Loading page…
Last updated: October 6, 2026
UnTapped Genius (“UG,” “we,” “us”) operates untappedgenius.org, including Genius OS, the platform UG staff, consultants, and partner district and campus leaders use to manage partnership work, goals, and reporting. This page explains what information we collect, whether you’re just browsing the site or signed in to Genius OS, how we use it, and who it’s shared with. For the technical detail on how we protect it, see our Security Overview; for the deeper processing terms that apply to district and campus partnership data specifically, see our Data Processing Agreement.
If you sign in with Google, Google shares a small set of basic profile fields with us: your name, email address, and profile photo. We use this to create and secure your account and confirm you are who you say you are. We do not receive your Google password, and signing in does not by itself give us access to your Gmail, Drive, Calendar, or any other Google service. If your district has configured single sign-on through its own identity provider (for example Entra ID/Azure AD, Okta, or Google Workspace as an OIDC provider), we receive the equivalent basic profile fields from that provider instead. If you sign in with an email and password we issued, we store your email address and a securely hashed version of your password; we never store or can see your actual password. If multi-factor authentication is enabled on your account, we store a securely encrypted authentication secret and single-use recovery codes, not any biometric data.
Depending on your role, this can include your district or campus affiliation, and the goals, key results, evidence files, coaching or classroom video, KPI and observation data, meeting notes, and other partnership records you enter or upload while using the platform. Uploading coaching video also requires you to attest that the recording meets your district’s media/consent requirements for any students visible in it; we record who made that attestation and when.
If you or your administrator choose to connect Google Drive, Calendar, or Sheets to Genius OS, we request access only to the specific scope needed for that feature (for example, the folders or files you select, or calendar availability for scheduling). The resulting access token is encrypted before storage and is used only to provide the feature you connected; it is not used to read unrelated content in your Google account. You can disconnect a connected Google service at any time from your account settings or from your Google Account permissions page.
We log technical and security-relevant data automatically: your IP address, browser/user agent, the pages or actions you access, and, for every sign-in attempt (successful or not), a timestamp and reason code. We use a strictly necessary session cookie to keep you signed in and to protect the platform against cross-site request forgery; it is not used for tracking or advertising. On the public marketing site only, meaning pages reachable without signing in, we use Google Analytics (GA4) to understand page views and general site usage; it is never loaded inside the signed-in application. See our Cookie Policy for the full list of cookies we use.
We do not sell your personal information. We do not use your account data, the profile data we receive from Google Sign-In or your district’s identity provider, or your partnership content for advertising, and we do not use cookies for cross-site tracking. We do not use your partnership data to train third-party AI models outside what’s needed to generate the specific output you requested in the moment.
We share information only as needed to operate Genius OS, with named service providers, each scoped to a specific function (full current list on our Subprocessors page):
Each provider is contractually limited to using your information to provide its service to us, not for its own independent purposes. We don’t add a new subprocessor with access to district data without it appearing on the Subprocessors page.
We retain account and partnership data for as long as your account is active or as needed to support the partnership record. Some categories have a fixed schedule: uploaded coaching/evidence video is retained 60 days and knowledge-base video 180 days, both automatically purged afterward; sign-in attempt logs are retained 90 days; and encrypted database backups are retained for 30 days, then deleted automatically. At the end of a district’s partnership with UG, we work with the district to export or delete its partnership data on request, as described in our Data Processing Agreement. You can request that we delete your individual account and associated personal information at any time; see “Contact us” below.
Genius OS is built for district and campus partnership management between UG consultants and district staff. It is not designed to be a system of record for individual student-level education records, and student-identifiable data is not a data type the platform is built to collect as part of its core goal/KPI/evidence workflow. If student-identifiable data appears in a specific use case, for example inside an uploaded file, coaching note, or classroom video, it is because a user entered or uploaded it, not because the platform’s data model is designed to capture it as a structured field. See our Data Processing Agreement for how we handle that data as a processor on your district’s behalf, including FERPA “school official” designation language available on request as part of contracting.
Genius OS is intended for UG staff, consultants, and adult district and campus staff. It is not directed at children, and we do not knowingly collect personal information directly from children under 13.
Our application compute, database, file storage, and video storage are all provisioned in United States regions. Vercel’s content delivery network, which caches static public site assets, is global by design; application code execution and all persistent storage of your data stay in our configured U.S. region.
We use administrative and technical safeguards to protect your information, including encryption of data in transit and at rest, role-based access control, and activity logging; see our Security Overview for the specifics. If we become aware of a security incident involving your personal information, we will notify you or your district without undue delay, targeting within 72 hours of confirming the incident meets our notification threshold. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
We may update this policy from time to time. We’ll update the “Last updated” date above when we do, and if a change is significant, we’ll take reasonable steps to let you know, such as by email or an in-app notice.
Questions about this policy or your data? Email us at ug@untappedgenius.org or use our contact page.