Privacy Policy.

Operator: Younus Qureishy.
Effective date: October 26, 2026.
Privacy contact: privacy@school-sync.app

1. Scope and purpose

School-Sync helps participating schools, teachers, parents and authorized guardians coordinate student dismissal. Accounts are created by the School-Sync team, by school administrators and by parents (for their guardians); there is no public sign-up. This policy covers the School-Sync mobile app and the contact forms on this website. School-Sync uses information to authenticate users, associate families with students and schools, check pickup eligibility, record arrivals and release status, manage guardian approvals, deliver messages, keep messaging safe and respond to feedback.

2. Information the app handles

• Account and school records: names, email addresses or usernames, account roles, school and class assignments, and parent/guardian links. AWS Cognito manages sign-in credentials.
• Student records: children’s names, school/class assignments and links to authorized adults, entered by school staff and parents. School-Sync does not collect a child’s own location.
• Pickup activity: eligibility checks, check-in coordinates, arrival and release status, and pickup-related timestamps associated with the account and student.
• Communications: messages, sent message photos, in-app notifications, guardian invitations and approval requests.
• Safety reports and blocks: when you report a person or a message, the report stores the reason, your optional note and a copy of the reported message text and photos taken from our servers at the time of the report. When you block someone, we store who blocked whom and when.
• Feedback: information you submit, including screenshots where attached. Avoid sending passwords or unnecessary student information.
• Service records: backend/API logs and authentication audit records.

3. Precise location during pickup

Foreground checks: with location permission, the app sends your precise latitude and longitude to the backend when it checks pickup-area eligibility and when you tap “I’m here.” The backend compares those coordinates with the school’s configured pickup geofence. Check-in coordinates are stored with the pickup record with a 90-day expiry. These coordinates are not displayed to teachers, administrators or other families. Eligibility coordinates are also transmitted to the backend.

After release: where background location is enabled and permitted (“Always” on iPhone, “Allow all the time” on Android), your device checks whether you have left the school area. This exit detection processes coordinates on your phone rather than uploading or storing those coordinates on the server. It sends “last inside” and “left” timestamps so staff can see pickup completion. This on-device description applies to exit detection, not to foreground eligibility or check-in.

You can change location permissions in your device settings. Refusing foreground access can prevent location-based check-in; refusing background access can prevent automatic exit updates. Follow your school’s alternative pickup instructions.

4. Safety, moderation and messaging

Messages sent in the app are checked for blocked language when they are sent. A message that fails the check is refused and is not stored. You can report a person or a message and block a person from the app. Reports are reviewed by your school’s administrators and by the School-Sync team, who can mark a report reviewed, remove a message for everyone, or disable an account. Blocking stops messages between the two of you; it never affects pickup or release. Report and block notifications sent by email contain the reason and a report reference, not message text or names.

5. Access and service providers

Account roles and school/family associations determine access to operational information. Student and pickup status supports authorized staff and connected families.

• AWS Cognito: authentication, including usernames/email addresses, passwords managed by Cognito, and roles.
• AWS API Gateway, Lambda, DynamoDB and S3: application requests, backend processing, database records and uploaded files. CloudWatch and CloudTrail provide logs and audit records.
• AWS Location Service: school geofence coordinates and radius. This service stores the school geofence; pickup eligibility is evaluated by the application backend.
• AWS SES: invitation, guardian approval, report notification and account-deletion emails.
• AWS SNS: notification events. Notifications are retrieved in the app.
• Google Maps SDK: administrator-only geofence map previews and map tile requests. Google’s SDK may collect device or usage information under its own terms and privacy practices.
• Apple Keychain and Face ID (iPhone), Android Keystore and fingerprint (Android): device-side biometric sign-in. Biometric data stays on the device; the backend stores a sign-in token hash, not a face image, fingerprint or biometric template.

The app does not use advertising, analytics or crash-reporting SDKs, does not sell personal information and does not track you across other companies’ apps or websites.

6. Retention and expiry

The following retention settings apply to app records. Expiry and removal of backup copies can occur at different times.

DynamoDB TTL removal is asynchronous: expired items can remain for a few additional days. AWS describes deletion as typically occurring within a few days of expiry; this is not a guaranteed deadline. AWS TTL documentation.

7. Deleting your account

You can delete your account from inside the app: tap your profile icon, open Account & Support, then Account Deletion, and confirm. Deletion is completed within 7 days, and you can cancel the request in the app until it is completed. Backup copies are removed within 35 days.

Deletion removes your account and sign-in, your guardian links (and guardians that only you added), messages you sent and photos you shared, your feedback, notifications, Face ID and fingerprint sign-in tokens, and reports and blocks involving your account. Student and class records stay with the school. Pickup records the school keeps have your account ID replaced and your check-in coordinates removed. If you cannot open the app, use the Account & Data Deletion page or email privacy@school-sync.app.

8. Children’s information and school responsibilities

School-Sync is used by school staff, parents and guardians, not by children. Children’s names and school/class relationships are still personal information even though adults enter them and no child location is collected. Student and class records are maintained by the school that uses School-Sync.

9. Website requests and website services

Website forms collect your name, email, message, selected role/topic and school name (required for school access requests, otherwise optional). They use WordPress’s email service to send to our support or privacy address. The website does not store submissions in a separate database. Website hosting and email services may retain submissions or service logs. The app retention table does not apply to website emails.

10. Your choices, requests and security

Keep account credentials private and use device permission controls to manage location access. To access or correct your information, or for any privacy request, email privacy@school-sync.app. To delete your account, follow section 7.

11. Updates and contact

For questions about your personal information, access, correction or deletion, email privacy@school-sync.app. The service is provided by Younus Qureishy. We may update this policy as the service changes. The effective date above identifies the current version.