Privacy policy

Last updated 23 October 2026

Thoth is a school operating system. Schools use it to keep their records and to keep families informed. This policy explains what personal information Thoth holds, why, who else handles it, and the choices you have. Thoth is run by a company based in the United States. In this policy, “Thoth”, “we” and “us” mean that company.

The short version

• Your school decides what goes into Thoth and who can see it. We hold school records on the school’s behalf and follow its instructions.
• We never sell personal information, show advertising, or build profiles of students for anything other than their school’s work.
• We do not use school records to train AI models.
• School records are stored in the European Union, in Ireland.
• Questions go to [email protected].

Who is responsible for your information

Records a school keeps in Thoth

When a school uses Thoth, the school is responsible for the records it keeps there. Under European and UK data protection law, the school is the controller and Thoth is its processor. In the United States, Thoth acts as a school official under the school’s direct control, as the Family Educational Rights and Privacy Act (FERPA) allows. We use these records only to provide Thoth to the school, under our agreement with it.

If you are a teacher, parent or student, your school is the right first contact for questions about your records. We help schools answer them.

Everything else

We are responsible for the details you send us through osthoth.com, for example when you ask for a demo, and for the business records we keep about the schools we work with.

What we collect

From schools

• People’s names, email addresses, roles and the classes and schools they belong to: staff, students, parents and other family contacts.
• Student details the school records, such as date of birth, gender, year group, classes and family links.
• The school’s calendar, timetable and other records it chooses to keep in Thoth.
• Sensitive records, if the school chooses to keep them in Thoth: health notes, accommodations, support plans and safeguarding records. These sit apart from other records, and only people the school gives permission can open them.
• Files a school uploads while it sets up Thoth, such as staff lists, class lists and calendars.

When you sign in

• Your email address or Thoth username, and your password, which is stored only in a scrambled (hashed) form.
• If your school turns on Google or Microsoft sign-in, the name, email address and account identifier those services share with us.
• Cookies that keep you signed in and remember your language. Thoth does not use advertising or tracking cookies.

While you use Thoth

• An audit record of changes: who changed what, and when. Schools use it to see how their records changed. Each time someone opens a safeguarding record, that is recorded too.
• Technical logs, such as IP addresses and error reports, which keep Thoth secure and working.

On osthoth.com

• If you ask for a demo: your name, school, email address and message.
• To stop repeated requests, we keep a scrambled (hashed) form of your IP address and email address for 10 minutes.
• A cookie that remembers the language you chose. The site has no analytics or advertising cookies.

How we use it

• To provide Thoth to schools, and to set it up for them.
• To send the emails Thoth needs: invitations, sign-in links, password resets and messages the school approves.
• To support schools when they ask for help.
• To keep Thoth secure, find problems and fix them.
• To reply to demo requests and other messages you send us.
• To meet our legal obligations.

For records we hold for schools, our legal basis is the school’s instructions under our agreement with it. For demo requests and our own business records, it is our legitimate interest in replying to you and running Thoth.

Drafts made with AI

Thoth uses AI to read the files a school uploads while setting up, and to draft records from them. A person at the school, or at Thoth working for the school, reviews every draft before anything is saved. To do this, Thoth sends the contents of those files to Anthropic, which provides the Claude AI model. Anthropic processes them under terms that do not allow it to train its models on them. We do not use school records to train AI models either.

Thoth staff access

Many schools ask us to set Thoth up for them, so our staff can see and correct a school’s records while they help. Any school can turn off our access to health notes, accommodations, support plans and safeguarding records. Once it does, only the school’s owner can let us back in. Our staff are bound by confidentiality, and their changes appear in the school’s audit record like anyone else’s.

Who else handles it

We use a small number of service providers to run Thoth. Each one handles personal information only to provide its service to us, under a written agreement.

• Supabase: database, sign-in and file storage. School records are stored on Amazon Web Services in Ireland.
• Vercel: hosts osthoth.com and the Thoth apps.
• Resend: sends Thoth’s emails.
• Anthropic: reads uploaded files during setup, as described above.
• Google and Microsoft: only if a school turns on their sign-in.

We may also share information when the law requires it, to protect someone’s safety, or with a company that takes over Thoth. A company that takes over Thoth must keep these commitments.

Where it is stored

School records are stored in Ireland. Some of our providers are based in the United States and may handle information there, for example to send an email. When information leaves the European Union or the UK, we rely on the European Commission’s Standard Contractual Clauses, the EU–US Data Privacy Framework, or the UK’s equivalents.

How long we keep it

• School records: for as long as the school uses Thoth. When a school leaves, we return or delete its records as our agreement with it sets out.
• Files uploaded during setup: deleted 30 days after upload. The records the school confirmed from them stay.
• Demo requests: for as long as we need them to reply and follow up.
• Backups and logs: for a limited time, then overwritten or deleted.

How we protect it

• All traffic to Thoth is encrypted, and so is stored data.
• Access rules in the database keep each school’s records apart. Inside a school, people see only what their role allows.
• Every change is recorded in the school’s audit record.
• Development and testing use made-up data, never real school records.

If a breach affects personal information, we tell the schools affected without undue delay, so they can meet their own duties.

Children

Children use Thoth only through their school. The school creates their accounts and decides what they can see. Thoth does not take sign-ups from children or anyone else.

In the United States, schools may consent on parents’ behalf for children under 13 to use Thoth for school purposes, as the Children’s Online Privacy Protection Act (COPPA) allows. We use children’s information only for their school’s work. We never sell it, use it for advertising, or build profiles from it for any other purpose.

Parents can ask the school to see, correct or delete their child’s information. Parents can also write to us, and we will work with the school to answer.

Your rights

Depending on where you live, you can ask to see the personal information we hold about you, correct it, delete it, receive a copy, or object to or limit how it is used. People in the European Union and the UK have these rights under the GDPR and UK GDPR. Some US states give their residents similar rights.

For records your school keeps in Thoth, ask your school first. If you write to us, we pass your request to the school and help it reply. For anything else, write to [email protected]. We reply within one month.

If you are in the European Union or the UK, you can also complain to your data protection authority. In the UK, that is the Information Commissioner’s Office.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters to how we handle your information, we tell schools by email before it takes effect.

Contact

Write to [email protected] with any question about this policy or your information.