Privacy Policy

Effective: 6 May 2026 · Last updated: 29 September 2026

This Privacy Policy describes how Pradya Yataseang ("we", "our") collects, uses, and protects your personal information when you use the NOTYSCHOOL Family and NOTYSCHOOL Teacher mobile applications (collectively, "the Apps") and related services.

1. Information We Collect

1.1 Information You Provide

• Account info: name, email, phone number, student ID / national ID (for identity verification)
• School info: school name, grade, classroom, academic year
• Messages: content of chat conversations between parents/students and teachers
• Authentication: Google account info when using Sign in with Google

1.2 Automatically Collected

• Push token: Firebase Cloud Messaging (FCM) token for delivering notifications
• Device info: phone model, OS, app version
• Usage data: login timestamps, in-app actions (check-in, leave requests, etc.)

1.3 Face Data (Opt-in by school only)

Some schools optionally enable a Face Scan attendance feature. Where a school enables it, the app collects and processes face data as described in this section.

• What we collect: A photo captured by the device camera at attendance check-in is converted into a face embedding (a numerical vector). We do not retain the raw facial image as biometric identity data, and the embedding cannot be reversed back into a face image.
• Why we store it: The face embedding is stored so the system can recognize and verify the enrolled student at each attendance check-in. Without a stored reference embedding, automated identity verification for attendance is not possible.
• How long we store it, and why: Face data is retained only for as long as the student is actively enrolled at the school and the school continues to use the Face Scan feature, because it is required to perform daily attendance during that period. Face data is not stored indefinitely. It is permanently deleted when any of the following occurs, in each case within 30 days: (a) the student graduates, transfers, or leaves the school; (b) the school disables the Face Scan feature; (c) a parent/guardian or the school withdraws consent; or (d) a data-deletion request is submitted.
• Sharing with third parties: We do not share face data (neither face embeddings nor check-in photos) with any third party. Face data is stored only on our own servers (scapschool.com, hosted in Thailand) and is used solely by the student's own school. The third-party services we use — Google Firebase (authentication and push notifications) — do not receive any face data.
• Third-party storage of face data: Because we do not share face data with any third party, no third party stores or has access to your face data.

1.4 Location Data (GPS) — only when you use a location feature

The apps read the device location only when you tap a feature that needs it, and only after you grant the device's location permission. The apps do not track location in the background and do not request "allow all the time" location access.

• What we collect, and for which features:
  • On-site check-in verification (Teacher), only at schools that enable it — the coordinates are used to calculate the distance from the school and confirm you are within the radius set by the school. The result is kept only for that login session; the coordinates are not saved to our database.
  • Home-visit records (Teacher) — when a teacher taps "Find coordinates" (หาพิกัด), the student's home coordinates are saved in the home-visit report when the teacher saves the form.
  • Activity check-in — the check-in coordinates and the distance from the activity location are saved in the check-in history. School admins may use their current location to set an activity's location.
  • GPS + photo attendance (Family app), only at schools that enable it — the coordinates and the distance from the school are saved with the attendance record.
• Accuracy: precise location is used. If you allow only approximate location, features that measure distance may not be able to verify your location.
• Retention: saved coordinates are kept with the related record (attendance, check-in, or home-visit report) per the school's academic year policy, and are deleted with the account when account deletion is requested (within 30 days).
• Sharing with third parties: we do not sell or share location data with third parties. Coordinates are stored on our own servers (scapschool.com, hosted in Thailand) and are accessible only to the relevant teachers/admins of your school. Pages that show a map load map images from OpenStreetMap, and if you tap "Open Google Maps", the coordinates are sent to Google Maps at your request.
• How to turn it off: you can deny or revoke location permission at any time in your device's Settings › Apps › Permissions › Location. Other features of the apps keep working.

2. How We Use Your Information

• Provide app features (scores, attendance, notifications)
• Verify presence at school or an activity location, and record home coordinates in home-visit reports — only when you use these features (see 1.4)
• Enable communication between schools and families via chat and push
• Authenticate users for student data security
• Improve app performance and fix issues
• Comply with legal obligations

3. Information Sharing

We do not sell personal information. Data is shared only with:

• Your school: Teachers and admins access info needed to provide educational services
• Cloud providers:
  • Google Firebase (Authentication, Cloud Messaging) — United States
  • scapschool.com hosting — Thailand
• Government: When required by law

4. Data Retention

• Account data is retained while you use the service
• Chat messages: up to 1 year after the last conversation
• Attendance records: per the school's academic year policy
• Location coordinates (1.4): kept with the related attendance/check-in/home-visit record, on the same schedule
• Account deletion requests are processed within 30 days

5. Security

• All data transmission uses HTTPS/TLS encryption
• Passwords stored as hash + salt, never plain text
• JWT tokens expire in 7 days; refresh tokens in 30 days
• Face data is converted to vectors before storage; not reversible

6. Your Rights

Under Thailand's PDPA (and equivalent laws), you have the right to:

• Access and request a copy of your data
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent for data processing
• Turn off the apps' location permission at any time in device settings
• Opt-out of push notifications

Contact nuiii044@gmail.com to exercise these rights.

7. Cookies & Tracking

The app does not use third-party tracking cookies. Only session tokens and operational caches are stored.

8. Children's Privacy

The app is designed for educational settings. Users under age 13 should have parental consent and use only via a parent's account.

9. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated via in-app notice and email.

10. Contact

• Developer: Pradya Yataseang
• Email: nuiii044@gmail.com
• Website: https://scapschool.com