Handover that survives graduation
When seniors graduate, the whole organization passes to the next owner in one step: roster, records, and money history.
What is reachable without signing in
Forms, a demo that runs on made-up data, and pages like this one. None of them shows a real organization's roster, events, or posts. A club can restrict its join form so that only students already active in another organization at the same school can request to join.
A verified badge, free
School staff verify their school once, and every organization there shows a note confirming it in their own settings.
No field for the people a program serves
A shift is named from the program's own list of activities. Coetio has no field for the people a program serves.
What stays private
Verifying a school adds a badge. It hands over no roster, no member list, and no attendance. There is no school-wide console, and no staff login reaches an organization's member records. Rosters belong to each organization, and personal details stay with its own owner.
- Age
- Accounts are for people 13 and older. The date of birth is checked on the server when the account is created.
- Personal details
- Roster details are visible only to an organization's leaders, unless a member opts into their organization's member directory. Phone numbers, including a guardian's, are visible only to the owner, and officer exports leave them out.
- Where the data sits
- Vercel hosts the application. Supabase holds the database, sign-in credentials, and uploaded files. Resend delivers email.
- When a student leaves
- Deleting an account removes the account and the records keyed to its email address. The organization keeps the roster row as its own history, with the name replaced and the email, phone, notes, and guardian details removed; its attendance, service hours, and completed work stay on that row.
Every record Coetio keeps, and who can read it, is listed in the privacy policy. How each protection is built, and where it stops, is on the security page.
How that is enforced
The first two come from how the records are stored. The rest are checked on the server every time someone asks.
- A date of birth stays with the account
- It is stored on the account. The roster screens, and every export and backup a leader can download, read the membership record instead, and that record has no date-of-birth column.
- The database answers nothing but the app
- Coetio's database is hosted on Supabase, which normally publishes an API that a key inside the web page can read. That API is switched off here two ways: row-level security on every table, and every privilege revoked from the public roles, including on tables that do not exist yet. Records move only through the app's own permission checks.
- Phone numbers stop at the owner
- An officer who can open the roster and export it cannot see a phone number, a guardian's included. Every screen and export that could show one checks on the server whether the reader is the owner. Beyond the owner, only accounts with platform administrative access can reach them.
- New attachments are private files
- Since late August 2026, a permission slip on a post or a set of minutes is stored as a private file. Coetio checks who is asking before it hands over a link, and the link stops working after a minute. Photos and banners uploaded since then are sent through the app after the same kind of check. Files uploaded before then still have a permanent public address.
- At a volunteer program, the front-desk tablet is a paired device
- A volunteer program pairs the tablet itself and stores only a hash of its token. It can see who is scheduled today and record their taps, and it can reach nothing else. A coordinator can revoke it from any device. A school club's tap-to-check-in screen is different: it runs on a leader's own signed-in session, so it should never be left unattended.
What Coetio does not have
Worth knowing before you decide.
- No outside audit. Coetio holds no SOC 2 and no ISO certification, and no security firm has been paid to test it.
- No compliance certification. Coetio is not a student-records system and is certified under no student-privacy framework. A school stays responsible for its own rules about student data and parental consent.
- No two-factor authentication. Signing in is a password, a one-time email link, or Google.
- No second host. If Vercel or Supabase has an outage, Coetio is down until they are back.
- No rehearsed restore. A backup runs every day and none is kept past 90 days. None has ever had to be restored, and restoring one has not been practiced.
- One person. Coetio is built and run by one high-school student. Nothing pages anyone at 3am, and an outage can run for a while before it is noticed.
What it costs
Nothing. Coetio is free for student organizations, for volunteer programs, and for schools, with the full toolset. Verification is a short form reviewed by a person, and the terms set out what an organization and its leaders are responsible for.
Questions from a school or a program go to support@coetio.com, or through the contact form.