CampusSteward LLC
These are the outside services that can receive personal information through CampusSteward, what each receives, and when. The list is generated from the code that makes the calls, so it changes when the platform does. Questions: contact@campussteward.com.
The services the platform runs on.
*.supabase.co
Database, sign-in and file storage.
Receives: All data held in the Service, including student records, accounts, messages and uploaded files.
vercel.com (hosting)
Hosting and serverless functions for the web application.
Receives: Every request to the Service passes through it, with request logs (IP address, browser, page).
*.upstash.io
Rate limiting shared across servers.
Receives: Request counters keyed by account id or IP address. No record content.
*.ingest.sentry.io
Error tracking.
Receives: Error reports: the error message and stack, the page or route, and identifiers involved (such as a district, user or student id). Never request bodies.
Outside services the platform calls when the operator has configured them.
www.googleapis.com/books, openlibrary.org
Book lookups + cover images for the Library catalog.
Receives: The ISBN or title being looked up. No borrower data.
api.resend.com
Transactional email delivery.
Receives: The recipient's email address and the subject and text of the email (invitations, notices, digests).
api.twilio.com
SMS alerts + notifications.
Receives: The recipient's mobile number and the text: sign-in codes, account alerts, emergency alerts and the notifications a person switched on.
browser push services (FCM / Mozilla / Apple)
Browser push notifications.
Receives: The device's push subscription address and an encrypted notification only that device can read.
api.search.brave.com or www.googleapis.com (Custom Search)
The owner-only web search preview at /steward sends the query an operator types (up to 400 characters) to Brave Search, or to Google Programmable Search when only that is set. Every search is recorded under Outside calls with the operator, host and size, never the query.
Receives: The search query a platform operator types into the owner-only web search preview. No district, school or student data is attached.
self-hosted / LiveKit Cloud (wss://…)
Scalable video meetings (SFU) for Convene.
Receives: Meeting audio and video and participants' display names, when Convene uses the server-routed mode.
operator-hosted WebSocket relay
Signaling relay for remote desktop control.
Receives: Remote-support session signaling (no screen or input). Not used unless the operator sets one up.
operator-supplied TURN server
ICE relay for remote control + Convene behind strict NATs. Each caller gets a short-lived TURN login minted from the shared secret.
Receives: Encrypted audio, video and screen streams relayed when two devices cannot connect directly, and their IP addresses.
api.open-meteo.com
Live weather for the signage weather slide + Stuart.
Receives: The site's location, for weather.
geocoding-api.open-meteo.com
City → coordinates lookup for weather.
Receives: A city name, to find its location.
api.dicebear.com
Draws School Adventurer avatars. Called by the server only (/api/avatars/adventurer) with a one-way pseudonym of the seed and the style options; browsers never contact it.
Receives: A one-way pseudonym of the avatar's seed and the chosen style options, sent by the server. Never an account id or anything of the viewer.
api.zippopotam.us
ZIP → city/state autofill on district/site forms.
Receives: The ZIP code typed into a district or site form.
fonts.googleapis.com / fonts.gstatic.com
Display fonts for the public scoreboard.
Receives: Requests for display fonts from browsers showing the public scoreboard (IP address and browser).
api.qrserver.com
QR image rendering (allowlisted).
Receives: Nothing today: the host is only allowed for images, and no page calls it.
Each district chooses these. Ones marked off by default send nothing until the district's leadership turns them on; the others can be turned off by the district.
geocoding-api.open-meteo.com, api.open-meteo.com
Stuart Plugins, per district; on until turned off
Receives: The place named in the question (whatever follows "weather in").
api.dictionaryapi.dev
Stuart Plugins, per district; on until turned off
Receives: The word or phrase to define.
api.frankfurter.app
Stuart Plugins, per district; on until turned off
Receives: The amount and the two currency codes.
geocoding-api.open-meteo.com
Stuart Plugins, per district; on until turned off
Receives: The place named in the question.
date.nager.at
Stuart Plugins, per district; on until turned off
Receives: A two-letter country code.
en.wikipedia.org, www.wikidata.org
Stuart Plugins, per district; off until the district's superintendent or district admin (or an owner seated in the district) turns it on
Receives: The subject of the question as typed (a born/died follow-up also looks the subject up on Wikidata).
newsapi.org
Stuart Plugins, per district; needs the district's own key
Receives: The topic asked about, and the district's NewsAPI key.
generativelanguage.googleapis.com, api.groq.com, openrouter.ai, the host in STUART_LLM_URL
General-knowledge AI in Stuart Plugins, per district; the platform picks the provider (STUART_LLM_*)
Receives: The current question as typed; for a follow-up ("when was he born") it is prefixed with the subject of the earlier general question, never the rest of earlier turns. When Stuart explains device documentation, also up to four device-manual or how-to passages. Never student notes, tickets or other article types.
api.anthropic.com
Per district, on IT → Integrations; off until the district's superintendent or district admin (or an owner seated in the district) turns it on, and needs ANTHROPIC_API_KEY
Receives: The text of the post or message a reader asks to translate, and the language wanted.
These run under the district's own account with the provider, are configured by the district, and are the district's vendors rather than ours.
googleapis.com (Calendar, Classroom, Admin Directory)
Directory, Calendar, and the Classroom course list (no roster) via one domain-wide service account.
Receives: Directory, calendar and Classroom course data the district's own Google Workspace returns and receives.
<district>.powerschool.com (/oauth + /ws/v1)
Connection check (school and student counts) and kiosk attendance write-back (beta). No roster or grade import yet.
Receives: Student and school counts, and attendance written back from the kiosk.
district-supplied base URL (Ollama / OpenAI-compatible)
Points Stuart at this district's own LLM endpoint.
Receives: The questions sent to the district's own model.
district-supplied REST endpoint
Offender / watchlist screening for the visitor kiosk.
Receives: A visitor's name, and date of birth when given, checked against the screening registry the district (or the operator) configures.
operator controller URL + api.ui.com (cloud)
Network controllers, clients, topology, and alerts.
Receives: Network device and client information from the district's own controllers.