Security & Privacy
Plain answers to the questions
most software avoids.
A school's institutional memory is sensitive. Here is exactly how we treat it.
Your data is yours.
The records in MAT are your school's institutional memory. They belong to you — not to MAT, not to Children's House, not to any other school. You can take them with you, at any time, unconditionally.
You can take it with you, any time.
The right to export is unconditional and permanent. Every record — materials, observations, stock takes, valuations — can be exported in full at any time, in a standard format, without prior notice and without needing to ask permission.
Schools are fully isolated.
No school can ever see another school's records. The isolation is enforced at the database level using Row Level Security — not just at the application layer. There is no way for a user in one school to access data from another, regardless of their role.
Your passwords are not stored.
Authentication is handled by Supabase Auth, using Google OAuth or email-based magic links. MAT never holds your password. Access tokens are short-lived and managed by a purpose-built authentication infrastructure.
Data is encrypted in transit.
All communication between your device and MAT is encrypted using TLS 1.3. Nothing travels over plain HTTP.
Role-based access limits exposure.
Each person in your school sees exactly what their role requires. A Guide sees their classroom. An Accountant sees financial reports. An Auditor sees verification history. Nothing bleeds across roles.
Institutional memory belongs entirely to the school — permanently, and portably.
This is not a policy subject to change. It is a design constraint.
The full legal detail is in our Privacy Policy and Terms of Service.