Cornerstone Education is a school information app used by students, families and school staff. This page explains, in plain English, what the app collects, what it does not, and who controls your student's records.
Who we are
Cornerstone Education is provided by Cornerstone Technology Systems, LLC (an Ohio limited liability company). The app is sold to school districts and independent schools that subscribe to Cornerstone Education. Individual users are students, parents and guardians, and school staff, using accounts their school or district issues them.
The app contains two experiences and this policy covers both: myEdu for students and families, and EdOps for educators and staff.
Who controls your student's records
Your school or district does. Grades, attendance, schedules, transcripts, health records, discipline records and enrolment information are the school's education records. The school is their legal custodian and decides who may see them and how long they are kept.
Cornerstone stores and displays those records on the school's behalf and under its direction. We do not own them. We do not sell them. We do not use them for our own purposes, and we do not use them to build profiles, target advertising, or train anything.
This is why a correction to a grade or an absence has to come from your school office and not from us: we are not permitted to change a school's records, and you should be glad we are not.
What the app collects
Everything below is collected only to make the app work for the school. It is linked to the signed-in person's identity, is never used for advertising, and is never used to track anyone across other apps or websites.
- Name. The signed-in person's display name, shown in the app and — for staff actions — recorded in the school's audit trail so the school can see who did what.
- Email address. Used to sign in and to identify your account. It is also what makes it possible for one address to hold both a family account and a staff account.
- Account identifier. The internal identifier for your account, used for your session and your access scope. If your email address holds two accounts, each has its own identifier and the two are never merged.
- Your role and school assignment. For staff, the role your school gave you, the school you are assigned to, and the permissions that role carries. These decide what the app shows you.
- Your student links. For families, which students your account is linked to, so the app knows whose information to show you.
- Information you enter. As more of the app arrives, this will include what staff enter — attendance, grades, notes, messages — and what families submit, such as forms and absence notes. All of it goes into the school's records.
The app displays student information the signed-in account is entitled to see, which for some staff roles includes health, counseling and discipline records. The app is a view onto the school's records, scoped by the permissions your school gave you. It does not collect that information from your phone.
What we store on your phone
Almost nothing, and nothing identifying. The app stores
one setting on your device: which experience to
open, recorded as the word myEdu or
EdOps.
No name, no school, no student, no password and no session token is written to your device by the app. Information the app has loaded is held in memory only and is gone when you close the app, when you sign out, and — when you switch experience — for the experience you left.
That setting is also only a preference. It is sent to our server as a request and checked every time, so if your staff assignment ends, a remembered "EdOps" simply does not match an account you hold and you are taken to myEdu instead.
How you sign in
With the email address and password your school issued, sent over an encrypted HTTPS connection. Your session is held in a secure cookie that scripts cannot read, backed by a session record on our server that can be revoked at any time. Signing out revokes it immediately.
Repeated failed sign-in attempts from the same network are deliberately slowed down.
The app does not currently use a second authentication step and does not use a third-party or single-provider identity service. Sign-in is your email address and your password, and we state that plainly rather than letting you assume otherwise.
What we don't do
- No advertising. The app shows no ads, uses no ad networks, and does not read Apple's advertising identifier.
- No cross-app or cross-website tracking. The app does not use App Tracking Transparency, so you will never see a tracking permission prompt from us, because there is nothing to ask about.
- No sale or sharing of your data. We do not sell student, family or staff data, and we do not share it with any third party for their own purposes. Data is stored with our hosting provider (Microsoft Azure) on our behalf, under a standard data-processing arrangement.
- No usage analytics. The app does not bundle PostHog, Mixpanel, Amplitude, Segment, Google Analytics or any equivalent, and sends no product-interaction events anywhere.
- No crash reporting. The app does not bundle Sentry, Bugsnag, Crashlytics or any equivalent, and sends no crash or performance reports.
- No location. The app has no location feature and does not read GPS or infer your location from your network connection.
- No camera or photo access. The app does not use your camera or your photo library.
- No in-app purchases. Nothing is sold in the app. Schools subscribe to Cornerstone commercially.
- No device identifier. The app does not generate or send any identifier for your phone.
Children
Cornerstone Education is used by children, because students have accounts and families use it on their behalf. We take that seriously and it shapes the whole design.
- Accounts for children are created by the school, under its authority as the student's educational institution. A child cannot create an account, because the app has no sign-up at all.
- We collect nothing from a child in order to create an account — there is no registration form anywhere in the app.
- No advertising, no analytics, no tracking, no purchases, and no browsing of the open web anywhere in the app.
- No social features. There are no public profiles, no posts, and nothing a student writes is shown to other students.
Student education records are governed by the Family Educational Rights and Privacy Act (FERPA), and we handle them as a school official acting under the school's direction. Our handling of children's information is also designed to meet the Children's Online Privacy Protection Act (COPPA) and state student-privacy laws such as SOPIPA and its equivalents, which prohibit advertising to students, selling student data, and profiling students for non-educational purposes. We do none of those things.
To see or correct your child's records, or to ask what the school holds, contact your school — they are the custodian and the law gives you your rights against them, not against us.
Who can see what
Access is decided by our servers, never by the app. Two rules worth knowing:
- Families see one student at a time, and only students their account is linked to.
- Staff reach students through their assignments — their classes, their caseload, their health office — not through a general directory. What a staff member can see is set by the role their school gave them, and our servers check it on every request.
If your email address holds both a family and a staff account, those accounts are kept separate on purpose. They are not merged into one account with both sets of permissions, because that would let a teacher's staff access reach their own child's record, or a parent's rights widen what they see as staff. Whichever account is active answers the question "may this person see this?", and never both at once.
Data retention
Records created in the app are kept according to your school's or district's own records-retention requirements. Student education records typically have to be retained for years under state law, and the school — not Cornerstone — decides how long any particular record is kept.
Account deletion
Accounts are managed by your school or district. You can request deletion of your Cornerstone Education login from the Account screen in the app, or on our account deletion page.
Deleting your login does not delete your student's school records. It removes your ability to sign in. Grades, attendance, transcripts, health and discipline records stay with the school, which is legally required to keep them and is their custodian.
The account deletion page sets out exactly what is removed and what is not.
Your questions
For a privacy question about the app, email support@cornerstonetech.online.
For a question about your student's records — what they contain, correcting them, who at the school has seen them — contact your school. They hold the records and they answer for them.
Changes to this policy
If this policy changes, we will update the effective date at the top of the page and say what changed. Continued use of the app after a change means you accept the updated policy.
Cornerstone Technology Systems, LLC · Ohio, USA · support@cornerstonetech.online · Support · Account deletion