Privacy Policy

[App Name] · Effective [Date] · Last updated [Date]

1. Introduction and scope

This Privacy Policy explains what personal information [App Name] (“the App”, “we”, “us”) collects from students and other users, why we collect it, who we share it with, and the choices you have. We wrote it to be read by students, so we have kept the language plain.

Who we are. [Company / Developer Legal Name], [Registered Address], [Country]. For privacy questions, contact us at [privacy@yourapp.com].

What this policy covers. The App’s mobile apps, website, and any related services (together, “the Service”). It does not cover third-party websites or services that the Service links to.

Key terms.

  • Personal information: any information that identifies you or can reasonably be linked to you.
  • Student: a person who uses the Service to communicate with classmates, teachers, or other students.
  • School / Institution: a school, university, or education provider that has arranged for its students to use the Service.
  • Parent / Guardian: a person with legal responsibility for a child under the age of digital consent in their country.

Your agreement. By creating an account or using the Service, you confirm that you have read this policy. If you do not agree, please do not use the Service. Users under the minimum age in Section 4 must have a parent, guardian, or school give permission first.

2. Information we collect

We collect only what we need to run a safe chat service for students.

Information you give us

Category Examples Why we need it
Account details Name or username, email or phone number, password (stored hashed), date of birth or age range Create your account, verify age, sign you in
Profile Profile photo, display name, school or class (optional), bio Let classmates find and recognise you
Messages and content Text messages, photos, files, voice notes, reactions, group names, shared links Deliver your chats to the people you choose
School information School name, school email, class or group codes, role (student, teacher) Connect you to your school’s groups
Support and reports Messages to our support team, abuse reports, screenshots you send us Fix problems and keep users safe

Information collected automatically

  • Device and technical data: device model, operating system, app version, language, time zone, IP address, crash logs.
  • Usage data: features used, login times, message counts (not message content), notification interactions.
  • Approximate location: derived from your IP address (country or city level). We do not collect precise GPS location unless you turn on a feature that needs it and give permission.
  • Cookies and similar tools (web version only): see Section 10.

Information from others

  • Your school or a teacher, if they create or manage your account.
  • Other users who mention you, add you to a group, or report you.
  • Sign-in providers (for example Google or Apple), if you choose to use them. We receive only the basic profile information you approve.

Permissions we may ask for. Camera, microphone, photos or files, contacts, and notifications. Each is optional and used only for the matching feature (for example, the camera for sending photos). You can withdraw any permission in your device settings.

What we do not collect. We do not knowingly collect government ID numbers, financial account details from students, health records, precise background location tracking, or biometric templates. We do not read your private messages for advertising. Please do not share sensitive information such as passwords or payment details in chats.

If information is incomplete. If you choose not to provide required information (such as age or email), you may not be able to create an account or use some features.

3. How and why we use your information

We use personal information only for the purposes below. Where privacy law requires a legal basis (for example under the GDPR), we name it.

Purpose Legal basis
Create and manage your account, deliver messages and notifications Performance of a contract (our Terms of Service)
Verify age and obtain parental or school consent Legal obligation; consent
Keep the Service safe: detect spam, bullying, grooming, threats, and illegal content; enforce our rules Legitimate interests; legal obligation; protecting vital interests
Provide customer support and respond to reports Contract; legitimate interests
Fix bugs, secure the Service, prevent fraud and account takeover Legitimate interests
Improve features using aggregated or de-identified usage data Legitimate interests
Send service messages (security alerts, policy updates) Contract; legal obligation
Send optional news or tips to users old enough to consent Consent (you can opt out at any time)
Comply with law, court orders, and valid government requests Legal obligation

What we will not do.

  • We do not sell students’ personal information.
  • We do not show targeted advertising to users under 18, and we do not build advertising profiles of students.
  • We do not use the content of private messages to train advertising or marketing systems.
  • We do not use your information for purposes that are materially different from those above without telling you and, where required, asking for consent again.

Automated tools. We use automated systems (for example, filters for spam, links to known harmful content, and abusive language) to help moderate the Service. These tools may flag content for human review. They do not by themselves make decisions with legal or similarly significant effects on you. If you believe an automated action was a mistake, contact us and a person will review it.

4. Children, students, and schools

Minimum age. The Service is intended for users aged [13] and over. Where local law sets a higher age of digital consent (for example 16 in some EU countries, or [age] in Vietnam), users below that age need verifiable permission from a parent or guardian, or from their school where the law allows.

Children under [13]. We do not knowingly collect personal information from children under [13] without verifiable parental consent. If we learn that we have collected such information without consent, we will delete the account and data promptly. Parents who believe their child has used the Service without permission can contact us at [privacy@yourapp.com].

Parental rights. A parent or guardian may, at any time:

  • ask what personal information we hold about their child;
  • ask us to correct or delete that information;
  • withdraw consent and ask us to stop collecting or using their child’s information;
  • ask us to close the child’s account.

We may need to verify your identity and your relationship to the child before acting on a request, to protect the child’s privacy.

Age verification. We ask for date of birth or age range at sign-up. We may use additional checks (such as a parent’s email confirmation or school roster match) where needed. Providing a false age breaches our Terms, and we may suspend the account.

Student defaults. For users under 18, we apply stricter default settings: profiles are not publicly searchable, direct messages from unknown adults are blocked, location sharing is off, and no advertising is shown.

Use through a school. If your school gives you access to the Service:

  • The school may create and manage your account, see your name, class, and account activity, and, if it has enabled this, access group chats it administers.
  • The school decides what information it gives us and why. In those cases the school is responsible for having the right to share it, and we process the information on the school’s instructions under a written agreement.
  • We handle education records only as allowed by that agreement and by laws such as FERPA (United States) or equivalent rules where you live. We do not use student data from schools for any purpose other than providing the Service.
  • Questions about what your school can see or do should go to the school first.

Teachers and adults. Adults in the Service (teachers, moderators) may be subject to extra rules, including background checks required by the school. Adult-to-minor private messaging may be restricted or monitored as described in Section 5.

5. Messages, moderation, and safety

Who can see your messages. Messages are visible to the people in that conversation or group, and to the group’s administrators where the group settings allow it. Once someone receives a message, photo, or file, they can copy, screenshot, or forward it. We cannot control what other users do with content you send them.

Our access to message content. [Set “encryption” at the top of this file to choose one.]

[If messages are end-to-end encrypted:] Messages are encrypted so that only you and the recipients can read them. We cannot read message content, but we can see limited information such as account details, timestamps, and reports that users send us.

[If messages are encrypted in transit and at rest only:] We do not routinely read private messages. We may access message content only when needed to investigate a report, prevent serious harm, comply with law, or maintain the Service.

Reporting and moderation. Any user can report a message, user, or group. When you report content, we may review the reported content and the messages around it, plus related account information. Trained staff or automated tools review reports. We may remove content, warn users, restrict features, suspend accounts, or notify schools, parents, or authorities as described below.

Serious safety risks. We may share information, including message content, with a parent or guardian, a school safeguarding lead, emergency services, or law enforcement if we reasonably believe it is necessary to:

  • prevent or respond to a risk of death or serious harm, including self-harm;
  • protect a child from abuse, grooming, exploitation, or trafficking;
  • respond to threats of violence against a person or school;
  • report child sexual abuse material to the appropriate authority, as required by law.

Bullying and harassment. Bullying, harassment, and hateful content are not allowed. Reported content may be kept longer than ordinary messages (see Section 8) so we can investigate and, if needed, support a school or authority.

Schools and group admins. Teachers or admins who run a class group may see the group’s messages, member lists, and files shared in that group. We tell you in the group info if a group is monitored by a school.

Deleting messages. You can delete your own messages. “Delete for everyone” removes a message from other participants’ view in the App where possible, but copies already saved or screenshotted by others, or held in backups for the period in Section 8, may remain.

Content you post publicly. If the Service offers public or large-group spaces, anything you post there may be seen, copied, and shared by many people, including people outside your school. Think before you post.

6. Who we share information with

We do not sell personal information, and we share it only in the situations below.

Recipient What and why
Other users Your name, photo, and messages are visible to people you chat with, within your privacy settings
Your school Account and activity information as set out in our agreement with the school (Section 4)
Parents or guardians Information about a child’s account, where law or consent allows
Service providers (processors) Cloud hosting, message delivery, push notifications, analytics, crash reporting, email and SMS, customer support tools, and moderation tools. They may use data only to serve us, under contracts that require confidentiality and security
Authorities and courts When required by law, a valid court order, or a legal request, or to protect safety (Section 5). We review requests and share the minimum needed. Where lawful, we notify the affected user
Professional advisers Lawyers, auditors, and insurers, under confidentiality duties
Business transfers If we merge, are acquired, or sell assets, your information may transfer to the new owner, who must honour this policy. We will notify you and give you choices before your information is covered by a different policy
With your consent Any other sharing you specifically approve

Aggregated and de-identified data. We may share statistics that cannot reasonably identify you (for example, how many students use a feature). We will not try to re-identify this data.

Third-party services you connect. If you sign in with, or link, a third-party service, that service’s own privacy policy applies to the information it holds. We recommend reading it.

Our list of service providers. We keep an up-to-date list of the categories and names of providers that handle student data at [link], and we will give schools a copy on request.

7. Data security and what can go wrong

How we protect your information. We use technical and organisational measures suited to the sensitivity of student data, including:

  • encryption of data in transit (TLS) and at rest;
  • hashed and salted password storage, and optional two-factor sign-in;
  • access controls, so staff see only what their role requires, with access logged and reviewed;
  • regular security testing, patching, and vendor reviews;
  • staff confidentiality agreements and privacy and safeguarding training;
  • backups and an incident response plan.

No system is perfectly secure. Despite our efforts, no service can promise absolute security. Risks include hacking, malware, software bugs, outages, human error, insider misuse, and failures at our providers. If you believe your account or information has been compromised, contact us right away at [security@yourapp.com].

If a data breach happens. If a breach is likely to put your information at risk, we will:

  1. contain the incident and investigate its cause and scope;
  2. notify affected users, parents or guardians, and schools without undue delay, and within the time limits that apply (for example 72 hours to a regulator under the GDPR where required);
  3. tell you what happened, what information was involved, what we are doing, and what you can do (such as changing your password);
  4. notify regulators and authorities where the law requires.

Your part. You can help protect your account by using a strong, unique password, not sharing it, signing out on shared devices, keeping your device and App updated, and being careful with links and requests from strangers. We are not responsible for losses caused by you sharing your login with others or by unsafe use of your own device.

Account takeover and impersonation. If someone pretends to be you or gains access to your account, report it to us. We will help you recover access, remove impersonating content, and review the incident.

Service interruptions and data loss. Outages, bugs, or failures can occasionally cause delays, missing messages, or data loss. We keep backups, but we cannot guarantee that every message or file can be recovered. Do not rely on the App as your only copy of important schoolwork.

8. How long we keep information and how to delete it

We keep personal information only as long as needed for the purposes in this policy, or as the law requires. The periods below are our defaults. [Adjust to your real practice.]

Information Retention
Account and profile Until you delete your account, then deleted within [30] days
Messages and files Until you or the group deletes them, or your account is deleted; removed from active systems within [30] days
Backups Overwritten within [90] days of deletion
Reported content and safety records Up to [12] months, or longer if needed for an investigation, legal claim, or safeguarding duty
Logs and security data Up to [12] months
Inactive accounts After [24] months of inactivity we will warn you, then delete the account
Legal and tax records As required by law (often 5 to 7 years)
Student data held for a school Per the school agreement; returned or deleted when the agreement ends

Deleting your account. Go to [Settings > Account > Delete account]. We will ask you to confirm, then delete or de-identify your information, except what we must keep by law or for safety (above). Messages you sent to other people may remain visible to them in their own chats unless a feature to remove them is available.

When a student leaves a school. The school may close or transfer the account. You can ask us to keep your personal account, move it to a personal email, or delete it.

Legal holds. If we receive a legal request or are involved in a dispute, we may need to keep certain information longer than the periods above.

De-identified data. Once information is truly de-identified or aggregated, it is no longer personal information and may be kept without time limit.

9. Your rights and choices

Depending on where you live, you may have some or all of the rights below. We offer them to every user wherever we reasonably can.

  • Access: get a copy of the personal information we hold about you.
  • Correction: have inaccurate or incomplete information fixed.
  • Deletion: ask us to delete your information (see Section 8 for limits).
  • Portability: receive your information in a common, machine-readable format.
  • Restriction and objection: ask us to limit or stop certain uses, including uses based on our legitimate interests.
  • Withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect what we did before.
  • Human review: ask for a person to review an automated moderation decision.
  • No discrimination: we will not treat you worse for using these rights.

How to use your rights

Use [Settings > Privacy] in the App, or email [privacy@yourapp.com]. We may ask you to verify your identity, and for a child, to confirm a parent or guardian. We will reply within one month, or sooner if the law requires. If a request is complex we may extend this by the time the law allows, and we will tell you why. We can refuse requests that are unfounded or that conflict with a legal duty or someone else’s rights, and we will explain our reasons.

Your choices in the App

  • Control who can find you, message you, and see your profile in privacy settings.
  • Turn off notifications, location features, and optional emails.
  • Block or report any user.
  • Download or delete your data from account settings.

Regional information

European Economic Area, United Kingdom, and Switzerland. You have the rights above under the GDPR or UK GDPR. Our controller is [Company Name]. [Add EU/UK representative and Data Protection Officer details if required.] You may complain to your local data protection authority.

United States. We follow COPPA for children under 13 and FERPA where we act for a school. California: you may request to know, correct, and delete your information, and to opt out of sale or sharing. We do not sell or share personal information for cross-context advertising, and we do not do so for users under 16. We do not use or disclose sensitive personal information beyond what is needed to provide the Service. Other states may give similar rights.

Vietnam. Under Vietnam’s personal data protection rules, you may know about, consent to or withdraw consent from, access, correct, delete, restrict, and object to the processing of your data, and complain or seek compensation. Processing children’s data requires parental or guardian consent, and the child’s own consent from age 7. [Confirm the current requirements with a Vietnamese lawyer, including any impact assessment or notification duties.]

Other countries. If your country gives you additional rights, we will honour them. Contact us to use them.

Complaints

Please contact us first so we can try to fix the problem. You also have the right to complain to your local privacy regulator or data protection authority.

10. International transfers, cookies, links, changes, and contact

International transfers

We and our providers may process and store your information in countries other than your own, including [list countries]. These countries may have different data protection laws. When we transfer personal information across borders, we use safeguards the law accepts, such as standard contractual clauses, adequacy decisions, or other approved mechanisms, and we require providers to protect the data to the same standard.

Cookies and similar technologies

On our website we use:

  • Essential cookies to sign you in and keep the site secure. These cannot be turned off.
  • Preference cookies to remember settings such as language or theme.
  • Analytics cookies to understand how the site is used, only if you agree where the law requires it.

We do not use advertising cookies on pages used by students. You can manage cookies in your browser and in our cookie settings. Some browsers send a “Do Not Track” or Global Privacy Control signal. We honour Global Privacy Control where the law requires.

Advertising

[Set “ads” at the top of this file to choose one of the two options below.]

The Service contains no advertising.

The Service may show advertising. Ads are never targeted at users under 18 and never use the content of messages.

Third-party links and content

Chats may contain links to other websites, apps, or files. We do not control them and are not responsible for their privacy practices. Be careful about clicking links from people you do not know.

Changes to this policy

We may update this policy as our Service or the law changes. For significant changes we will tell you in the App or by email at least [30] days before they apply, and, where required, ask parents, guardians, or schools for fresh consent. The “Last updated” date at the top shows the latest version. Older versions are available on request.

Contact us

[Company Legal Name]
[Registered Address]
Privacy questions and requests: [privacy@yourapp.com]
Security issues: [security@yourapp.com]
[Data Protection Officer / EU or UK representative, if applicable]