Privacy
Photo privacy: a roster lookup, not a face match
Student portraits are the most sensitive data the toolchain handles, and the privacy posture is built into the modules rather than bolted on. Photos and face data are never sent to an outside AI or photo company; the editing and storage steps of the toolchain run on our own private system.
Find-my-child is a roster LOOKUP, not a face match. A family finds photos by entering the child’s roster name against the school roster; the module confirms the family is the one attached to that roster record and serves only that child’s portraits. The match is the studio’s explicit roster assignment made at upload. No portrait is placed in a public index, and no portrait is visible to any family other than the one on the roster record.
Facial recognition is a capability we are building and is not turned on today. It plays no part in the matching workflow, the gallery, or the order module. It stays off for a child until that child’s parent opts in explicitly — an older blanket permission sitting on the roster record is not enough to switch it on. Face matching is a capability we are building and is not turned on today — the recognizer is not yet wired: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. The template is never public and never sold.
What does work end to end is suppression. A do-not-publish decision drops that student’s images and name from the digital edition, from the reader, and from the print belt — one child suppressed everywhere, without touching any other student’s photos. That is a separate promise from the face-template one, and it is the one we can show a family working.
Consent is collected per student, tracked per roster record, off by default, and withdrawable at any time. A withdrawal removes the student from the shared gallery. The consent gate is enforced at the data layer, so the privacy posture holds even for a route that forgot to check.
What is built and what is honest-off
Roster import, the consent gate enforced at the data layer, private roster-matched galleries (find-my-child is a roster lookup, not a face match), team photos, composites, the class directory, and ID-card composites, school-choosable backgrounds with deterministic matting, PSPA/SPOA pro-lab output, and per-school tenant isolation are built and running today. The toolchain is free to run — no contract, no per-seat fee. The order rails are built as infrastructure, but the live payment rail is honest-off: no card is charged today and there is no live checkout. Delivery tracking beyond the built order ledger, outside-lab routing, and texted family reminders are early access: we name them plainly. Photos and face data are never sent to an outside AI or photo company; editing and storage run on our own private system. Face matching is a capability we are building and is not turned on today — the recognizer is not yet wired: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. Do-not-publish suppression — dropping a student’s images and name from the digital edition, the reader, and the print belt — is built and running today. No competitor brand names appear here. Money, pricing, and checkout are not on this page.