SchoolFlow

Privacy Policy

Last updated: April 30, 2026

This Privacy Policy describes how SchoolFlow ("we", "our", "the platform") collects, uses, stores and protects information when you use the SchoolFlow student & parent mobile app and any related websites and APIs (the "Services"). SchoolFlow is provided to your school as a school management system; the school is the controller of student records, and SchoolFlow is the data processor.

1. Information we collect

1.1 Information you provide

  • Account information: name, email address, phone number, profile photo, preferred language, and the school code or invite code you use to sign up.
  • Family information: for parent accounts, the link between you and your child(ren) at the school.
  • Communications: messages, attachments, leave requests, RSVPs, quiz answers, and assignment submissions you send through the app.
  • Payment proofs: screenshots or PDFs you upload to confirm a fee payment. We do not collect or store full bank or card numbers ourselves.

1.2 Information we receive from your school

  • Enrollment, attendance, grades, schedule, course progress, fees and invoices, announcements, behavioral notes, and other academic records maintained by your school.

1.3 Information collected automatically

  • Device data: device model, operating system version, app version, language, and a Firebase Cloud Messaging (FCM) push token used to deliver notifications.
  • Usage and diagnostic data: error reports, crash logs, and basic API access logs (IP address, timestamp, endpoint) retained for security and operational purposes.

2. How we use information

  • To authenticate you and keep your account secure.
  • To deliver core features: dashboard, attendance, schedule, grades, assignments, courses, fees, messages, announcements, rewards, and notifications.
  • To send transactional and educational push notifications you have opted in to (and which you can mute by category in Settings).
  • To process and confirm school fee payments.
  • To investigate abuse, prevent fraud, and comply with applicable law.

3. How we share information

We do not sell your personal information. We share data only with:

  • Your school and its authorized staff, which is the primary purpose of the Services.
  • Sub-processors we use to operate the platform: Supabase (database, authentication, file storage, real-time), Vercel (hosting), Firebase Cloud Messaging (push notifications), Sentry (error monitoring), and Upstash (caching). Each is bound by a data processing agreement and processes data only on our instructions.
  • Authorities when required to comply with a valid legal request.

4. Children's privacy

SchoolFlow is designed to be used by school-age students under the supervision of their school and (where applicable) their parents. The school obtains parental consent for student accounts as part of enrollment. We do not knowingly collect personal information from children outside this school-managed context. If you believe a child has provided us information without proper consent, please contact us and we will delete it.

5. Data retention

Account data is retained for as long as your account is active at the school. When an account is deleted (see Section 7), personal identifiers are removed within 30 days, except where the school must retain academic or financial records to comply with law or its own record-keeping policy. Backups are purged on a rolling 90-day cycle.

6. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted, audited, and protected by multi-factor authentication. Row-Level Security policies in our database ensure that one school's data is never visible to another's.

7. Your rights and choices

  • Access & export: request a copy of your data via the in-app "Download my data" option (also available via GET /api/v1/portal/me/data-export).
  • Correction: ask your school to correct inaccurate academic or contact information.
  • Deletion: request deletion of your account at any time from inside the app (Settings > Delete Account) or via the web form at /account-deletion.
  • Notification preferences: mute any notification category from Settings.

8. International transfers

Our infrastructure runs on Supabase and Vercel data centers, which may be located outside your country of residence. We use standard contractual clauses or equivalent safeguards where required by law.

9. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be announced inside the app or via email. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

Questions, requests, or complaints can be sent to privacy@schoolflow.app.