olaf

Privacy policy

Olaf School is provided by TGIF Labs (Olaf). This policy covers this school connection service, not a separate Olaf phone or messaging product. For questions or privacy requests, contact kim@tgiflabs.com.

What we process

• Your Olaf login. Your email address, account identifier and sign-in information are managed by Clerk. Olaf uses the verified account identifier to keep your school connection separate from other parents.
• Your ClassDojo connection. When you connect, Olaf processes your ClassDojo email and either a sign-in code or password for that sign-in attempt. The saved connection contains ClassDojo session cookies and ClassDojo browser storage, not your submitted password or code.
• School information you request. Olaf retrieves displayed stories, events and, when requested, teacher messages and supported attachments. These can contain information about children, families and staff. Olaf sends the retrieved information and source links to ChatGPT to answer your question. It does not keep a school-content history database.
• Technical and support information. Hosting and authentication services process request metadata and security logs. If you contact us, we receive your correspondence. Please do not email passwords, codes, cookies or private school messages.

Why and with whom

We use this information to sign you in, maintain your authorized connection, retrieve the school information you request, provide support and protect the service. Providers used for these purposes include Clerk (authentication), Neon (database), Google Cloud (hosting and encryption-key protection), Vercel (website delivery) and OpenAI/ChatGPT (your requested answer). We do not sell school information, run advertising in this service or use school information to train an Olaf model.

This connection does not grant access to Gmail or Google Calendar. Olaf does not send school messages, submit forms or make payments. ClassDojo and OpenAI operate under their own policies. ChatGPT may retain conversations and tool results according to your ChatGPT settings. Deleting an Olaf connection does not delete those chats.

Storage and retention

• Saved ClassDojo authorization is encrypted in the separate school-service database using AES-256-GCM. Google Cloud KMS protects its encryption keys.
• A saved session remains until you disconnect, delete your account, or ClassDojo proves the session is no longer usable. You may need to reconnect. Connection status and identifiers are removed when you disconnect or delete your account.
• School text and attachments are processed for the requested read, rather than saved as an Olaf history. Temporary browser and processing data can exist while the request or unfinished sign-in is running.
• The database currently has a six-hour recovery-history window. Deleted data can remain in that recovery history until it rolls off. Our configured Google Cloud operational-log bucket retains logs for 30 days. Request URLs with query strings are excluded from new school-service request-log storage because authentication redirects may contain tokens. Existing test logs and providers' own security records have their separate retention.
• Clerk manages authentication records and its own security/backup retention. Support correspondence is retained to handle requests and related security or legal needs. You may request its deletion.

Your choices

On your school connection, Disconnect ClassDojo removes the saved session and connection record. Under Account settings, Delete Olaf School account removes your school-service login and connection. Neither action deletes your ClassDojo account, school records, other Olaf products or ChatGPT conversations.

You can also contact kim@tgiflabs.com to request access, correction or deletion. We may need to verify that the request comes from the account owner. Use this service only as an adult authorized to access the school information you connect. It is not a signup service for children.

Changes

We will update this page and its effective date when this service's data practices change. Significant new access will require the applicable authorization.