Privacy Policy

Overview

Evident is a product of 5minMindful LLC ("we," "our," or "us"), a Delaware limited liability company located at 2803 Philadelphia Pike, Suite B #569, Claymont, DE 19703. We are committed to protecting the privacy of educators, students, and families who use our service. This Privacy Policy explains how we handle information when you use Evident.

The short version: Evident offers two modes of use:

• Guest Mode: Create charts without an account. All data stays in your browser and QR codes. Nothing is stored on our servers.
• Registered Teacher Accounts: Create an account to save charts, track student progress over time, and communicate with parents. This data is encrypted and stored securely on our servers.

Guest Mode (No Account)

When using Evident without an account, we do NOT collect or store:

• Student names or identifying information
• Behavior goals or chart content
• Parent contact information
• Any personally identifiable information

All chart data exists only in your browser's local storage and in QR codes you generate. While you browse, the standard site analytics described under "Information We May Collect" below still apply; they never include your chart content.

Registered Teacher Accounts

When you create an Evident account, we store the following information to provide our behavior tracking and parent communication services:

Data We Store

• Account information: Your email address and display name for authentication and account management.
• Student display names and grade level: We recommend first names or nicknames only, avoiding full names or other identifying information. Grade level is optional.
• Daily behavioral logs: Goal status (met/not met), teacher notes, and timestamps for each day.
• Student-support records you choose to create: IEP goals and progress data points, accommodations and their implementation notes, behavior incident logs, behavior intervention plans, evidence notes and their attachments (screenshots or photos of student work you capture), and weekly family summaries. Evident stores only what you document.
• Parent interactions: Signature records (including the typed signature name), view timestamps, and any comments a family member leaves in the parent portal.
• Sharing and roles: Your classrooms, school or organization membership, and which staff roles have access to which students.
• Access tokens: Secure tokens that allow parents to view their child's chart without creating an account.

Data Ownership

Teachers retain full ownership of all student data. You can:

• Export your data at any time in CSV format from your dashboard
• Permanently delete individual student records
• Delete your entire account and all associated data

When you delete data, it immediately becomes inaccessible in the product and is permanently removed from our systems, including encrypted database backups, within 30 days. If your account is subject to a Data Processing Agreement (DPA), data disposition follows the 60-day timeline specified in that agreement.

Security

We protect your data with industry-standard security measures:

• Encryption at rest: All data is encrypted using AES-256 encryption in our database.
• Encryption in transit: All connections are encrypted with TLS 1.2 or newer (TLS 1.3 where the browser supports it).
• Access controls: Row-level security ensures teachers can only access their own students' data.
• Audit logging: All data access and modifications are logged for security monitoring.

Information We May Collect (All Users)

To improve our service and ensure reliability, we may collect limited anonymous usage data:

• Analytics data: Page views, feature usage, and general traffic patterns, via Vercel Analytics (aggregated and cookieless) and PostHog (first-party product analytics). For signed-in users, PostHog associates product events with an account identifier; session replay masks form inputs and is disabled on sensitive pages. In the European Economic Area and the United Kingdom, PostHog analytics and all session replay run only after you accept via the cookie banner. We do not use this data for advertising.
• Error logs and debugging replays: Technical errors that occur during use, which help us fix bugs (via Sentry). These logs do not contain student data. To reproduce hard-to-find bugs, a small sample of sessions may also include a masked screen recording in which all text is replaced with placeholders and media is blocked; in the EEA and UK these recordings run only after you accept via the cookie banner.
• Approximate location (country): Our hosting provider (Vercel) derives your country from your IP address at the network edge. We use it to show regional pricing and to apply the EEA/UK cookie-consent requirements. Your IP address is not sent to any third-party geolocation service.
• Security and audit logs: Sign-in and data access activity is recorded for security monitoring, including IP address and browser information. IP addresses and browser details are automatically removed from these logs after 90 days; the remaining audit entries are deleted after 24 months.
• Translation requests: When you translate chart content, teacher notes, weekly family summaries, or evidence packets, the content is sent to our translation service: OpenAI for the US deployment, and Mistral AI (a French provider, processed in the EU) for the EU deployment. For notes, summaries, and evidence packets, Evident removes the student's name before sending and restores it on your device after translation; for summaries and evidence packets, teachers also review the redacted text before it is sent. We set translation requests not to be stored by OpenAI, Mistral retains request content for at most 30 days (abuse monitoring only) and does not train on it, and we do not log or store this content on our servers.
• Progress narrative drafts: When a teacher asks Evident to draft an IEP progress-report narrative (US deployment only; this feature is disabled on the EU deployment), redacted goal text and pre-computed summaries of the recorded progress data are sent to Anthropic, our AI drafting provider. The student's name is replaced with a placeholder before sending and restored after the draft is returned, and every draft requires teacher review before it is used.
• Help assistant questions: Our public site includes an optional help assistant. Questions you type are sent to OpenAI to generate an answer; we set these requests not to be stored by OpenAI, and they are not linked to a teacher account. A copy of each question, truncated to 200 characters, is recorded in our product analytics so we can improve the help content. Please do not include student information in help questions.

Newsletter & Marketing Email

Some pages let you share your email address with us outside of creating an account: the newsletter signup forms, the free chart download ("email me this chart"), and the school inquiry / contact forms. Here is exactly what happens to those addresses:

• What we store: The email address, when and where it was submitted (including basic campaign attribution such as UTM parameters), your region (EEA/UK or not, for the consent rules below), and, for inquiry forms, the details you typed into the form.
• Marketing is opt-in only. Subscribing to the newsletter is itself the opt-in. On the chart download and inquiry forms, we email you marketing content only if you tick the optional checkbox. The chart or the reply to your inquiry arrives either way, and leaving the box unticked has no effect on the service you receive.
• What you get: Occasional teaching resources and product updates. We record when and where you opted in so we can demonstrate consent, and we do not share or sell the list.
• Unsubscribing: Every marketing email includes a one-click unsubscribe link. Once you unsubscribe, a later form submission does not re-subscribe you.
• Deletion: Deleting your Evident account also deletes these lead records and removes you from the mailing list. If you never created an account, email privacy@evidentk12.com and we will delete them on request.

Marketing email is delivered by Resend (see Third-Party Services below). Transactional email (the chart you asked for, parent signature notifications, account emails) is separate and does not depend on any marketing opt-in.

How Your Data is Stored

Browser Storage

Your chart data is stored in your browser's local storage. This data:

• Never leaves your device unless you print or share a QR code
• Persists until you clear your browser data
• Is not accessible to Evident or any third party

QR Code Encoding

When you generate a QR code, the chart data is encoded directly into the QR code image using compression. This means:

• The data travels with the printed chart, not through our servers
• Anyone with access to the QR code can decode and view the data
• We recommend not including sensitive information in charts

Evident Capture Browser Extension

Evident Capture is an optional browser extension for signed-in teachers. It connects to your Evident account with your explicit approval and can be disconnected at any time by signing out of the extension. When you use it:

• The extension reads the current page's title, address, or your highlighted text only when you click a capture button. It has no access to your browsing otherwise, requests no access to all websites, and runs no code on pages in the background
• Screenshots are cropped or confirmed by you before upload; only the region you confirm is uploaded
• Everything you capture is sent only to your Evident account over encrypted connections, along with the title and address of the page it came from, which are saved with the note so the evidence can be traced back to its source. The same storage, retention, and deletion rules as data entered on this site apply, including the 30-day deletion window for removed evidence
• Entries made while offline are held on your device and synced to your account when you reconnect
• The extension contains no advertising or analytics trackers and sends data to no one except Evident

FERPA Compliance

Evident is designed with FERPA (Family Educational Rights and Privacy Act) compliance in mind.

Guest Mode

When using Evident without an account, no student data is stored on our servers. Data exists only in your browser and QR codes, so no data sharing agreement is required.

Registered Accounts

We support compliance through:

• Data minimization: Student identity is limited to a display name and optional grade level; beyond that, Evident stores only the behavior and support records you choose to document (see "Data We Store" above)
• Data encryption: AES-256 encryption at rest and TLS 1.2+ in transit
• Access controls: Row-level security ensures data isolation
• Audit logging: Complete record of data access
• Data portability: Export all data at any time
• Right to delete: Permanently delete data on request

Recommendations

We recommend that educators:

• Use only student first names or nicknames (not full names)
• Avoid including sensitive behavioral, medical, or disciplinary information
• Consult their school's data privacy officer before using with student data
• Contact us for a Data Processing Agreement if required by your district

Third-Party Services

Evident uses the following third-party services:

• Vercel: Hosting and analytics. See Vercel's Privacy Policy
• Supabase: Database and authentication for registered accounts. Data is stored in SOC 2 Type II certified data centers. See Supabase's Privacy Policy
• Google: Optional "Continue with Google" sign-in. If you choose it, Google shares your name, email address, and profile photo with us to create and sign in to your account; we never see your Google password. Where a deployment has the Google Classroom roster import enabled, Evident additionally requests read-only access to your Classroom course list and rosters, used only to import the students you select. Evident's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. See Google's Privacy Policy
• Clever and ClassLink: Optional single sign-on for schools and districts, where enabled for your deployment. If you sign in through your school's Clever or ClassLink portal, the provider shares your name and email address with us to create and sign in to your account; we never see your password. See Clever's Privacy Policy and ClassLink's Privacy Policy
• OpenAI: Translation services, optional AI note polish writing support, and the help assistant on our public site. Note, summary, and evidence packet text is redacted before sending; for note polish and for summary and evidence packet translation, teachers review the redacted text first. Evident does not send student IDs, student names, teacher emails, school names, class names, grades, IEP status, diagnoses, or app metadata. We have an executed Data Processing Addendum with OpenAI that includes the EU Standard Contractual Clauses for international transfers. OpenAI does not use API data to train its models; data is retained for up to 30 days for abuse monitoring and then deleted, and we set requests not to be stored. Subject to OpenAI's Privacy Policy
• Mistral AI: Translation services for our EU deployment, processed in the European Union by Mistral AI, a French provider. Student names are removed before sending and restored on your device after translation. Mistral retains request content for at most 30 days for abuse monitoring only and does not train on it. On the EU deployment, Mistral also generates optional chart color themes from a single keyword a teacher types (no student data is sent). See Mistral AI's Privacy Policy
• Anthropic: AI drafting of IEP progress-report narratives, available on the US deployment only (the feature is disabled on the EU deployment) and always reviewed and edited by the teacher before use. Evident sends redacted goal text and pre-computed summaries of recorded progress data; the student's name is replaced with a placeholder before sending and restored after the draft is returned. Anthropic also generates optional chart color themes from a single keyword a teacher types (no student data is sent). Anthropic does not use API data to train its models. See Anthropic's Privacy Policy
• Stripe: Payment processing for paid subscriptions. We do not store credit card numbers. See Stripe's Privacy Policy
• Resend: Email delivery: transactional email (e.g., parent signature notifications) and, where you have opted in, our educator newsletter and product updates (see Newsletter & Marketing Email above). See Resend's Privacy Policy
• Sentry: Error monitoring to detect and fix bugs, including a small sample of masked debugging replays (all text replaced with placeholders, media blocked; consent-gated in the EEA/UK). Error reports do not contain student data. See Sentry's Privacy Policy
• PostHog: First-party product analytics and session replay, used to understand how the product is used and to fix usability issues. Replay masks form inputs and is disabled on sensitive pages; analytics URLs are scrubbed of identifiers. See PostHog's Privacy Policy
• Upstash: Rate limiting to protect the service from abuse. No student data is stored. See Upstash's Privacy Policy
• jsDelivr: A content delivery network your browser loads fonts from when exporting PDFs in some languages. Like any web request, jsDelivr receives your IP address when the font is fetched; no student data or chart content is sent. See jsDelivr's Privacy Policy

Cookies

Evident uses cookies that are necessary for the website to function, plus first-party analytics cookies (Vercel Analytics and PostHog) that help us understand how the product is used. We do not use advertising cookies, and we do not track you across other websites.

For visitors in the European Economic Area and the United Kingdom, we ask for consent before running non-essential analytics, including PostHog analytics events and any session recording (PostHog replay and Sentry debugging replays), and you can change your choice at any time from the "Cookie settings" link in the site footer or from the Settings page in your dashboard. The consent banner is available on every page of the site, not just the marketing pages.

Children's Privacy

Evident is designed for use by educators, not directly by children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

Your Rights

Guest Users

Your data exists only in your browser:

• Access: Your data is in your browser's local storage and any QR codes you've generated.
• Deletion: Clear your browser's local storage to remove all chart data from your device.
• Portability: Print or save your charts as PDFs at any time.

Registered Teachers

You have full control over your data:

• Access: View all your data in your dashboard at any time.
• Export: Use "Download my data" in Settings for a complete machine-readable copy of your account's data (JSON), or export student data as CSV from the dashboard.
• Deletion: Delete individual students or your entire account from Settings. Deleting your account also removes any newsletter/lead records tied to your email and takes you off the mailing list. Deleted data is permanently removed within 30 days.
• Correction: Edit student information and logs at any time.
• Portability: Export and take your data to another service.

International Data Transfers & GDPR

Data Processing

Evident processes personal data on the basis of:

• Contractual necessity: Processing required to provide the Evident service (e.g., storing student behavior logs, managing teacher accounts).
• Legitimate interest: Processing required to improve our service, prevent fraud, and ensure security.
• Consent: Where required, such as for optional email notifications and analytics.

International Transfers

Evident is operated from the United States. If you are accessing our service from outside the US, your data may be transferred to and processed in the United States. We use standard contractual clauses and rely on our data processors' compliance frameworks (including Supabase's SOC 2 Type II certification and Vercel's GDPR compliance) to ensure adequate protection of your data during international transfers.

For EU school deployments, Evident additionally operates an EU region deployment with student records stored in the EU (Frankfurt) and EU-resident providers for analytics and translation. Per-subprocessor locations for the EU deployment are listed on the Data Processing Agreement page.

Your Rights Under GDPR

If you are in the EU/EEA, you have the following rights in addition to those listed in the "Your Rights" section above:

• Right to be Forgotten: Request permanent deletion of your personal data. Use the "Delete Student" feature in your dashboard, or delete your entire account (including newsletter/lead records) from Settings, with no email required.
• Right to Data Portability: Export your data in a machine-readable format. Use "Download my data" in Settings for a complete JSON bundle of your account's data, or the CSV export in your dashboard for student data.
• Right to Restriction: Request that we limit the processing of your personal data under certain circumstances.
• Right to Object: Object to processing of your personal data for direct marketing or based on legitimate interests. For marketing email, the one-click unsubscribe link in any message has the same effect immediately.
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@evidentk12.com. We will respond to all requests within 30 days.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

What We Do Not Do

• We do not sell your personal information to third parties.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use sensitive personal information for purposes other than providing the Service.

Your California Rights

As a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete your personal information, subject to certain exceptions.
• Correct inaccurate personal information.
• Non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at privacy@evidentk12.com. We will verify your identity and respond within 45 days.

Do Not Track

Evident does not track users across third-party websites. We do not respond to "Do Not Track" browser signals because we do not engage in cross-site tracking.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us.