Parent Software · family access · consent-first
What your family gets from the school photography platform — and the honest consent story behind it.
Your family’s gallery is consent-gated and walled to your own children. A guardian claims access by claim code or roster match and sees only their own child’s portraits — not another family’s. Finding your child is a roster lookup by name and grade, not a face-match query; that path computes no biometric template, and facial recognition is off by default. The sale of a portrait is gated on consent at the record level, fail-closed and per-subject: no consent on file, no sale. Consent can be withdrawn at any time. This page explains exactly what is built, what is in early access, and what the rails enforce — nothing more.
Galleries, picture-day proofing, free digital publications, and the consent controls described here are built and running. Family notification by text message is early access, not live. We say so rather than presenting in-progress work as finished.
The consent rails — what the code actually enforces
These are not policy statements a vendor might revise quietly. They are enforced at the code level, per-subject, fail-closed. Each one is described exactly as the system implements it.
Consent-gated galleries -- your child only
A guardian who claims their student by claim code or roster match enters a gallery that is walled to their own child. No family can browse another family’s portraits. The gallery shows only portraits whose publish consent is on file for that student. The wall is not a permission you set; it is enforced at the data layer, one school tenant at a time. Shipped
Consent withdrawable at any time
Consent is not a one-time enrollment checkbox. A guardian can withdraw at any time before the print window closes. When consent is withdrawn, the student’s portraits are removed from the gallery and from any sale queue. The withdrawal takes effect at the record level and propagates fail-closed through the pipeline. Shipped
Roster lookup, not face match
A guardian finds their child by entering the child’s name and grade. That is a query against the school’s roster — the same authoritative list the front office uses — not a facial recognition query. The standard find-my-child path builds no biometric template. Face matching is a separate per-child opt-in feature that is off by default; when it is on, the face template is held only inside our own private system, with no outside recognition service connected. The school sets a face-data retention window — 365 days by default — and that window is what marks a template due for destruction. Withdrawing the opt-in stops the matching. The step that destroys the stored template is not finished, and we are not going to tell you it runs nightly when it does not. Roster lookup shipped · template destruction not finished
Consent gates the sale, fail-closed, per subject
A portrait becomes purchasable only when consent on file says it may be — enforced in code, per student, using the canSellPhotoPrint gate. No consent record on file is treated as no consent, not as implied consent. A student whose guardian has not consented to sale does not appear in a purchase flow, regardless of whether their portrait is otherwise accessible to the family. Shipped
What a family receives
When picture day is complete, a guardian receives a claim code tied to their child’s roster entry. They use that code — or a direct roster match by name and grade — to open a private gallery containing only their own child’s portraits. There is no general photo browsing of the school’s picture-day set. There is no ad-supported storefront operated by an outside photo vendor.
The gallery shows portraits whose publish consent is on file. A guardian whose consent status is absent or withdrawn sees their child’s record with a clear explanation: the portrait is on file and available to school staff for the directory and ID cards, but it will not appear in a shared or purchasable gallery without consent.
Where a publication scope has opted into the free-digital tier, families who consented receive the digital yearbook or publication at no charge. That is a per-scope decision made by the school or district; not every publication is free-digital, and the page says so rather than presenting it as universal.
A guardian who wants to order prints selects size and quantity from the gallery. The sale is consent-gated at the record before the order proceeds. No order is placed for a student whose sale-consent record is absent or withdrawn. Ordering is always the guardian’s choice; nothing is charged automatically.
Picture-day proofing — the subject-sovereign step
Before portraits are released for the gallery or for print, a student, their guardian, or an adviser can verify their own roster entry through a subject-sovereign proofing step. The proofing surface shows the student’s name, grade, homeroom, and the portrait on file for them. A guardian can confirm that the information is correct and that the right portrait is associated with their child before anything is published or offered for sale.
This is an own-data carve-out, not a general data-access right. A student’s claim code gives access only to that student’s own entry — no proofing participant can review another student’s record. A typo in the name, a wrong grade assignment, or an outdated homeroom can be caught and corrected at this step before it propagates into the directory, the ID card composite, or the yearbook.
The proofing step does not require facial recognition. A guardian confirms the portrait they see is their child; they do not upload a reference photo to prove it. The association between a portrait and a student was made at capture time through the roster, not through a face-match query at the proofing step.
What is built and what is in early access
The galleries, the proofing step, the consent controls, and free digital publications where the scope opts in are live today. Notification by text message is early access. We label each one plainly.
Consent-gated, tenant-isolated family gallery
A guardian claims by claim code or roster match and enters a gallery walled to their own child, on the school’s own tenant. No guardian can view another family’s portraits. The gallery is not on a public URL and is not indexed by search engines. Portraits appear only when publish consent is on file. Shipped
Subject-sovereign roster proofing
A student or guardian verifies their own roster entry and portrait before release. The step is scoped to the student’s own record by claim code. No proofing participant can access another student’s record. Corrections made at this step flow through to the directory, ID cards, and yearbook. Shipped
Consent-gated portrait purchase
A portrait enters a purchase flow only when the per-subject canSellPhotoPrint gate reads a valid consent record. Absent consent is treated as no consent, fail-closed. A guardian whose sale consent is withdrawn is not shown a purchase option for that student’s portraits. The gate runs at the record level, not at the presentation layer. Shipped
Free digital publications
Where a school or district publication scope opts into the free-digital tier, consented families receive the digital yearbook or publication at no charge. The free-digital option is a per-scope decision configured by the operator; it applies to the publications within that scope, not to every publication on the platform. Shipped
Consent withdrawal — any time
A guardian can withdraw consent at any time. Withdrawal removes the student’s portraits from the gallery and from any active sale queue. The withdrawal is enforced at the record level and propagates through the pipeline fail-closed. It does not require a support ticket or a call to the school. Shipped
Family notification — free-tier posture
The platform supports a notification posture for families on the free tier. The data model and the notification chokepoint are built. Live text-message delivery to guardians is in early access; the architecture has the seam and the posture is designed, but text alerts are not live today. Early access
How the family access flow works
When picture day finishes, portraits are ingested into the platform’s private system. The pipeline binds each portrait to the student’s roster entry — by name, grade, and homeroom — at ingest time. There is no face-match step to associate a portrait with a student; the roster entry is the association.
- Claim code or roster match. The guardian receives a claim code from the school. Entering the code — or matching by name and grade on the roster — opens the family’s private gallery. No guardian account is required before the claim step; the code is the credential.
- Proofing. Before portraits are released to the gallery, the guardian or student can review the roster entry and confirm the portrait is correct. This step catches errors before they reach the directory, the ID card, or the yearbook. It is optional but recommended; the school can require it for their publication workflow.
- Gallery access. After the release window opens, the guardian enters the gallery and sees only their own child’s portraits. The gallery is walled at the tenant and family level. A portrait that does not have publish consent on file does not appear. A portrait that does not have sale consent on file appears in the gallery for the family to view but is not offered for purchase.
- Portrait purchase (if consented). A guardian who wants to order prints selects size and quantity. The canSellPhotoPrint gate re-checks consent at the time of the order. The order confirmation goes to the guardian; fulfillment ships to the address they provide.
- Free digital publication (if the scope opts in). Where the school or district has enabled the free-digital tier for the yearbook or another publication, consented families receive access to the digital edition at no charge. This is a one-time notification when the publication is released.
- Consent withdrawal. A guardian who wants to withdraw consent does so from the same claim interface used for the gallery. The withdrawal is effective immediately. Any portrait removed from publication consent is removed from the gallery. Any portrait removed from sale consent can no longer be purchased.
The privacy rails — what the system never does
Every statement on this page about minors’ data describes what the code enforces, not what a policy document says. Here is what the system does not do, and why the architecture makes it the default.
Face matching is off by default. The standard find-my-child path does not compute a face-recognition signature. Face matching is a separate per-child opt-in feature that is off by default; when it is on, the face template is held only inside our own private system, with no outside recognition service connected. A guardian reviewing the opt-in sees an opaque reference, never the template itself. The school sets a face-data retention window — 365 days by default — and that window is what marks a template due for destruction. Withdrawing the opt-in stops the matching.
One thing we will not overstate. The step that destroys the stored template is not finished, and we are not going to tell you it runs nightly when it does not. The cleanup job is built to refuse: when it cannot actually destroy a template, it halts and raises an alert rather than mark it deleted. We would rather leave that alert standing than record a deletion we cannot show you. When it can be demonstrated end to end, this page will say so plainly.
No public URL for a minor’s portrait. Portraits are never served on a public URL. They are not indexed by search engines. A portrait URL requires a valid authenticated session scoped to the family that holds publish consent for that student. A URL without a valid session returns nothing.
No portrait routing to outside AI or photo companies. Photos run on the platform’s own private system. A portrait is not sent to an outside AI service, an ad network, a data broker, or a shared photo-vendor storage environment. An outside fulfillment partner receives only the minimum information required to fulfill a specific print order that a guardian has placed — not a copy of the photo archive.
No family can see another family’s child. The family-isolation wall is enforced at the data layer, per tenant, per family claim. It is not a setting a guardian configures; it is a structural constraint the system applies. A guardian with a valid session for Student A has no path to a portrait associated with Student B.
No sale without consent on file. The canSellPhotoPrint gate is fail-closed. An absent consent record is treated as no consent. A student record without a sale-consent entry is invisible to the purchase flow, regardless of whether the guardian has gallery access. The gate runs at the record level, not at the front-end layer.
Common questions
How does a guardian access their child’s gallery?
A guardian receives a claim code from the school after picture day. Entering the code — or matching by the child’s name and grade on the roster — opens a gallery walled to that family’s own child. No guardian account is required before the claim step. The code is scoped to one student record; it does not provide access to any other student’s gallery.
Is “find my child” a face-match feature?
No. Finding a child’s portrait is a roster lookup: a guardian enters the child’s name and grade, and the system returns the portrait bound to that roster entry. It is the same kind of database query the front office uses to look up a student — not a facial recognition query. There is no biometric template in the system by default. Facial recognition is off by default. When a school turns opt-in facial recognition on, the face template it then builds is held only inside our own private system, with no outside recognition service connected. The school sets a face-data retention window — 365 days by default — and that window is what marks a template due for destruction. Withdrawing the opt-in stops the matching. Destroying the stored template itself is a step we have not finished, so we do not claim it happens on a schedule; the cleanup job halts and raises an alert rather than record a deletion it cannot carry out.
Can a guardian see another family’s child’s photos?
No. The gallery is walled at the family level and enforced at the data layer. A guardian who has claimed their own child has no access path to a portrait associated with another student. This is not a permission you set; it is a structural constraint the system applies regardless of how the session is presented.
What is the consent gate on portrait sales?
A portrait becomes purchasable only when a per-subject consent record is on file that permits the sale. The gate is the canSellPhotoPrint check, which runs fail-closed: an absent consent record is treated as no consent, not as implied consent. A guardian who has not provided sale consent — or who has withdrawn it — will not be shown a purchase option for that student’s portraits.
Can consent be withdrawn after it has been given?
Yes. A guardian can withdraw consent at any time through the same claim interface used to access the gallery. Withdrawal is effective immediately at the record level. Portraits for that student are removed from the gallery and from any active sale queue. Withdrawal does not require contacting the school or submitting a request to support.
What is the free digital publication and how does a family receive it?
Where a school or district publication scope has opted into the free-digital tier, consented families receive access to the digital yearbook or publication at no charge when it is released. The free-digital option is configured per publication scope by the operator; it is not a universal feature of every publication on the platform. Families receive a notification when their scope’s publication is available.
Are family notifications by text message live?
Not yet. The platform has a notification architecture and a free-tier notification posture designed for families. Live text-message delivery to guardians is in early access — the seam is built, but the live SMS dispatch is not connected. We say so plainly rather than claiming it as available.
Does the platform build a biometric template for any student?
No, by default. The system does not compute a face-recognition signature for any student as part of its standard operation. Facial recognition is off by default; no faceprint is built, stored, or used to locate a portrait. The default is no biometric template — not a setting a guardian has to find and disable.
How does this surface differ from parent.software?
parent.software is the sibling family portal: it covers the broader family hub, COPPA rights management, school publications, and the full consent substrate. parentsoftware.app is this page: the plain ‘.app’ family surface, focused on the consent and PII story specifically — what a family receives from the school photography flow, how consent gates the gallery and the sale, and how the roster-lookup architecture replaces face matching. The two cross-link; they do not duplicate.
Where is the school photography product described in detail?
The full school photography product — the private-system pipeline, the four-way revenue split, the studio operating model, and the directory and ID-card composites — is described at pholio.photos. This page covers the family-access surface and the consent rails specifically.
Related properties
Pholio Photos
The school-photography product families get their galleries through. Full details on the private-system pipeline, the directory and ID-card composites, the operating model, and the four-way revenue split.
Parent Software
The sibling family surface: the broader family hub, COPPA data rights management, school publications, and the full consent substrate. Cross-linked honestly; this page covers the consent/PII story for the photo gallery surface specifically.
Homeroom
The platform the family experience sits on: the shared student record, the single-school FERPA privacy wall, and the consent substrate that backs the gallery and the sale gate.
What is built and what is honest-off
The consent-gated, tenant-isolated family galleries (guardian claims by claim code or roster match and sees only their own child), the consent-withdrawal-at-any-time rails, the find-by-roster lookup with no biometric template, the canSellPhotoPrint consent gate (fail-closed, per-subject), the subject-sovereign roster proofing step, and the free-digital publication delivery where the publication scope opts in are built and running. Facial recognition is off by default; no template is built by default. Family notification by text message is early access: the architecture is built, live SMS dispatch is not yet connected. Money movement — pricing, checkout, and print-order fulfillment — is honest-off on this page; the portrait-sale flow exists at the platform level and is described plainly at pholio.photos. We name the status of every feature rather than hiding it behind a launch headline.
Parent Software is the family access surface from Stanley Studios — built on the Homeroom K-12 platform, one consented student record underneath.