How Photos Are Stored

SchoolMorph takes the security of student photos seriously. Here is how your data is stored and protected.

Private, encrypted storage

All photos are stored in private, encrypted storage hosted in Australia. Photos are never stored on public servers and are never accessible via a public URL.

Temporary access only

When you view photos in SchoolMorph (for example, on your project page), they are served via temporary signed URLs that expire within minutes. Even if someone intercepted a URL, it would stop working almost immediately.

Access control

Only the teacher who uploaded the photos can access them. Every request is verified through two layers of security:

1. Authentication -- The system confirms you are logged in and are who you say you are.
2. Project ownership -- The system confirms you own the project the photos belong to.

No other user, teacher, or SchoolMorph staff member can access your project's photos during normal operations.

No secondary use

Your photos are never used for any purpose other than creating your morph video. Specifically:

• Photos are not used for AI training
• Photos are not used for analytics
• Photos are not shared with third parties
• Photos are not used for marketing

Infrastructure

Storage is managed by Supabase, a trusted open-source platform, with row-level security (RLS) enabled on all database tables. This means access controls are enforced at the database level, not just the application level -- providing an extra layer of protection.

Further reading

• Automatic Photo Deletion -- How and when photos are removed
• Data Handling for Schools -- Compliance information for school administrators