The release form
The form governs almost everything. There is one thing underneath it.
Districts put a great deal of care into the photo release, and it deserves the credit: it settles the yearbook, the composite, the corridor, the assembly and what staff may see. What it cannot do for an elementary student is open the door onto the public internet, and understanding why is worth ten minutes.
The order the system asks its questions in
Order is the whole thing here, so it is worth setting out plainly.
First: how old is this student? If they are under thirteen — or if their date of birth is missing or unknown, which is treated identically — publication to the open web is refused, and the system stops. It does not go on to consult the release, because there is nothing the release could add.
Second, and only for a student who cleared that: has this family actively agreed to publication, and is that agreement still current? This permission defaults closed. A family that has not answered is treated as not having agreed.
On an elementary roster, nobody ever reaches the second question. That is what makes it a floor rather than a default: it is not the position of a switch, it sits under the switch.
The practical consequence for your district. If your communications team has been sourcing website and social images from elementary picture day, that will not work through this system, and no amount of paperwork changes it.
We would rather you knew in the first meeting. It is the single most common reason a district decides this is not for them, and it is a legitimate reason.
What the release does govern, which is most of it
It would be easy to read the section above and conclude the form is pointless here. It is the opposite: because the public door is closed anyway, the release is doing its real work everywhere else, and everywhere else is where schools actually live.
| The use | Governed by the release? | What happens when a family says no |
|---|---|---|
| The yearbook and the class composite | Yes, decisively | The student is not in it, and the gap is not filled |
| A display in a corridor or an assembly slideshow | Yes | Excluded when it is composed, not edited out afterwards |
| What other staff in the school can see | Partly -- role limits apply as well | Both have to allow it; either one refusing is a refusal |
| What the student's own family can see | No -- this is their own child | Unaffected; a family always sees its own student |
| The open web | No -- the age floor decides first | Refused for every elementary student either way |
Three details that catch districts out
An opt-out form does not behave like an opt-in system. Our publication permission defaults closed: a family that never returned the packet is treated as not having agreed. If your district form is an opt-out — publication assumed unless a family objects — then your paperwork and your system disagree about the silent families, and that gap is worth finding before adoption rather than after.
A withdrawal applies the next time anybody looks. It is not queued for an overnight job. Because what a person may see is worked out when they ask rather than remembered from when it was granted, a March withdrawal reaches the yearbook composition in March.
A missing date of birth is treated as under thirteen. Not as unknown-therefore-proceed. On an elementary roster this changes nothing, since the whole roster is held anyway — but it is the same rule in every band, and it is the reason a student who moves up to a middle school does not quietly become publishable because a field was blank.
How a photograph reaches the right student
By a permission-checked lookup on your own roster: a name and an id. It is dull on purpose. Your teachers already know who was in the class, so the interesting alternative — sorting photographs by recognising faces — would answer a question the roster has already answered while creating a stored biometric template for every child in the building.
That capability exists in the wider platform. It is off unless a parent switches it on for their own child, it is never bundled into a publication permission, and where it is on, the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking.
The piece we have not finished, in the same size type as everything else. Destroying a stored template at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, or on withdrawal, or at the end of the window.
What we can tell you is how it fails: when the cleanup cannot actually destroy a template it stops and raises a standing alarm rather than marking one gone, and that alarm stays where a district can see it. A quiet failure is the worse outcome and it is the one it was designed against. When the whole chain can be shown, this will say so.
The questions a district asks
So what is the release form for, if it cannot authorise the website?
A great deal. It governs how a student's image may be used inside the school and the district: the yearbook, the composite, a display in a corridor, a slideshow at an assembly, what may be shown to other staff. Those are the uses that make up almost all of a school's actual photography. The public internet is the one door it does not open for this age group.
Our district form has an opt-out rather than an opt-in. Does that work here?
The system's own publication permission is opt-in and defaults closed, which means a student whose family has not answered is treated as not permitted rather than as permitted. If your district form is written the other way round, that gap is worth surfacing before you adopt anything, because it is a difference between what your paperwork says and what your system will do.
What happens when a student's date of birth is missing?
They are treated exactly as an under-thirteen student is: held. An unknown age is not a reason to proceed, it is a reason to stop. On an elementary roster this changes nothing in practice, because the whole roster is held anyway -- but it matters when a family moves up, and it is the same rule everywhere in the platform.
A family withdrew consent in March. What reaches the yearbook?
Nothing of that student, because the yearbook is composed from the same library the permission lives in rather than from copies imported earlier in the year. That is the practical reason to keep the images and the permissions in one place: a withdrawal that has to be carried between two systems is carried by somebody's memory, and memory fails in the week of a print deadline.
Can you confirm our district is meeting its obligations?
No, and be wary of anyone who will. We can tell you precisely what the system blocks, when it re-checks it, and what it refuses to do. Whether that satisfies your district's obligations is a question for your district and its counsel. What we can do is make sure the answer does not depend on whether somebody in your front office remembered.
What have you not finished?
One thing, and it is on this site rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can yet demonstrate from one end to the other. The cleanup is built to stop and raise a standing alarm rather than mark a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so and not before.