Privacy policy

Last updated: October 23, 2026.

Who this site is for

BlueChimps is a purchasing tool for school district staff. Accounts belong to employees — teachers, office staff, purchasing and receiving. Students do not have accounts, do not sign in, and are not users of this site.

We do not collect, store, or process student data of any kind — no names, no student identifiers, no grades, no attendance, no education records. Nothing on this site is designed to receive it, and we ask districts not to send it to us. This means the site is not a school official under FERPA and is not directed to children under COPPA.

What we collect

• Account details you give us: name, work email, phone, school or district, job role.
• Shipping addresses for the places orders are delivered.
• Quotes and orders you create, including purchase-order documents you upload.
• Feedback you send with the feedback button: what you wrote, the page you sent it from, and your browser's identification string. Staff submissions may include a screenshot you attach.
• Sign-in records: when you last signed in, and the one-time codes we email you to confirm it is you. Codes expire after ten minutes and are erased once used.
• Visit counts: how many times each page was viewed each day, and which websites sent visitors here (the site's name only, not the page you came from). To count each visitor once a day, we also store a scrambled code made from your connection's IP address and browser identification string, using a key that changes every day. Soon after each day ends (midnight, Pacific time) we record that day's total and delete its codes and its key; after that the count cannot be traced back to anyone. The codes and keys are never copied into our off-site backups; our host's short-term disk snapshots, which expire within five days, can briefly hold them. Your IP address itself is never stored. This counter uses no cookies, so it is not one of the cookie choices below and runs whichever you choose. The daily counts themselves say nothing about any person, and we keep them.

What we don't collect

• No student data. See above — this one is absolute.
• No advertising trackers and no cross-site tracking pixels. Site analytics (Google Analytics) runs only if you allow it, with Google's advertising features switched off — see Cookies.
• No payment card details. Orders are placed against a purchase order and invoiced; we never see a card number.
• We do not sell or share personal information, and never have.

Who else handles your data

We use a small number of service providers to run the site. They process data on our instructions only, and none of them are permitted to use it for their own purposes.

• Fly.io — hosts the site and its database, in the United States.
• Zoho Mail — delivers our email: quotes, order updates, sign-in codes and password resets.
• California Department of Tax and Fee Administration (CDTFA) — when a quote is priced, the delivery street, city and ZIP are sent to the State of California's public tax-rate service so the correct local sales-tax rate is applied. No name, email, or order contents are sent.
• Cloudflare — stores our encrypted off-site backups, and provides DNS for our domains.
• Google (Google Analytics) — only if you allow analytics cookies: the pages you visit, how you arrived (for example from a search engine), your device and browser type, and your approximate location (city or region). Google's advertising features are switched off for our site, and Google states that Google Analytics does not log or store IP addresses.

How we protect it

• All traffic is encrypted in transit (HTTPS, enforced site-wide).
• Every account requires a second factor at sign-in, in addition to a password.
• Uploaded purchase orders and generated documents are access-controlled: being signed in is not enough — the request must belong to you, your organization, or BlueChimps staff.
• Backups are encrypted before they leave our server, using a key we hold offline. The backup system can create backups but cannot read them.

Cookies

Three categories, and you control the second and third:

• Strictly necessary — sign-in session, security tokens that protect forms from being submitted by other sites, your quote cart, your cookie choice itself, and an optional "don't ask for a code again on this device for 7 days" cookie. These cannot be turned off; without them you cannot sign in or build a quote.
• Personalization — one cookie (bc_recent) remembering which products you looked at, so we can show "Recently viewed" and suggest similar items. Only set if you allow it. Choose Essential only on the cookie banner to decline, and you can change your mind any time from the cookie preferences link in the footer.
• Analytics — Google Analytics cookies (_ga and _ga_…) that tell one visit from another, so we can count visitors and see which pages are useful. Only set if you allow them, and you can decline or change your mind the same way. They expire after two years.

How long we keep it

Quotes, orders and invoices are kept for about seven years as standard business records — they support warranties, returns, tax filing and accounting obligations. Contacts who leave a district can be deactivated: they disappear from day-to-day use but are preserved so past orders remain explainable.

Your rights

California residents have the right to know what we hold, to request deletion, and to opt out of the sale or sharing of personal information — we do not sell or share it. You can also ask us to correct anything that is wrong.

To exercise these rights, sign in and open Your data & deletion requests, or email us at the address below.

Some records must be kept even after a deletion request — a paid invoice is a tax record. Where that applies we will tell you what is being retained and why, rather than quietly keeping it.

Changes to this policy

If we change how we handle your information, we update this page and move the date at the top. Material changes affecting existing customers will also be emailed to the account contacts we have on file.

Contact

Questions, requests, or anything that looks wrong: corporate@bluechimps.com.

BlueChimps Supply, Inc.