Privacy Policy — STS

STS (Student Tracking System) is a school management application that lets school administrators, teachers and parents follow students' academic and financial records. This policy explains what data the app processes, how it is used, and how it is protected.

1. Who uses the app

The app is intended for adults (18+): school administrators, administrative staff, teachers, and parents. Students are not users of the app; a student's account is operated by their parent or guardian.

Users cannot register themselves. All accounts are created exclusively by the subscribing school. There is no public sign-up.

2. Data processed

Data is entered by the school or its authorised staff, not by the end user. Most fields are optional and filled in at the school's discretion.

2.1 Account data

• A login email address — an internal identifier generated by the school, not a real mailbox, never used for correspondence.
• Role (owner · administrative · teacher · parent) and school identifier.
• A device push token, if notifications are enabled.

2.2 Student data

Required: full name (three parts), class, division.

Optional, at the school's discretion: date of birth, gender, mother's name, contact phone number, address, profile photo, bus number, marks, attendance records, merit points, fees and payments.

2.3 Teacher and staff data

Required: full name (three parts).

Optional: date of birth, gender, phone number, address, specialisation, short bio, profile photo.

2.4 Device permissions

The app does not collect location, contacts, microphone data, or any advertising identifier.

3. Data about minors

The app is not directed to children and is not used by them. School records do, however, contain information about students who are minors.

• No data is collected directly from a child.
• Student data is entered by the school acting as data controller, under its contractual relationship with the parent.
• The school is responsible for obtaining any consents required by the laws applicable to it.
• A student's data is visible only to their parent and to the teachers responsible for their division.

4. How data is used

Data is used solely to operate the service: weekly timetable, marks, attendance, homework, exams, school events, and fees.

We do not sell data, share it with advertisers, or use it for ad tracking or behavioural analytics. The app shows no commercial advertising; items under "Events" are school content published by the school itself.

5. Storage and access

Data is stored on Supabase servers, a database hosting provider acting as our data processor.

Access is enforced by strict database-level isolation. Each school's data is separated from every other school's, and each user sees only what their role permits:

• Parent: their own children only.
• Teacher: students in their own divisions and subjects only, with no access to financial records.
• School administration: their own school only.

We do not share data with third parties except where required by a valid legal order.

6. Retention and deletion

Data is retained for as long as the school's subscription is active. When a school is deleted, all of its associated records are permanently removed. When an individual account is deleted, fee and payment records are retained by the school as its own accounting record.

To access, correct or delete your data, contact your school first, as it is the data controller. You may also write to us directly at the address above; we respond within 30 days.

7. Security

Data is transmitted and stored over encrypted connections (HTTPS/TLS). Passwords are hashed and never stored in plain text. Access is restricted by policies enforced at the database level, not by the application alone.

8. Changes to this policy

We may update this policy as the app's functionality changes. The last-updated date appears at the top of this page, and the current version is always published at this URL.