Privacy Policy

Who we are

Fish is an app for schools, families and staff, made by Attack Penguin ("we", "us"). Schools sign up for Fish; your school creates your account and decides which of its people use it.

For information about students and families, your school is in charge of it and we act on its behalf. In law this makes your school the owner of the data and us its service provider: we only use it the way our agreement with your school allows. Where the U.S. Family Educational Rights and Privacy Act (FERPA) applies to your school, we act as a "school official" under its direct control.

What we collect

From your school

• Names, email addresses and roles (parent, student, teacher, staff, principal)
• Which classes and groups people are in, and which adults are linked to which children
• Contact cards for students: names, phone numbers, addresses, and who may pick a child up
• Anything your school sends through Fish: posts, events, forms, documents such as report cards, bills, lunch menus

From you

• Your profile: name, photo, mobile number, and how you like to be notified
• What you write and share: chat messages, posts, photos, replies to forms, event responses
• What you tell the school: absences, changes to how your child goes home, volunteer hours
• What you choose to share with other families, such as your email or phone number in the family directory
• Orders and payments. Card and bank details go straight to our payment provider, Stripe, and never reach Fish

When you use Fish

• Sign-in records: when you signed in, from which browser or device, and its IP address
• A device token, if you turn on notifications in the app
• Which notifications you've read, and which school posts you've opened, so a teacher can see who has seen a post
• Error reports when something breaks, sent without personal information

We don't use advertising or analytics trackers.

How we use it

• To run Fish for your school: show you your school's posts, classes, calendars, forms and messages, and deliver notifications
• To take payments your school asks for
• To keep Fish secure, and to stop misuse such as spam or abuse
• To help when you or your school asks us for support
• To improve Fish, using only information that doesn't identify anyone

What we never do

• Sell or rent anyone's information
• Show advertising, or use what students do in Fish to target advertising anywhere
• Build a profile of a student for any purpose other than your school's
• Use what a school puts in Fish for anything that school hasn't asked for

Who can see what

• Your school's staff see what their role needs: a teacher their classes, the office the whole school.
• Other families see what you share with them: posts and messages in a class or group you're in, and, in the family directory, your name and your children's, unless you take yourself out. Your school decides whether the directory shows each family the classes their children are in, or the whole school.
• Fish support only views the app as one of your school's people when your school has turned on support access, and every time is recorded in a log your school can read.

When we share it

• With the services we use to run Fish, each bound to protect it as we do. They're listed on our sub-processors page, and schools hear from us before we add one.
• When the law requires it, such as a valid court order, and only what is required.
• To protect someone's safety, or the security of Fish.
• If Attack Penguin is ever sold or merged, only to a company that keeps this policy for the data it receives.

AI assistants

If your school turns on FISH AI and you connect an AI assistant to your account, the assistant can read what you can already see in Fish when it asks. That's your choice, made one assistant at a time, and you can disconnect it whenever you like. What the assistant's maker does with it is covered by their own terms. Student records and health information are never available to assistants.

Children

Students may have Fish accounts that their school creates, for school purposes only. For children under 13, the school gives consent on behalf of parents for that school use, as the U.S. Children's Online Privacy Protection Act (COPPA) allows. We collect only what a student needs to take part in their classes, and a parent can ask the school to see or delete their child's information at any time.

Your choices

• See and correct your information on your profile. Roster details such as a child's class come from your school; ask the office to change them.
• Choose how you're notified, on your profile.
• Choose what other families see: you can take yourself out of the family directory at any time, and your email and phone number appear there only if you choose.
• Ask to delete your account whenever you like. Your school decides, because your account is part of its records. See how to delete your account.
• Ask for a copy of, or the deletion of, your child's information. Ask your school: it decides, and we carry it out for them.

Keeping it safe

Everything travels encrypted and is stored encrypted. Sign-in uses one-time links and passkeys, not passwords. Only a few people at Attack Penguin can reach the systems Fish runs on, and every change to Fish passes automated security checks before it ships. More on our security page.

How long we keep it

• While your school uses Fish, for as long as your school needs it.
• When your school deletes your account, your name, email, phone number and photo are erased straight away. What you posted or reported to the school stays as the school's record, shown as "Deleted user".
• When a school stops using Fish, we give the school a copy of its data if it asks, then delete it within 60 days.
• Backups roll over on a fixed schedule, so deleted information leaves them too.

If something goes wrong

If we learn that information in Fish has been seen or taken by someone who shouldn't have it, we tell the affected schools within 72 hours of confirming it, help them tell the families involved, and give every notice the law requires.

Changes to this policy

We'll post any change here with a new date. If a change matters to how your information is used, we'll tell schools first and ask you to agree again the next time you open Fish.