K12 Cyber Forward helps Georgia school systems strengthen cybersecurity, so we hold ourselves to the same standard we teach: collect only what we need, protect it well and tell you exactly what we do.
Effective 11 October 2026 · Operated by GLET — Georgia Leaders of Educational Technology, Georgia's CoSN chapter
1. Who we are
K12 Cyber Forward is a program of GLET — Georgia Leaders of Educational Technology, Georgia's chapter of CoSN (the Consortium for School Networking). GLET runs this website and the district and program portals. CyberCon GA is GLET's annual cybersecurity conference. In this notice, "we" means GLET and "you" means anyone who visits the site or uses the portals.
Preview period: right now the portals contain synthetic demonstration data only. No real district records are stored yet.
2. What we collect
When you visit the website
Our server records the page requested, the time, whether it worked, how long it took and your browser type. For routine visits we store a one-way, keyed fingerprint of your IP address instead of the address itself, and our everyday web server logs leave IP addresses out. For security, our firewall and attack-detection tools record the IP address of requests that look like attacks, are blocked, or fail to sign in, and keep it for up to 30 days. We do this to protect the platform and the school data districts entrust to us, and we use it only to detect, block and investigate misuse.
When you request participation
The form asks for your district or school system, your name, your role or title, your work email and the areas you are interested in. We use it to review the request and get back to you.
When you contact us
The contact form asks for your name, role or title, organization, work email, an optional phone number, a topic and your message. Only the GLET program team can read it, and we use it to reply and to keep a record of how your message was handled.
When you have an account
Your username, display name, role and district. Your password is stored only as a one-way hash we cannot read. If you turn on an authenticator app, its secret is encrypted. We also keep a record of sign-ins and security events so accounts stay accountable.
What districts add to the portal
Assessment ratings and notes, improvement plans, policies, vendor and training records, evidence files, learning progress and, for insurance pool members, program financial records. Your district decides what to add.
Please keep these out of the portal: student records or student names, staff personal details beyond work contact information, and passwords, recovery keys or other secrets. The portal is built for policies, settings and evidence of practice, not for personal records.
3. Cookies and browser storage
A cookie is a small file your browser keeps for a website. We use only four, and every one is needed for the site to work or stay secure. Because none of them track you or serve ads, we don't show a cookie banner.
Every cookie and storage item we use
Name
What it does
How long it lasts
cr_session
Keeps you signed in after you log in. Your browser's scripts can't read it, and it is only sent over encrypted connections.
Until you sign out, after 2 hours of inactivity, or 24 hours at most
cr_csrf
Protects your account by making sure changes you submit really come from this site (cross-site request forgery protection).
Same as your sign-in session
glet_join_nonce
Helps stop automated spam on the participation request form. Sent only to that form.
15 minutes
glet_contact_nonce
Helps stop automated spam on the contact form. Sent only to that form.
15 minutes
cr_intro_dismissed (browser storage, not a cookie)
Remembers that you closed an introductory message, so it doesn't reappear.
Until you clear your browser data
cc-conversation, cc-guide, cc-highlight, cc-open (browser session storage, not cookies)
Keep your current GLET AI conversation, walkthrough step and panel open while you move between pages.
Until you close the browser tab
You can block or delete cookies in your browser settings. If you block cr_session, you won't be able to sign in.
4. How we use information
To run the program: provide your district's workspace, reports, learning and support.
To keep it secure: sign you in, prevent misuse, investigate problems and keep an accountable record of important actions.
To support you: respond to participation requests and questions.
To improve the program: understand, in aggregate, which tools districts use and where statewide help is most needed.
To meet legal obligations: when the law requires it.
GLET staff see program-wide results to target support. Comparisons between districts are switched off until participating districts agree to clear rules for sharing.
5. What we never do
Sell, rent or trade your information.
Show advertising or use advertising or social-media trackers.
Use third-party analytics services. Visit statistics are counted on our own server.
Follow you around other websites.
Use your district's information to train artificial-intelligence models.
Let a district's results decide insurance coverage automatically. Those remain separate, human decisions.
6. Who can see it
Every person has their own named account and sees only what their role needs. District staff see their own district. GLET staff see what their program role requires. Independent reviewers and outside contractors see only the cases or tasks assigned to them.
We share information outside GLET only:
with our hosting provider, which runs the server in Atlanta, Georgia, and does not use your information for its own purposes;
with partners your district chooses to work with through the portal, limited to what you share with them;
with our AI provider (Anthropic), only when your district has turned on GLET AI and someone asks it a question that needs an AI answer — see GLET AI;
when the law requires it, or to protect the safety and security of people or the service.
Our security certificate provider only ever sees our website's name, never your information.
7. Students and children
K12 Cyber Forward is a tool for school-system staff and leaders. It is not designed to collect information from students and is not directed to children under 13. We don't knowingly collect children's personal information. If you believe a child's information was entered, contact us and we will remove it.
Districts remain responsible for student records under laws such as FERPA and Georgia's Student Data Privacy, Accessibility, and Transparency Act. That's why we ask districts to keep student records out of the portal entirely.
8. How we protect it
Encrypted connections (HTTPS) everywhere, with strict browser security settings.
Uploaded files encrypted at rest with AES-256, using keys stored separately from the data.
Named accounts, least-privilege roles, optional authenticator-app sign-in (required for GLET administrators in production) and sign-in rate limiting.
An accountability log of sign-ins, denied actions and important changes. Financial postings need two different people.
A hardened, monitored server with regular security updates and independent security checks.
No system is perfect. If a security incident affects your information, we will tell affected districts and people promptly and as required by law.
9. How long we keep it
Retention
Information
Kept for
Web server logs (no IP addresses)
7 days
Security and firewall logs (IP addresses of suspicious, blocked or failed sign-in requests)
30 days
Website visit statistics (fingerprinted, no IP addresses)
180 days
Contact form messages
While we respond, then up to 24 months after the conversation is closed. A short record of how a privacy request was handled is kept as an accountability record.
Server backups
14 days, then overwritten
Account and district program records
While your district participates. Afterwards we return or delete them on request, except where we must keep a record for legal, audit or accountability reasons.
Security and accountability history
Kept with the program record so actions remain traceable
GLET AI conversations
The period your district chooses, between 30 and 90 days (60 by default); you can delete your own history at any time
GLET AI usage records (counts and costs, no question text)
Up to 400 days
10. Your choices
See and download: districts can export their reports, plans and evidence from the portal at any time.
Correct: update your own details, or ask your district administrator or GLET.
Delete: ask us to delete your account or your district's information. We will confirm what can be deleted and what must be kept, and why.
Stop participating: a district can leave the program at any time.
We respond to requests within 30 days and may need to confirm who you are first.
11. GLET AI
GLET AI is an optional coach inside the portal. A district administrator decides whether to turn it on, which roles can use it and how long conversations are kept. Each person can also turn it off for themselves.
Many questions never reach an AI model. Status questions, definitions and how-to walkthroughs are answered by the portal itself.
When an AI answer is needed, the question and the minimum district information needed to answer it — scores, counts, statuses, titles and dates — are sent to our AI provider, Anthropic. Email addresses, phone numbers and the names of people in your district are removed first.
No training on your data. Under the provider's commercial terms, it does not use this information to train its models. It may keep requests for a limited time for safety and abuse monitoring, as its terms describe.
Nothing changes without you. GLET AI can prepare a change, such as a new action item, but it runs only after you confirm it, with your own permissions.
Program review is opt-in. The GLET program team can review conversations for quality only if your district allows it.
If we change how we handle information, we'll update this page and its effective date. For significant changes, we'll also let participating districts know.
Questions or requests? Use our contact form and choose "Privacy request", or contact GLET through theglet.org. Participating districts can also reach us through their GLET program contact.
