Your information, in plain language

Last updated November 8, 2026

School & Steeple is a directory of Christian and Catholic schools that shows what a family pays after state school-choice funding. This page explains what we collect, why, who sees it and how long we keep it.

The short version

You can search and read every school page without an account or giving us anything.
We only ask for your child’s grade, never their name or birth date.
A tour request goes to the one school you chose, and nowhere else.
We don’t sell personal information, and we never give your name, email or phone number to advertisers.
We contact people by email only. We don’t send text messages.

When you browse

We count activity on each school’s listing: page views, times it appears in search results, and clicks on its tour and website buttons. These are totals per school per day. They carry no name, address, cookie or other way to tell who you are, and they are what schools see in their dashboards. Your browser remembers, until you close the tab, which school pages it has already counted, so reloading a page doesn’t count twice.

Some things stay on your own device:

Schools you add to the compare tray are saved in your browser’s storage, not sent to us.
If you arrived from an ad or a link with a campaign tag, your browser keeps that tag for the visit so a tour request can say where you found us.

Our own code sets no cookies for parents (the Meta Pixel may; see below). City maps load map images from OpenStreetMap’s servers (or another map provider we name on the map), which see your IP address and the area you’re viewing, as any website you load does. Our host, Vercel, handles every page request and keeps short-term technical logs.

Advertising measurement (Meta)

When we advertise to parents on Facebook and Instagram, we use the Meta Pixel and Meta’s Conversions API to learn whether the ads lead to tour requests:

On public pages, the Pixel (code from Meta that runs in your browser) tells Meta which page was viewed and when a tour request is sent. Like anything loaded from Meta, it lets Meta see your IP address and browser details, and it may set Meta’s own cookies (_fbp, _fbc). It never loads on sign-in, claim, dashboard or email-link pages.
When you send a tour request, our server also tells Meta that one was sent: the time, an event number, the address of the page you were on, your IP address, your browser’s user agent, and Meta’s cookie IDs or the ad click ID from the link you arrived by, so Meta can match it to an ad click.
Neither one sends your name, email, phone number, message or your child’s grade. The tour form’s fields are never passed to Meta.
If your browser sends a Global Privacy Control or Do Not Track signal, the Pixel doesn’t load and our server sends Meta nothing about your visit.

Some state privacy laws call this kind of ad measurement “sharing” for targeted advertising. Turning on Global Privacy Control in your browser opts you out of it on our site. Meta’s use of what it receives is covered by Meta’s own privacy policy.

When you request a tour

The tour form asks for your name, email, phone (optional), your child’s grade or grades, the year you’d like to start, and a message (optional), plus your agreement that we send these details to that school. We also record the page or ad campaign that brought you, the date, and a one-way scrambled code made from your IP address (a hash). We use the hash only to limit how many requests one visitor can send in an hour; it can’t be turned back into your IP address. Please don’t put your child’s name in the message.

What happens next:

We email your request to that school’s admissions address, with your email as the reply address, so the school answers you directly. The address comes from the school itself, from the person who claimed the listing, or from the state program’s list of participating schools.
We email you a copy confirming where it went.
If we have no email address for the school, a person on our team passes your request to that school by phone, by email, or through the school’s own website form, the same day where we can.
About two days after delivery, we may email you once to ask whether the school got back to you. If you answer, we save the yes or no. If it’s no, we give you the school’s phone number and look into it.

The school receives your details to reply about your request. Schools that claim their listing agree to use them only for that, and not to add you to marketing lists without your consent. A school on a paid plan also sees, in its dashboard, a list of its requests showing the grades, start year, date and whether it replied.

When a school claims or manages its listing

Claiming: the claim form asks for your name, role, work email and phone (optional), and keeps the same kind of IP hash as above. We verify you by an emailed link (when your email matches the school’s website or its state-list contact), by calling the school’s phone number on file, or by checking by hand.
Signing in: there are no passwords. We email a one-time sign-in link to the work email on a verified claim, and keep an IP hash with each request to limit them. Signing in sets one cookie (ss_session) that keeps you signed in for 30 days or until you sign out. We store links and sessions only as one-way hashes.
Your listing: what you enter (tuition, statement of faith, curriculum, accreditation, description, photos, open houses, phone and website) is published on your school’s public page. We keep a history of each change, with the email that made it, so we can answer questions and undo mistakes. The address you choose for tour requests stays private. Photos are resized and their hidden details, such as camera location, are removed before they’re published.
Paying: paid plans are handled by Stripe. Your card details go to Stripe, never to us. We keep the plan, price, status, renewal date, billing email and Stripe’s customer and subscription numbers.
Our emails to schools: tour requests, sign-in links, billing confirmations, an occasional note about your listing’s activity with an upgrade offer (each kind once), and, for schools that haven’t claimed their listing yet, a weekly summary of the week’s activity sent to the school’s address on the state program list. Every one of those notes and summaries has an unsubscribe link and our postal address.

School listings themselves (name, address, phone, website, grades, tradition) come from the U.S. Department of Education’s private school survey, official state program lists and schools’ own websites. See Data and methods. State lists that include staff names or personal phone numbers are never published on the site.

Who we share information with

The school you choose, for a tour request. No other school, and no one else, gets your request.
Companies that run the site for us, only to provide their service: Vercel (hosting), Supabase (our database and photo storage), Resend (sending email), Stripe (school payments) and Meta (ad measurement, as described above).
When the law requires it, or to protect someone’s safety, or as part of a sale or merger of School & Steeple, in which case this policy would still apply to your information.

We don’t sell personal information, and we don’t rent or trade email lists.

How long we keep it

Sign-in links work once, for 30 minutes (24 hours when we send one after a phone verification), and are deleted a week after they expire.
Sessions end after 30 days or when you sign out; we delete the record 30 days after that.
Claim verification links work for 48 hours. The “did the school reply?” links work for 30 days.
Tour requests, claims and listing change history are kept so we can confirm delivery, answer questions from you or the school, and prevent abuse. We keep them until you ask us to delete them.
If you unsubscribe, we keep your email address on our do-not-email list so we can keep honoring it. Unsubscribe links don’t expire.
Billing records are kept as long as accounting and tax rules require.
Daily activity counts carry no personal information and are kept.

Your choices

Ask us for a copy of the information we hold about you, or to correct or delete it, using the contact details below.
Unsubscribe from our summaries and offers with the link in any of those emails.
Turn on Global Privacy Control or Do Not Track in your browser to stop the Meta Pixel and our server event.
Schools can update their listing from the dashboard and cancel a paid plan in the billing portal at any time.

Depending on where you live, you may have more rights under your state’s privacy law. We honor these requests for everyone, and we won’t treat you differently for making one. We may need to confirm the request came from you, for example by replying to the email address involved.

Children

School & Steeple is for parents, guardians and school staff. It isn’t meant for children, and we don’t knowingly collect information from anyone under 13. We ask only for a child’s grade, never a name or birth date. If you think a child has sent us information, contact us and we’ll delete it.

Keeping it safe

Tour requests, claims and school contact addresses are kept in a database that only our server can read; the public can read school listings only. Sign-in, verification, reply and unsubscribe links are stored only as one-way hashes, and the site is served over an encrypted connection. No system is perfect: if something happens that affects your information, we’ll tell you as the law requires.

Changes to this policy

When we change this page we update the date at the top. If a change affects how we use information you’ve already given us, we’ll say so here before it takes effect, and email schools with an account.

Contact us

Reply to any email you’ve had from School & Steeple and it reaches us. We read every message.