What we collect, and why.
Last reviewed October 28, 2026
Bluebird Tutor LLC builds software for classrooms. Most of what we handle is student attendance data that belongs to the colleges we work with. This page explains what we collect on this website, in the free Rollbook tool, and in Rollbook Pro, what we do with it, and how to reach us.
— The short version: we collect as little as the job requires, we never sell it or use it for advertising, we never use it to train AI models, and the college that entrusts it to us always owns it.
Who we are
Bluebird Tutor LLC is a North Carolina limited liability company based in Raleigh, NC. For anything in this policy, contact James Farlow, Founder, at james@bluebirdtutor.com.
This website
bluebirdtutor.com is a static marketing site. It sets no advertising or tracking cookies. We use Vercel Analytics, which records page views in aggregate without cookies and without identifying individual visitors.
If you sign up for email updates, we store the address you give us with Buttondown, the service that sends the emails. We use it only to send those updates. Every message has an unsubscribe link, and unsubscribing deletes you from the list.
Our hosting provider, Vercel, keeps standard server logs (IP address, browser, pages requested) for a short period for security and operations.
The free Rollbook tool
The free converter at bluebirdtutor.com/tools/rollbook runs entirely in your browser. The Teams attendance file you drop onto it is parsed on your computer and is never uploaded to us or to anyone else. Nothing you enter is stored. When you close the tab, it is gone. The ADVANSYS bookmarklet copies data to your clipboard and pastes it into a page you are already signed in to; we never see it.
Rollbook Pro
Rollbook Pro is a subscription service for community college adult education programs. Instructors use it to reconcile class attendance before entering it into the state reporting system. The data it processes are student education records protected by FERPA.
We process this data on behalf of the college, not for ourselves. Each college signs a Data Processing Agreement that designates Bluebird Tutor a school official under FERPA (34 CFR 99.31(a)(1)(i)(B)), puts the data under the college's direct control, and limits our use of it to providing the service. The college owns the data, decides who at the college can see it, and can export or delete it at any time.
What Rollbook Pro collects
| Data | Where it comes from | Why |
|---|---|---|
| Staff account: name, institutional email, Microsoft account identifier | The college's Microsoft sign-in | To sign instructors and administrators in and attribute their actions |
| Class rosters: student first and last name, student ID, optional institutional email | Uploaded by the instructor from the college's student list | To match attendance to the right student |
| Attendance: dates, join and leave times, contact hours, instructor notes | Microsoft Teams attendance exports or paper sign-in sheets | To produce the attendance record the college reports |
| Photos of paper sign-in sheets | Taken by the instructor | To read the sheet into attendance rows; kept with the session as the record of what was signed |
| Audit log: who did what, when, from what address | Generated by the service | Accountability and FERPA record keeping |
We do not collect Social Security numbers, dates of birth, home addresses, phone numbers, grades, financial aid information, or demographic data. When an instructor uploads a student list, the roster import reads only first name, last name, and email and ignores every other column.
How Rollbook Pro protects it
- Sign-in through the college. Instructors use their existing Microsoft 365 account. We store no passwords.
- Access limited in the database itself. Every record is tagged with the college it belongs to, and database-level rules prevent anyone from reading or changing records outside their college. Within a college, an instructor sees only the classes they teach; a program administrator sees the college's records.
- No casual access by us. Bluebird staff cannot browse college data. Support access requires a written reason, is read-only, expires after one hour, and appears in the college's own audit log.
- Encrypted and hosted in the United States. Data is encrypted in transit and at rest and stored on AWS infrastructure in the United States.
- Tamper-evident history. Every change is written to an append-only audit log that cannot be edited or deleted, even by us.
The sign-in-sheet reading feature
Rollbook Pro can read a photo of a paper sign-in sheet into attendance rows. This feature is off by default and is turned on for a college only when its agreement with us covers it. When it is on, the photo is sent to a commercial AI service (Anthropic, or OpenAI if Anthropic is unavailable at that moment) with a fixed instruction to read the names, IDs, and times on the sheet. Nothing from our database is included; only the image. Neither service uses the image to train its models, and both delete it within 30 days (each keeps API inputs only for abuse monitoring in that window). Every row it reads is a draft that the instructor reviews and corrects before anything is recorded or exported. The photo itself is stored with the session, visible only to the instructor and the college's administrators, so the signed sheet stays with the record it produced.
Who else sees the data
We use a small number of service providers to run Rollbook Pro. Each is bound by contract to use the data only to provide its service to us and to protect it. Colleges are notified before any provider is added.
| Provider | Role | Location |
|---|---|---|
| Microsoft | Sign-in (Entra ID), operated by the college | College's tenant |
| Supabase | Database, authentication, file storage | United States (AWS) |
| Vercel | Application hosting | United States |
| Anthropic | Reading sign-in-sheet photos (only when enabled for the college) | United States |
| OpenAI | Reading sign-in-sheet photos, only as a fallback when Anthropic is unavailable | United States |
We do not sell data, share it with advertisers, or disclose it to anyone else except as the college directs or as required by a valid legal order. If we receive a legal demand for a college's data, we notify the college before responding unless the law prohibits it.
How long we keep it
College data is kept for as long as the college subscribes, then remains available for export for 90 days and is deleted. Audit log entries are kept for seven years for accountability. Sign-in-sheet photos stay with their session until the instructor or the college removes them or the college's data is deleted. Email list addresses are kept until you unsubscribe.
Your rights
If you are a student, your FERPA rights to inspect and correct your education records run through your college. Contact your college's registrar or adult education office; we will give the college everything it needs to respond, including a complete export of your records in Rollbook Pro.
If you are an instructor or administrator with a Rollbook Pro account, you can see your own account details in the application and ask your college or us to correct them.
If you signed up for our email list, you can unsubscribe from any message or email us to be removed.
Students under 18
Rollbook Pro is used by colleges, and students are generally adults. Where a college enrolls students under 18 (for example, dual enrollment), their records are handled under the same FERPA agreement with the college. We do not knowingly collect information directly from anyone under 18, and the service has no student-facing interface.
If something goes wrong
If we learn of a security incident affecting a college's data, we notify the college within 72 hours of confirming it, tell it what was affected, and support any notification it decides to make. We comply with North Carolina and federal breach notification requirements.
Changes to this policy
When we change this policy in a way that matters, we update the date at the top and tell subscribing colleges directly. Earlier versions are available on request.
Contact
Bluebird Tutor LLC, Raleigh, North Carolina. james@bluebirdtutor.com. Colleges evaluating Rollbook Pro can also request our security documentation, Data Processing Agreement, and a completed HECVAT.