Privacy is the product

Privacy & Cookies

Last updated: 5 June 2026

This notice explains what baton.school — our public marketing website — does with data. It is deliberately short, because the site collects very little: aggregate traffic and basic diagnostics, nothing for advertising. We don't sell data and we don't track you across the web.

This is about the website, not the Baton app. The Baton classroom platform is self-hosted by each school on its own infrastructure. Student data lives there, on the school's network, and never reaches us — it's governed by the data-processing agreement and DPIA we provide to that school, not by this notice.

On this page

  1. Who we are
  2. What we collect
  3. Cookies & your choices
  4. Booking a pilot (Google Calendar)
  5. Who processes data for us
  6. What we don't do
  7. How long we keep it
  8. Your rights
  9. Where your data is processed
  10. Changes & contact

1. Who we are

This website is operated by Media78 LLC, 34990 Emerald Coast Parkway, Suite 352, Destin, FL 32541, USA — the data controller for information collected here. Questions or requests: hello@media78.co.

2. What we collect

On this website, only the following:

Aggregate traffic & performance analytics

We use Cloudflare Web Analytics to count page views and understand how visitors move through the site — pages viewed, referring link, approximate region (country/city level), device/browser type, and basic load-performance measurements. It is cookieless: it sets no cookies, stores nothing on your device, reports only in aggregate, and cannot identify you. Legal basis: our legitimate interest in understanding traffic and keeping the site fast. Because it is cookieless and non-identifying, no consent is required for it.

Security & server logs

Our infrastructure providers (below) automatically log standard request data — including IP address, user agent, and timestamp — to deliver the site and protect it from abuse. This is ordinary web-server activity. Legal basis: our legitimate interest in security and reliability.

3. Cookies & your choices

We keep storage on your device to a minimum. Today this site sets only strictly-necessary cookies — Cloudflare's security cookies that keep the site available and protected. Our analytics and performance measurement (above) are cookieless and store nothing on your device, so they require no consent.

  • Strictly necessary — Cloudflare security cookies. Always on; no consent required.
  • Analytics & performance — cookieless (Cloudflare Web Analytics); sets nothing on your device.
  • Advertising / marketing — none. We don't use them.

We show a brief privacy notice for transparency. If we ever add a tool that uses non-essential cookies or similar storage, we will ask for your consent first and will not load it until you agree — and you'll be able to change your choice at any time. Nothing here affects your ability to use the site.

4. Booking a pilot (Google Calendar)

When you click “Book a pilot”, you are taken to a Google Calendar Appointment Scheduling page in a new tab. The name, email address, and any details you enter there are used by us solely to arrange and follow up on your pilot. Google processes that booking information on our behalf as our service provider, and Google's own cookies and terms apply on its page. We do not use booking details for advertising, and we don't sell them. Legal basis: your consent and steps taken at your request to arrange the pilot. See Google's privacy policy.

5. Who processes data for us

We keep the supplier list short and self-hostable in spirit. For this website:

ProviderRoleData involved
Cloudflare, Inc.DNS, CDN/proxy, TLS, security, and website analyticsIP address, request metadata, approximate location, device/browser; aggregate analytics
GitLab Inc.Static site hosting (GitLab Pages)Standard access logs for serving the pages
Google LLCAppointment scheduling — only if you book a pilotName, email, and details you submit on the booking page

These providers act under their own terms and our agreements with them. We don't share your data with anyone else.

6. What we don't do

  • No advertising or marketing trackers — none, anywhere on this site.
  • No selling or renting of personal data, ever.
  • No cross-site tracking or third-party ad profiles.
  • No behavioural profiling of visitors.
  • This site is not directed at children and does not knowingly collect children's data. Student data is handled only inside the self-hosted Baton app, on the school's own systems.

7. How long we keep it

We keep the data described above for up to one year, then delete it (or sooner if you ask us to):

  • Aggregate analytics — retained in aggregate for up to one year; no individual profiles are built or stored.
  • Security & server logs — retained for up to one year, then deleted.
  • Pilot booking details — kept for up to one year to arrange the pilot and our related correspondence, then deleted (sooner on request).

8. Your rights

Depending on where you live (for example under the UK/EU GDPR), you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email hello@media78.co and we'll respond within a reasonable time. You also have the right to complain to your data-protection supervisory authority.

9. Where your data is processed

We are based in the United States (Florida), and so are our main providers (Cloudflare, GitLab, Google) — so personal data collected through this site is processed in the US. If you visit from the UK, EU, or another region with cross-border transfer rules, this means your data is transferred to and processed in the United States. Where those rules require it, the transfer is covered by appropriate safeguards such as Standard Contractual Clauses and equivalent measures offered by us and our providers.

10. Changes & contact

We may update this notice as the site changes; we'll revise the “last updated” date above. For anything privacy-related, contact hello@media78.co.