Privacy policy

Last updated: August 17, 2026.

Who this site is for

BlueChimps is a purchasing tool for school district staff. Accounts belong to employees — teachers, office staff, purchasing and receiving. Students do not have accounts, do not sign in, and are not users of this site.

We do not collect, store, or process student data of any kind — no names, no student identifiers, no grades, no attendance, no education records. Nothing on this site is designed to receive it, and we ask districts not to send it to us. This means the site is not a school official under FERPA and is not directed to children under COPPA.

What we collect

• Account details you give us: name, work email, phone, school or district, job role.
• Shipping addresses for the places orders are delivered.
• Quotes and orders you create, including purchase-order documents you upload.
• Feedback you send with the feedback button: what you wrote, the page you sent it from, and your browser's identification string. Staff submissions may include a screenshot you attach.
• Sign-in records: when you last signed in, and the one-time codes we email you to confirm it is you. Codes expire after ten minutes and are erased once used.

What we don't collect

• No student data. See above — this one is absolute.
• No advertising trackers, no cross-site tracking pixels, no analytics profile built about you.
• No payment card details. Orders are placed against a purchase order and invoiced; we never see a card number.
• We do not sell or share personal information, and never have.

Who else handles your data

We use a small number of service providers to run the site. They process data on our instructions only, and none of them are permitted to use it for their own purposes.

• Fly.io — hosts the site and its database, in the United States.
• Zoho Mail — delivers our email: quotes, order updates, sign-in codes and password resets.
• California Department of Tax and Fee Administration (CDTFA) — when a quote is priced, the delivery street, city and ZIP are sent to the State of California's public tax-rate service so the correct local sales-tax rate is applied. No name, email, or order contents are sent.
• Cloudflare — stores our encrypted off-site backups, and provides DNS for our domains.

How we protect it

• All traffic is encrypted in transit (HTTPS, enforced site-wide).
• Every account requires a second factor at sign-in, in addition to a password.
• Uploaded purchase orders and generated documents are access-controlled: being signed in is not enough — the request must belong to you, your organization, or BlueChimps staff.
• Backups are encrypted before they leave our server, using a key we hold offline. The backup system can create backups but cannot read them.

Cookies

Two categories, and you control the second one:

• Strictly necessary — sign-in session, security tokens that protect forms from being submitted by other sites, your quote cart, your cookie choice itself, and an optional "don't ask for a code again on this device for 7 days" cookie. These cannot be turned off; without them you cannot sign in or build a quote.
• Personalization — one cookie (bc_recent) remembering which products you looked at, so we can show "Recently viewed" and suggest similar items. Only set if you allow it. Choose Essential only on the cookie banner to decline, and you can change your mind any time from the cookie preferences link in the footer.

How long we keep it

Quotes, orders and invoices are kept for about seven years as standard business records — they support warranties, returns, tax filing and accounting obligations. Contacts who leave a district can be deactivated: they disappear from day-to-day use but are preserved so past orders remain explainable.

Your rights

California residents have the right to know what we hold, to request deletion, and to opt out of the sale or sharing of personal information — we do not sell or share it. You can also ask us to correct anything that is wrong.

To exercise these rights, sign in and open Your data & deletion requests, or email us at the address below.

Some records must be kept even after a deletion request — a paid invoice is a tax record. Where that applies we will tell you what is being retained and why, rather than quietly keeping it.

Changes to this policy

If we change how we handle your information, we update this page and move the date at the top. Material changes affecting existing customers will also be emailed to the account contacts we have on file.

Contact

Questions, requests, or anything that looks wrong: corporate@bluechimps.com.

BlueChimps Supply, Inc.