Bolster Juniors Desk

Introduction

Bolster Juniors ("we", "our", "us") operates the Bolster Juniors Desk application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

The school or educational institution you are associated with is the data controller and determines how and why your personal data is processed. Bolster Juniors acts as a data processor on behalf of the school.

This policy also covers our use of Google Sign-In for authentication. By using Google Sign-In, you agree to Google's handling of your data as described in Google's Privacy Policy and this policy.

Information We Collect

We collect personal information that you voluntarily provide to us when registering or using the app, including:

• Name, email address, and phone number
• Google account email, name, and profile picture (when you sign in using Google Sign-In)
• Role and class information for students and staff
• Address and emergency contact details
• Blood group (optional)
• Date of birth (optional) for students and staff, used to display birthday greetings, including a branch-wide greeting posted to the Notice Board
• Attendance records and leave applications
• School transport (cab) data: routes, stops, your child's route and stop assignments, daily pick-up/drop/absence records, recorded route start times, and cab driver and in-charge name and phone details
• Messages, announcements, and resignation communications
• Uploaded images, documents, videos, and files attached to notices and homework
• Examination records, marks, report cards, and teacher remarks about students
• Survey responses and remarks submitted by parents
• Device tokens for push notifications
• Diet tracking data (meal status: followed, partial, healthy, not followed)
• Theme preference (light/dark mode)
• Language preference (English, Hindi, Tamil, or Kannada)

When you sign in with Google, we receive your email address, name, and profile picture from your Google account. We only request the minimal OAuth scopes (email, profile, and openid) necessary for authentication. We do not access your Google Drive, Gmail, Contacts, or any other Google service data.

How We Use Your Information

• To authenticate your identity via Google Sign-In or email-password login
• To provide and maintain our services
• To notify you about school announcements, homework, and events
• To share homework assignments and attached files with the recipients (parents, students, and staff) they are intended for
• To manage examinations, record marks, and generate report cards for families
• To collect survey responses from parents and share them with school staff for review
• To manage attendance and leave records
• To manage school cab routes, assign children to routes and stops, record daily cab pick-up/drop status, show live cab status to parents and staff, and generate monthly cab reports
• To facilitate communication between parents, teachers, and school management
• To send push notifications (with your consent obtained via the device runtime permission dialog)
• To generate Hall of Fame rankings based on attendance and diet data
• To record read receipts for announcements and homework (whether staff or parents have viewed an item), visible only to school management
• To improve our application and user experience

Google Sign-In (Authentication)

We offer Google Sign-In as a convenient and secure way to access your account. When you choose to sign in with Google:

• What we collect: Your Google account email address, name, and profile picture. These are used to create and personalize your account.
• Why we use it: To verify your identity and provide a seamless login experience without requiring a separate password.
• How it works: Google authenticates your identity and provides us with a secure ID token. We validate this token with Google's servers and create or log you into your account.
• What we do NOT collect: We do not access your Google Drive, Gmail, contacts, calendar, search history, location, or any other personal data from your Google account beyond what is listed above.

You can choose to use email-password login instead of Google Sign-In at any time. Google Sign-In is optional and not required to use the app.

You can revoke your Google account's access to our app at any time by visiting your Google Account permissions page. Please note that revoking access will not delete your account data from our systems — you must separately request account deletion through the app or our deletion page.

Data Sharing and Disclosure

We share your personal data only in the following circumstances:

• With family members (names shared via family link)
• With school owners and teachers for notification purposes
• With the intended recipients of homework assignments and their attached files (parents and staff of the target classes)
• With a student's family (marks, report cards, and teacher remarks for their own child)
• With school owners, administrators, and teachers (survey responses and remarks for review)
• With a student's family and school staff (school cab route, stop, driver/in-charge contact, and daily pick-up/drop status)
• With Supabase, our hosting provider, for data storage and processing
• With Google (Firebase Cloud Messaging) for push notification delivery
• With Google (Google Sign-In) for authentication — we send the ID token to Google's servers for verification
• As required by law or to protect our legal rights

We do not sell your personal information to third parties.

Data Security

We are concerned about safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards to protect information we process and maintain. All data in transit is encrypted using HTTPS. Your credentials are stored encrypted on your device using secure storage. We limit access to this information to authorized employees and contractors who need that information in order to operate, develop or improve our Application. Please be aware that, although we endeavour to provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

Google Sign-In uses industry-standard OAuth 2.0 protocol and Google's secure authentication infrastructure. We never see or store your Google account password.

Data Retention Policy

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account Data: Retained for the duration of your active account. Upon account deletion, all personal data is permanently removed within 30 days.
• Attendance & Leave Records: Retained for the current academic year plus one additional year for reporting purposes, after which they are anonymized.
• School Cab Records: Routes and stop assignments are retained while the route is active. Daily cab pick-up/drop records and recorded route start times are retained for 13 months (the current month plus the previous 12 complete months), after which they are permanently deleted.
• Communication Records: Announcements, messages, and notifications are retained for the duration of the academic year.
• Diet & Hall of Fame Records: Meal status data and derived rankings are retained for the current academic year.
• Homework Attachments: Files attached to homework (images and PDFs) are automatically deleted 5 days after upload. Associated database records are removed with them.
• Notice Attachments: Videos attached to notices are automatically deleted 5 days after upload. Images and PDFs are removed when the notice expires (15 days after posting).
• Examination Records: Exam records, marks, and report cards are retained for 12 months plus a 1-month grace period (13 months total), after which they are permanently deleted.
• Report Card Remarks: Teacher remarks about a student are removed together with the related exam or when the student is deleted.
• Survey Responses: Survey answers and parent remarks are retained while the related survey exists, and are removed when the exam, survey, or student is deleted.
• Audit Logs: Retained for 12 months for security and compliance purposes.
• Device Tokens: Retained only while push notifications are enabled. Immediately removed when you opt out or delete your account.
• Profile Picture (Avatar): Retained for the duration of your account. Deleted upon account deletion.
• Theme Preference: Retained for the duration of your account. Deleted upon account deletion.
• Language Preference: Retained for the duration of your account. Deleted upon account deletion.

When data is no longer needed, it is securely deleted or anonymized. We do not retain your personal information beyond the stated periods unless required by applicable law.

Managing Your Information

You have full control over your personal information through the app:

• Update Profile: Navigate to the Profile tab to update your name, phone number, address, and other personal details at any time.
• Change Password: Use the "Forgot Password" option on the sign-in page or update through your profile settings.
• Notification Preferences: Enable or disable push notifications from the Settings screen in the app.
• Language: Switch the app display language (English, Hindi, or Tamil) at any time from Settings.
• Parent Profiles: Manage linked parent profiles, add or remove students, and update emergency contact information from the Profile tab.
• Family Access: If all linked students are removed from a family, app access for that family is automatically restricted until a new student is added and approved by the school.
• Delete Account: Permanently delete your account and all associated data from the Profile tab by selecting "Delete My Account".
• Revoke Google Access: Visit Google Account permissions to revoke our app's access to your Google account.
• Profile Picture: Your Google profile picture is synced automatically on sign-in. It is displayed as your avatar across the app and can be updated by changing your Google account picture.

If you need assistance managing your information or encounter any issues, please contact the school administration or the owner through the app.

Children

Our application is used by schools and educational institutions to manage communication with parents, teachers, and staff. Only adults (parents, teachers, and school administrators) have login accounts. We do not create accounts for or knowingly collect personal information directly from children under the age of 13.

Student information such as name, class, attendance records, and academic records (marks and report cards) is provided to us by the school or by parents/guardians. The school is responsible for obtaining parental consent for the collection and use of student data.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at bolsterjuniors@gmail.com. We will delete any such information from our files within a reasonable time.

Your Rights

You have the following rights regarding your personal data:

• Access and review your personal data
• Update or correct your information
• Delete your account and associated data
• Revoke Google Sign-In access to our application via your Google Account settings
• Opt out of push notifications at any time from Settings
• Withdraw consent for data processing by disabling push notifications in Settings, contacting the school administration, or deleting your account from the Profile tab

Opt-Out Rights

You may opt out of the following at any time:

• Push Notifications: Go to Settings in the app and toggle off "Push Notifications". This will immediately stop all notification delivery and remove your device token from our servers.
• Email Communications: Contact the school administration to opt out of non-essential email communications.
• Data Sharing: To restrict how your data is shared within the school ecosystem, contact the school owner or administrator.
• Account Deletion: You may delete your entire account from the Profile tab, which removes all associated personal data from our systems.

Opting out of certain services may limit your ability to use some features of the app (e.g., disabling push notifications means you will not receive real-time alerts). Your decision to opt out will not affect the lawfulness of processing based on consent before its withdrawal.

Account Deletion

You can delete your account from the Profile tab by selecting "Delete My Account". This will permanently remove all your personal data from our systems. You may also request account deletion by visiting our account deletion page — no login required. Upon receiving your request, we will delete your account and associated data within 30 days.

Deleting your account does not automatically revoke Google Sign-In access. To fully disconnect, visit Google Account permissions and remove Bolster Juniors Desk from the list of connected apps.

Changes to This Policy

This Privacy Policy may be updated from time to time for any reason. We will notify you of any changes to our Privacy Policy by posting the new Privacy Policy in the app and sending a push notification. You are advised to consult this Privacy Policy regularly for any changes, as continued use is deemed approval of all changes.

Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the rules framed thereunder. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Chennai, India.

Contact Us

If you have any questions about this Privacy Policy or our use of Google Sign-In, please contact us at bolsterjuniors@gmail.com or reach out to the school administration through the app.