'd need to contact that publication.

Google Calendar, if you connect it

Connecting Google Calendar is optional. If you do, we store access and refresh tokens so the app can fetch your events and show them on your schedule, plus your choices about which calendars to show or hide. The tokens are encrypted at rest with AES-256-GCM. We read your calendar; we never write to it. You can disconnect it in the app at any time, which deletes the stored tokens.

Analytics

We use PostHog to see which features people actually use and to find bugs. It records taps and app events (things like "notification opened"). It does not record your screen, and we configured it not to track which screens you visit automatically. There are no ads in the app and we don't sell data to anyone. Honestly, there's nothing to sell — this is a school project.

Do Not Track and selling data

Some browsers send a "Do Not Track" signal. Nothing in the app currently changes based on it. We don't sell your personal information to anyone, and we never will — there's no ad network or data broker here to sell it to.

Emails we send

We send email for three reasons: verification codes when you sign up, password reset links when you ask for one, and a weekly digest of popular articles, which you can turn off in your profile settings. Email goes out through Resend, our email provider.

Where the articles come from

The articles themselves are fetched from the publications' public websites (The Paly Voice, The Campanile, Verde, and the rest). When you read one, images may load directly from that publication's site, which means their servers see the request like any normal web visit.

Services we rely on

The app couldn't run without a few third-party services, and some of your data passes through them:

• Railway hosts the server and the Postgres database where everything above is stored
• Resend delivers our emails
• Expo delivers push notifications and app updates
• PostHog processes the analytics events
• Google handles Google sign-in and calendar access, if you use them
• The publications' websites receive comments you post and serve the articles you read

Security

Traffic to the server uses HTTPS. Passwords and 2FA backup codes are hashed, OAuth tokens and 2FA secrets are encrypted at rest, and sessions use secure cookies. That said, we're students, not a security team. We've put real effort into this, but no one can promise perfect security, and we won't either.

The beta signup page

If you fill out the beta signup form on this site, we store your name, email, and role (student, staff, parent, or alumni) so we can review the request and send you a TestFlight invite.

Deleting your data

You can delete your account from the profile screen in the app. That deletes your account record and everything tied to it: saved articles, upvotes, to-dos, classes, notification settings, push tokens, calendar connections, all of it. The two exceptions are comments already published on publication websites (explained above) and feedback you submitted, which is kept so we can still act on it. Verification codes and password reset tokens expire on their own. If you'd rather just see what we have on you or fix something instead of deleting it all, email us and we'll help.

Age

The app is built for high schoolers, their families, and Paly staff. You need to be at least 13 to make an account. It is not directed at children under 13, and we don't knowingly collect their data.

Changes and contact

If we change this policy, we'll update the date at the top. For anything privacy-related, use the feedback form in the app or email [email protected].