Privacy Policy

This Privacy Policy describes how Banana Fana LLC d/b/a PS Match, a New York limited liability company ("we," "us," or "our"), collects, uses, and protects information.

Public School Match (the "Service") is a parent-directed tool that helps New York City parents and legal guardians research, compare, and apply to NYC public schools. This Privacy Policy covers publicschoolmatch.com and the account service, and describes what information we collect, how we use it, and the choices you have. By creating an account you confirm that you are at least 18 years old and the parent or legal guardian of (or otherwise authorized to enter information about) any child whose information you enter.

1. Information you provide

• Account information: your email address and password, or your Google account identifier if you sign in with Google. We also keep a record of the Terms of Service version you accepted and when.
• Household information: your home school district; your household's free-or-reduced-price lunch status (encrypted at rest); the languages spoken in your household (encrypted at rest); and the schools your other children attend, if you list them.
• Saved locations: the address text you type (encrypted at rest), a label and type for the location (for example, Home or Work), and the map coordinates we derive from the address. See the Security section for exactly what is and is not encrypted.
• Child profile information. The minimum required is a nickname or initials and a grade level; we never require a child's full name, photo, email address, or phone number. You may optionally provide a learning-environment preference, interests, school-size and configuration preferences, and the priorities that drive your match results. You may also optionally provide sensitive attributes: IEP status, English Language Learner (ELL) status, free-or-reduced-price lunch status, race or ethnicity, GPA, lottery number, a disability-related seat group, specialized-program interest, and languages spoken or of interest. Each of these sensitive fields is optional and encrypted at rest (see Security and Sensitive information below).
• Match-outcome reports (voluntary): if you choose to report how your applications turned out, we collect the schools you applied to, your priority group, your lottery-number percentile, GPA (optional), and your offer, waitlist, and accept-or-decline outcomes. See How we use information for how these reports are used.
• Notes and media: your text notes about schools, and (on premium plans) the photos, files, and voice memos you attach to them, along with automatic transcripts of your voice memos.
• AI assistant conversations: the messages you send to, and the responses you receive from, the Parent Coordinator (our optional AI assistant), stored as your chat history.
• Email preferences: which categories of email you have opted into or out of, and your preferred language for communication.
• Feedback and contact submissions: anything you send through our contact form, including data-issue reports, privacy and legal inquiries, and takedown requests, together with the email address you provide.

2. Information collected automatically

• Session data: the cookies our authentication provider (Supabase) sets to keep you signed in.
• Usage analytics: pageviews and interaction events, collected through Google Tag Manager. We do not use cross-site advertising tracking.
• Error and performance reports: diagnostic information when something on the site fails or runs slowly, collected through Sentry. If an error occurs during your session, a small share of those error sessions may also be captured as a session replay showing what was on your screen at the time, so that we can diagnose the failure.
• Background-job telemetry: our background-job system logs pseudonymous identifiers (such as internal account and profile IDs) and job timing so we can operate features like match computation and email delivery. It does not receive decrypted sensitive fields.
• Server logs: standard technical logs generated by operating the Service.

3. Cookies

We set the following cookies:

• Authentication cookies set by Supabase to keep you signed in (essential).
• NEXT_LOCALE, which remembers your language choice for about one year.
• psm_schools_prefs and other first-party preference cookies, which remember interface settings such as your view, sort, filter, and grade-group choices on the schools directory.
• Analytics cookies set through our Google Tag Manager container to measure how the Service is used.

All of our cookies are first-party or essential to operating the Service. We set no third-party advertising cookies. If we ever introduce advertising, we will update this section first.

4. How we use information

• To create and maintain your account.
• To compute personalized match scores, admissions-outlook labels, and commute estimates for the schools you research.
• To power the Parent Coordinator, our optional AI assistant, which answers your questions using your family's context and our school data, within the question quota for your plan (see Service providers for exactly what we send to our AI provider).
• To transcribe the voice memos you record, so you can search and export them as text.
• To improve our admissions-outlook estimates for all users, using the match-outcome reports parents volunteer. See Data retention for how these reports are deleted.
• To send transactional email you have requested (sign-in confirmations, deadline reminders, co-reviewer invitations).
• To send marketing email about new features, only to subscribers who have not opted out.
• To prevent fraud and abuse, including rate limiting and monitoring automated access.
• To improve the Service, including identifying and fixing errors and measuring which features are used.
• To comply with our legal obligations.

What we never do

We never sell personal information. We never use child or student profile data to target advertising. No school ever pays for placement or ranking in our results.

Public School Match is currently ad-free. If we ever introduce advertising, these limits will apply:

• Advertising will never be targeted using child or student profile data or any sensitive information you enter.
• No school will ever pay for placement or ranking: no pay-to-rank, no pay-to-promote, and no sponsored placement of any school in search results, match results, or editorial content.
• Any advertising will be visually distinguished from school data and editorial content, and premium subscribers will not be shown advertising.

5. Service providers

We share personal information only with the service providers we need to operate the Service, and only what each one needs:

What the Parent Coordinator sends to Anthropic

When you use the Parent Coordinator, we send Anthropic your messages together with a limited summary of your family's context: your child's nickname, the grade your child is applying for and its grade group, your home school district number, your preferred boroughs and districts, the priorities you selected, the names, school codes, and fit results of the schools on your saved list, the nicknames and grades of your other children on the account, and whether your child has an IEP on file or is an English Language Learner (as yes or no indicators only). We never send your home address or any saved location, the map coordinates we derive from them, or your child's lottery number, GPA, race or ethnicity, free-or-reduced-price lunch status, or the underlying value of any other encrypted sensitive field.

The assistant may also run web searches to research your questions. Under our agreement with Anthropic, conversations are not used to train its models.

6. Sharing features you control

Some features let you disclose your own information, at your direction:

• Co-reviewer sharing. You can invite a co-parent or other trusted adult, by email, to view (or view and edit) a child's profile. An invited co-reviewer sees everything you see for that child: the profile details you entered (including any sensitive attributes), match results, commute results computed against your household, the saved school list, and your notes and attached photos and media. The invitation only works for the email address you invited, and you can revoke access at any time.
• Calendar feeds. Your saved-events calendar feed is authorized by a secret link. Anyone who has the link can read your saved events, so share it carefully; you can regenerate the link at any time to cut off old copies.
• Connecting your own AI client (premium). If you connect an AI application of your own to our remote data connection, the data those tools return (your children's profiles, your match results, and school data) flows to that application and its AI provider under their terms, at your direction.
• Exports. PDF and CSV exports are copies of school data and your own notes that you download and control.

School data on the Service (directory listings, profiles, guides, and events) is public. Everything you enter about your family (child profiles, notes, saved locations, saved lists, and match results) is private to your account and anyone you explicitly invite. A child's information is never displayed publicly.

7. Legal and other disclosures

We may disclose information when required by law or legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of our users or others.

If Public School Match is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. The commitments in this policy, including our commitments never to sell personal information and never to target advertising using child or student profile data, will continue to apply to the transferred information, or we will notify you and give you a choice before any different practice applies.

8. Children's information

The Service is directed to parents and legal guardians, not to children. Children cannot create accounts, sign in, receive email from us, or otherwise interact with the Service. All information about a child is provided by the parent or legal guardian who owns the account, and we do not knowingly collect personal information directly from any child, including children under 13.

We designed the Service to need as little information about a child as possible: a nickname or initials and a grade level are enough, and we never require a child's full name, photo, email address, or phone number. A child's information is never displayed publicly and is never shared with other users, other than a co-reviewer you explicitly invite. You can delete any child profile yourself at any time from your family pages, and that deletion takes effect immediately; residual copies may persist in backups and in detached storage copies for a limited period before being removed.

9. Sensitive information

You may choose to provide sensitive attributes about your child or household: IEP status, ELL status, free-or-reduced-price lunch status, race or ethnicity, GPA, lottery number, a disability-related seat group, specialized-program interest, and languages. Every one of these fields is optional, and each is encrypted at rest.

We use sensitive attributes only to compute the admissions logic for which they are relevant and the fit criteria you have enabled. Apart from sharing you direct yourself (a co-reviewer you invite, an AI client you connect, or an export you download) and the error reports described in Information we collect automatically, the only sensitive signal we send to any service provider is the yes-or-no IEP and ELL indicator sent to the Parent Coordinator's AI provider when you use the assistant, as described in Service providers. Sensitive information is never public, never sold, and never used for advertising.

10. Data retention

Wherever data is deleted, residual copies may persist in backups and in detached storage copies for a limited period before being removed.

11. Your rights and choices

• Access and correction. You can view and edit your information at any time from your account and family pages: your email and billing settings under your account page, and your child and household information under your family pages.
• Deletion. You can delete any child profile yourself at any time from your family pages, and that deletion takes effect immediately. To delete your entire account, contact us at any time; we will complete your request within 30 days, and if we need longer we will tell you why and when to expect completion. When data is deleted, residual copies may persist in backups and in detached storage copies for a limited period before being removed.
• Email preferences. You can opt out of any marketing email using the unsubscribe link in every marketing message or from the email preferences page. Transactional email tied to your account (sign-in confirmations, reminders for deadlines you have explicitly saved) cannot be opted out of while your account is active.
• AI assistant history. Your Parent Coordinator conversations are deleted automatically after 90 days, and deleting your account removes them sooner.
• Opt-out preference signals. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in state privacy laws. Because there is nothing to opt out of, opt-out preference signals such as Global Privacy Control do not change anything today. If our practices ever change, we will honor those signals.

12. Security

• Connections to the Service use TLS.
• Sensitive profile fields, and the address text of your saved locations, are encrypted at rest with a managed key and can be decrypted only by controlled server-side functions. The map coordinates we derive from a saved address are stored in our database and protected by access controls, not field-level encryption.
• Every read and write is checked against your account, so you can reach only records you own or that another user has explicitly shared with you; database row-level security provides an additional layer of protection, and decryption of sensitive fields is limited to server-side processing.
• No system is perfectly secure, and we cannot guarantee that personal information will never be exposed by an unforeseen event.

13. Breach notification and state privacy laws

We maintain a program of reasonable administrative, technical, and physical safeguards for personal information. If a breach of security affects your personal information, we will notify you and the appropriate regulators as required by the New York SHIELD Act and other applicable law.

We extend the access, correction, and deletion rights described in this policy to all of our users, regardless of the state they live in, and we do not sell personal information as state privacy laws define that term.

14. Changes to this policy

If we change this policy materially, we will notify you by email and in the product before the change takes effect. Material changes to how we handle children's information, or to our commitments never to sell personal information and never to target advertising using child or student profile data, apply prospectively only.

15. Translations

We publish this policy in languages other than English so you can read it in the language you use the Service in. Those translations are provided for convenience. They are not certified legal translations and have not been independently reviewed for legal accuracy. If a translation and the English version disagree, the English version of this policy controls.

16. Contact

This policy is provided by Banana Fana LLC d/b/a PS Match, 418 Broadway Ste N, Albany, NY 12207. Questions about this policy, or a privacy request? Contact us.