Privacy Policy

1. Introduction

BCBA Tracker ("we," "our," or "the App") is a professional behavioral data collection tool designed for Board Certified Behavior Analysts (BCBAs), teachers, and Registered Behavior Technicians (RBTs) working with special needs students.

This Privacy Policy explains how we collect, use, protect, and handle student behavioral data. We are committed to protecting student privacy and complying with the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA).

2. Information We Collect

2.1 Student Information (Minimal PII)

BCBA Tracker is designed to collect the minimum personally identifiable information (PII) necessary for professional behavioral tracking:

• First Name (e.g., "Sarah")
• Last Initial (e.g., "M")
• Grade Level (e.g., "3rd Grade")
• Behavioral Observation Data:
  • Session timestamps (date and time)
  • Behavior frequencies (counting occurrences)
  • Behavior durations (time measurements)
  • ABC data (Antecedent-Behavior-Consequence notes)
  • Interval recording data
  • Program progress tracking
  • Session notes (text entered by teacher/therapist)

2.2 Teacher/Therapist Account Information

If you choose to use the optional Google Drive backup feature, we collect:

• Google Account Email (for authentication only)
• Google Account Name (displayed in app)
• Device Name (for backup identification)

This information is used solely for Google Sign-In authentication and is never shared with third parties.

3. What We DON'T Collect

BCBA Tracker is explicitly designed to NOT collect the following:

4. How We Use Information

4.1 Primary Purpose: Behavioral Data Collection

Student data collected by BCBA Tracker is used exclusively for:

4.2 Local-Only Storage

ALL student data is stored locally on your iOS device. We do not:

• Transmit student data to remote servers (except optional Google Drive backup)
• Share data with third-party analytics services
• Use student data for advertising or marketing
• Track student behavior across apps or websites

4.3 Optional Google Drive Backup

If you choose to enable Google Drive backup:

• Backups are manual only (triggered by you, never automatic)
• Backups are stored in your personal Google Drive account (not our servers)
• You control when backups are created and deleted
• Backup files are in JSON format and encrypted
• We never access your Google Drive files
• Google's privacy policy applies to data stored in your Google account

8. Data Security

8.1 Local Encryption

All student data stored on your iOS device is protected using:

• iOS Keychain Services: Secure credential storage
• AES-256 Encryption: Industry-standard encryption (CryptoKit framework)
• Face ID/Touch ID: Biometric authentication (optional but recommended)
• Device Passcode Protection: iOS-level security

8.4 No Cloud Servers

BCBA Tracker does not operate cloud servers. We do not have access to your data, and therefore:

• Cannot be hacked (no central database)
• Cannot experience data breaches (data is local-only)
• Cannot comply with unauthorized data requests (we don't have the data)

15. Regulatory Compliance Summary

14. Contact Us

14.1 FERPA/COPPA Requests

For FERPA-related requests (parental access, data corrections, deletions):

1. Email support@nycapphouse.com with "FERPA Request" in the subject line
2. Provide student's first name and last initial (for verification)
3. Specify the request type (access, correction, deletion)
4. We will respond within 45 days as required by FERPA regulations

16. Consent and Acknowledgment

By using BCBA Tracker, you acknowledge that:

1. You have read and understand this Privacy Policy
2. You are authorized to collect behavioral data for the students you enter into the app
3. You will comply with FERPA, COPPA, and applicable school/organization policies
4. You understand that student data is stored locally on your device
5. You are responsible for securing your device (Face ID, strong passcode)
6. You will provide parents with access to their child's data upon request
7. You will obtain necessary parental consents before data collection