سياسة الخصوصية

Privacy Policy (English)

Effective date: 31 August 2026. This English text is a summary of the Arabic policy above; the Arabic text prevails if the two differ.

Who we are

The Dolphin School App is a private application for a school community (guardians, students, teachers, staff and bus crew). Accounts are created by the school — there is no public sign-up. The school is the data controller; Diamond Kode develops the app and operates the servers as a processor acting on the school's instructions.

What we collect

• Account data: full name, email, hashed password, role, preferred language.
• Student data: name, class, school photo (if uploaded by the school), attendance, grades, homework and exam submissions, teacher notes.
• In-app correspondence: messages to the school, complaints, suggestions and call-out (early leave) requests.
• Bus location: coordinates from the bus crew's device only, while a trip is running and the screen is open.
• Push token: a Firebase Cloud Messaging device identifier.
• Limited technical data: app version, OS, connectivity state, server error logs.

What we never do

• We do not sell, rent or trade your data or your children's data.
• No ads, no ad networks, no advertising identifiers, no marketing profiles.
• No third-party behavioural analytics.
• No access to contacts, SMS, call logs, microphone, camera or photo gallery.

Permissions

• Internet / network state — required to reach the school's server.
• Notifications — optional; can be denied or turned off at any time.
• Location (while in use) — optional, requested only from bus crew accounts. No background location is requested and no person is tracked after a trip ends.

Sharing

Data is visible inside the school strictly by role (a guardian sees only their own children; a teacher only their own classes). The only external processors are Google Firebase Cloud Messaging, used solely to deliver notifications, and the server hosting provider. Data is otherwise disclosed only where a legally binding order requires it.

Security

All traffic is encrypted with HTTPS/TLS. Passwords are stored as BCrypt hashes and are never readable, including by us. Session tokens are held in the device's secure store (iOS Keychain, hardware-backed AES-GCM on Android), are short-lived and are rotated. Each school runs on its own separate database.

Retention and deletion

Student and account data is kept while the student is enrolled, and afterwards only as long as applicable education regulations require. Bus coordinates are deleted or aggregated after the trip ends. Push tokens are invalidated on sign-out or uninstall.

Account deletion: because accounts are issued by the school, send deletion requests to the school or to support@diamondkode.com, including the user's name or email and the school name. Valid requests are actioned within 30 days, except for records the school is legally required to retain, which we will identify in our reply.

Children's privacy

This is a school application and by its nature processes minors' data, entered by the school within its educational relationship with the guardian and visible only to that guardian and authorised staff. We do not solicit data directly from children, do not advertise to them, do not profile them, and do not share their data with any advertising party. Guardians may review, correct or request deletion of their child's data through the school.

Your rights

Access, correction, deletion (within the limits above), withdrawal of notification or location consent at any time from device settings, and the right to complain to us or to the school.

Changes

We may update this policy as the app changes. The effective date at the top is updated with every revision and material changes are announced in the app.

Contact

School-specific data: contact the school directly. App or policy questions: support@diamondkode.com