SchoolOS is a school management app built and run by Kreare Tech, Visakhapatnam, Andhra Pradesh, India ("we", "us"). It is used by schools, their staff, and the parents and guardians of their students. This policy explains what personal data SchoolOS collects, why, how it is protected, and the rights you and your school have over it. It covers the SchoolOS Android and iPhone apps (including apps published under a school's own name), the SchoolOS web app, and this page.
Your school gives you SchoolOS. Each school is the data controller for the personal data of its own students, parents and staff: the school decides what is collected and why. Kreare Tech is the data processor: we run SchoolOS for the school, on its instructions. We do not sell, rent or use school data for anything other than running SchoolOS.
1. What we collect, and why
Account and identity
Name, role (parent, teacher, principal, admin and so on), and the phone number or email used to sign in. For students: full name, date of birth, admission number, class and section, and a photo where the school uses ID cards, profiles or the gallery.
Attendance, academics and school records
Daily attendance, homework, marks and report cards, timetables, exam schedules, admission enquiries and, where a school issues them, transfer, bonafide and study certificates. These are the digital form of a school's paper registers, and some of them (such as transfer certificates and the admission register) are records a school must keep by law.
Fees — we never touch your money
SchoolOS does not process payments and never holds fee money. Parents pay straight to the school's own UPI ID. SchoolOS stores only the amount due, the UTR (transaction reference) number a parent enters as proof of payment, and the school office's confirmation. Card, bank and UPI PIN details are never entered into or seen by SchoolOS.
Staff check-in: fingerprint, face and location
If a school turns it on, staff can check in with their phone's own fingerprint or face unlock (passkeys, a W3C standard called WebAuthn). We never see or store that fingerprint or face: it stays inside the phone's secure hardware. SchoolOS receives only a cryptographic proof that the phone approved the check-in, plus a random device identifier.
In the mobile app, a school can instead turn on face check-in. When a staff member agrees to enrol, the app reads their staff profile photo and turns it into 11 numbers that describe face proportions (such as eye spacing and nose and mouth proportions). Only these numbers are stored, together with the time the staff member agreed. At each check-in the phone takes a photo, measures it on the phone and deletes it straight away; the photo never leaves the phone. Only the 11 numbers and the check-in location are sent, and our server compares them with the stored numbers. Face detection runs on the phone using Google ML Kit. Staff can ask their school, or us, to delete their face enrolment at any time, and the school can mark their attendance another way.
Where it is turned on, each check-in is also matched against the school's location (a "geofence") using the phone's GPS at that moment, so attendance can only be marked on school premises. We do not track staff location outside this one-time check.
School bus tracking
Where a school uses transport tracking, the driver's phone sends its location only while the driver is running a trip in the app. Parents of students on that route can see where the bus is now. We keep only the latest position: no location history, no trip log and no record of past routes. This feature is optional for each school.
Messages, notices and media
Notices, homework attachments, gallery photos, messages between parents, teachers and school staff, and read receipts on notices (so a school can see which parents it has reached and follow up with the rest).
Device and technical data
A push notification token (so notices reach your phone or browser), device type, and the basic technical data needed to keep the service working and secure. SchoolOS has no advertising and no third-party advertising trackers.
2. Children's data
SchoolOS holds personal data about students, many of whom are children under 18 as defined by India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). A student's record is created and managed by their school and linked to their parent or guardian's account; students do not create SchoolOS accounts of their own. We do not use children's data for behavioural monitoring, targeted advertising or tracking beyond what the school sets up for its own work (attendance, transport safety and academics). Parents can see everything held about their own child through their parent account at any time.
3. How your data is protected
- Each school's data is kept separate from every other school's, so nobody at one school can see another school's records.
- Data is hosted in India (Mumbai region) with Supabase, the provider we use for the database, sign-in and file storage.
- Changes to fees, marks, certificates, admissions, staff leave and attendance are recorded in an audit trail (who changed what, and when) that only the school's own admin or principal can read. This protects families from quiet changes to records.
- Passwords are never stored in readable form, and access to every table is enforced by security rules in the database itself, not only by checks in the app.
4. Who can see what
Access follows school roles: a parent sees only their own children; a teacher sees the students in the classes they teach; a principal or admin sees their own school. Nobody outside the school's own staff and the student's own parents can see a student's records. Kreare Tech's team looks at school data only when needed to give support or fix a technical problem, at the school's request.
5. Email, SMS and notifications
SchoolOS sends routine notices by app and browser push notifications and by email. Emergency notices are also sent by SMS so they reach every parent at once (this needs telecom registration and is not active for every school). Email and SMS are delivered by our messaging provider Brevo; only the message and the recipient's registered email address or phone number are shared with Brevo for that purpose.
6. How long data is kept
We keep a student's or family's data while they are enrolled at or connected with the school, plus a reasonable period afterwards for the school's legal record-keeping (such as certificate and admission registers). A school can ask us to export or delete its data at any time, subject to the record-keeping rules that apply to schools. Live bus positions and passkey security challenges are deleted automatically within minutes.
7. Your rights
Under the DPDP Act you can ask to see, correct and (subject to the school's legal record-keeping duties) delete your personal data, and withdraw consent where consent is the basis for using it. Because your school is the data controller, the quickest way is through your school office. We support every such request, and will act on a verified request directly if your school cannot.
8. Services we rely on
Supabase (database, sign-in and file storage, India region), Google Firebase and Apple push notification services (push notifications), Brevo (email and SMS delivery), Cloudflare (web hosting), Google ML Kit (face detection on the phone, only where face check-in is on) and OpenStreetMap (map tiles for bus tracking, only where transport tracking is on). None of these providers may use school data for their own purposes; they handle it only to deliver SchoolOS to the school.
9. Changes to this policy
If we make an important change, we will update the date at the top of this page and, where the change affects how children's data is handled, tell schools directly before it takes effect.
10. Contact
For questions, data requests or concerns, email support@krearetech.com or call or WhatsApp +91 93983 40399.