Privacy Policy for Scolage Student

Scolage ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Scolage Student mobile application (the "App") and the corresponding backend services (the "Services").

This policy is designed to comply with the developer requirements of the Google Play Store and the Apple App Store, including GDPR, CCPA, and App Store Review Guideline 5.1.1.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

1. Information We Collect

We collect information about you in three ways: information you provide directly, information collected automatically, and information collected from device permissions.

A. Information You Provide Directly

• Account Registration & Profiles: When you register as a student or admin, we collect your Full Name, Email Address, Mobile Phone Number, Date of Birth, Gender, and profile picture (avatar).
• Admissions & Enrollment Data: When applying to institutes via the Discovery Portal, we collect academic documents, eligibility certificates, categories, and confirm admissions records.
• User-Generated Content (Chat & Media):
  • Direct and Group chat messages.
  • Media attachments (images, videos, audio, and documents) uploaded during chats.

B. Information Collected Automatically

• Session & Authentication Logs: We collect one-time passwords (OTP) verification requests, last login timestamps, and access tokens (JWT/Redis session mappings).
• Presence & Interaction State: Real-time presence status (online/offline indicators) and typing indicators are processed to facilitate communication features.
• Device & Notification IDs: We store your Firebase Cloud Messaging (FCM) Token to route real-time notifications and incoming VoIP call alerts.
• API & Socket Logs: IP addresses, network statuses, API usage details, and transaction histories (e.g. token wallet logs).

C. Device Permissions We Request

To provide our core communication and discovery services, the App requests access to specific hardware and software components on your mobile device:

• Camera & Photos/Gallery: Required to upload profile pictures and send images/videos as chat attachments.
• Microphone & Audio: Required to facilitate VoIP voice/video calls.
• Notifications & Foreground Services: Required to deliver real-time push alerts, chat notifications, and CallKit screens for background incoming calls.
• Network & Internet State: Required to establish connections to our RESTful APIs and Socket.io servers.

2. How We Use Your Information

We process your data to operate, maintain, and improve the Scolage platform, specifically:

• Authentication & Verification: Using email or mobile OTPs to secure your account.
• Real-time Communications: Facilitating direct/group messaging and call connectivity using WebSocket channels (Socket.io) and temporary voice connections.
• Admissions Processing: Enabling students to discover, check eligibility, and apply to academic institutes.
• Offline Notifications: Sending progressive alerts (push notifications, SMS, or email digests) when you receive unread messages while offline.
• System Integrity & Security: Detecting, investigating, and preventing unauthorized login sessions, policy abuse, or security breaches.

3. Storage, Retention, and Security of Data

A. Data Security

We employ industry-standard security measures to protect your personal data:

• Stateless JWT tokens combined with encrypted stateful Redis maps protect session data.
• Media attachments are stored in secured object storage buckets (AWS S3, Cloudinary, and Azure Blob Storage) using read-only/write-only Shared Access Signatures (SAS) to restrict access.
• Secure local storage (flutter_secure_storage) is used to store sensitive credentials on your device.

B. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law (e.g., academic enrollment records).

4. Third-Party Services We Use

We share information with trusted third-party providers who perform services for our platform:

• Google Firebase (FCM): For delivering push alerts and incoming VoIP call triggers.
• Azure Services & AWS: For secure document/image hosting and background event streaming.
• SMS & Email Gateway Services: Nodemailer/Gmail SMTP and Fast2SMS API to deliver verification codes (OTPs) and unread message reminders.
• Cloudinary: For dynamic image resizing and profile picture optimization.

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

5. Your Rights and Data Deletion (App Store Compliance)

We respect your rights regarding your personal data:

• Access & Correction: You can view and update your profile details inside the App settings.
• Account & Data Deletion (Required by Apple & Google): You have the right to delete your account and remove all associated personal data at any time.
  • How to delete: You can request account deletion directly within the App settings by navigating to Profile > Delete Account, or by sending a request to support@scolage.com.
  • Upon receiving an account deletion request, we will permanently delete or anonymize your personal information, profile data, and FCM tokens from our production databases within 30 days, subject to any legal retention requirements.

6. Children's Privacy

Our services are designed for students and educational administration. If a student is under the age of 13, we require parental or guardian consent to register and process their data. If we learn that we have collected personal data from a child under 13 without appropriate consent, we will delete that data immediately.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy within the App and updating the "Last Updated" date at the top of this document.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at: