Schoology Scraper, another website that publicly displayed student profiles, was taken down on Feb. 12. While Schoology Scraper was active, it mainly functioned as a registry containing over 10,000 profiles of both students and staff across every FUHSD educational group from the Classes of ‘24 through ‘29.
While active, the website featured five pages. The most expansive sections were a filterable directory of all FUHSD affiliates from the Classes of ‘24 through ‘29, as well as a game to match a random name or school to an individual. Schoology Scraper also included a face averager that could merge any two individuals’ faces, a page with an amalgamation of every district face and a site updates log.
The Database
The Epitaph interviewed the FUHSD student who created Schoology Scraper. We have verified their connection to the site, and they will be referred to as Jordan to protect their anonymity.
After the 2023-24 school year, public access to Schoology profiles was removed, Jordan said. Just before the start of the 2024-25 school year, Jordan said they collaborated with a graduated senior to create a database that digitally pulled, or “scraped,” these profiles to restore viewership.
“Originally, this site was only meant for close friends,” Jordan said. “Every year, you have club officer elections, and sometimes you have people apply, and you don’t know who they are. You’ve never seen their face. I’m sometimes really bad at names, so it helps you to associate a name with a face.”
To create the database, Jordan said they logged into Schoology and altered their profile URL to view the profiles of others. Then, in the span of a few hours, with a simple Python script shorter than 200 lines, Jordan said they created a JSON file with everyone’s name, photo and school.
Instead of saving these profile images to their computer, Jordan’s database only collected links to the content delivery network of Schoology’s servers, which contains available image assets from profiles. For individuals beyond the Classes of ‘24 through ‘28, profile images were not scrapeable, so only their names were included in the directory, Jordan said.
While the profiles of graduates or retirees are removed from Schoology, servers preserve their images under the same asset link. This allowed Jordan to access them even months later when applying the database to create the site, they said.
Within Schoology’s content delivery network, these links are accessible to the public without a login, Jordan said. However, using commonplace security measures, Schoology’s CDN could have been encrypted.
Creation and Takedown
Jordan said they personally coded the website with basic HTML, CSS and JavaScript around September 2025, using AI for debugging. It was hosted by Render, a free cloud application platform.
At the beginning of 2026, Jordan said they discussed growing concerns of Schoology Scraper’s misuse and publicity with one of their teachers, who was a fan of its face merger feature. Following this, Jordan said they ultimately decided to attempt taking down the site themself.
“[Schoology Scraper] wasn’t intended to be anything malicious, but as more and more people started using it, the immediate effects that I hadn’t thought of became pretty apparent,” Jordan said. “[Taking it down] was in the back of my mind for quite a while.”
The Epitaph notified HHS administrators of the existence of Schoology Scraper on Feb. 5, which they were not aware of previously. The information we provided was passed onto the district, which then contacted Schoology to remove the site, principal Denae Nurnberg said.
“We have taken action by submitting a takedown request to the hosting provider for the site you reported,” an email from a PowerSchool representative said. “This request is based on unauthorized use of Schoology content and the potential for misuse of student information.”
Before Jordan could remove Schoology Scraper themselves, their account and the site were terminated by Render, they said. Since Feb. 12, the site has been displaying, “This service has been suspended by its owner.”
Perspectives
Schoology Scraper was purely a passion project that spread by word of mouth, aiming to help individuals who needed to match a name to a face, Jordan said.
Sophomore Caden Li, who received the site’s link from friends, said he did not view Schoology Scraper as a large issue because its links to each profile were not obtained from hacking.
“The photos could be seen anyway, so it was kind of public already,” Li said. “If it’s something anyone can access, it doesn’t really harm anyone. But if it’s private, [administration] should take action against it.”
While Schoology Scraper did not display directly harmful content, other sites could have exploited its registry, Jordan said.
“[These kinds of sites] can actively demoralize students,” Jordan said. “If someone were to use those images from Schoology Scraper to make something similar to [HHS Rank] in the future, that would be very problematic.”
Future and Investigation
Jordan’s actions will likely not face legal action, Mike Hiestand, senior legal counsel at the Student Press Law Center, said. Unlike sensitive information such as test scores, the data on Schoology Scraper, like names and yearbook photos, are considered “directory information” that is legal to share.
“The level of wrongdoing seems fairly minimal,” Hiestand said. “Most laws out there that deal with hacking are all about getting access to information you don’t lawfully have access to. In terms of the type of data manipulation that was done here, [consequences] are going to be on a smaller scale.”
While Schoology Scraper’s creation possibly infringed upon the district’s Acceptable Use Policy, Hiestand said the absence of actual hacking shifts responsibility over digital security to PowerSchool, the company that owns Schoology.
Jordan said creating Schoology Scraper has allowed them to discover privacy issues in the Schoology infrastructure. Specifically, Jordan said the maintenance of alum photos and lack of any CDN protections must be addressed by PowerSchool in the future.
In parallel with Hiestand’s comment, Nurnberg said PowerSchool is now responsible for investigating who created Schoology Scraper and resolving Schoology’s security vulnerabilities.
“There wasn’t anything that was insecure on our side in our settings,” Nurnberg said. “PowerSchool, which owns Schoology, said they’ve been in constant communication with both [their] legal and security [teams] about next steps.”
Editor’s note: As of this article’s initial publication, PowerSchool’s investigation is ongoing, and no details have been publicly released yet. Due to this ongoing status, further details may be added at a later date.
Updates: The Epitaph learned of a similar site soon after publishing this article. To read more about it and FUHSD’s response to all Schoology-exploiting sites, click on this link.
![“We are the next generation of leaders. What we see in our social media is being censored, and what we can talk about in school is being controlled,” organizer Imaan Syed said. “That’s why our First Amendment rights are important, [so] that we can speak about anything we want to and continue to show out.”](https://hhsepitaph.com/wp-content/uploads/2026/02/2-1200x800.jpeg)
