Privacy Policy

Last updated: 11th October 2026

This Privacy Policy explains how Schoolary ("we", "us") collects, uses, and protects personal data through the Schoolary platform. It's written to align with the Nigeria Data Protection Act, 2023 ("NDPA").

Controller vs. Processor — who's responsible for what: Each School using Schoolary is the data controller for the personal data of its own students, parents/guardians, and staff — it decides what data to collect and why, and is responsible for having a lawful basis (including parental/guardian consent, where required) to process it. Schoolary acts as a data processor, providing the platform the School uses to store and manage that data on its behalf. If you're a parent, guardian, or student with a question about your data, your school is your first point of contact — Schoolary processes it under the School's instruction.

1. What we collect

Who	Data collected
School (at registration)	School name, admin's name and email address
Admin / Teacher accounts	Name, email address, password (stored securely, hashed by Firebase Authentication — Schoolary never sees it in plain text), role, assigned classes
Students	Name, class, results/grades, attendance records, and any other academic record the School chooses to enter
Parents / Guardians	Phone number (for fee/attendance reminders), and whatever a School enters to identify them — parents do not create a password-based account; access is via a Student ID the School provides them
Payments	Transaction reference and amount, handled by Flutterwave. Schoolary does not collect or store card numbers.
Technical	Basic device/browser information needed to operate the app (standard for any web service)

2. Children's data

Schoolary is used by schools to manage records belonging to minors. We do not collect this data directly from children — it is entered by the School (a teacher or admin), which is responsible for ensuring it has the necessary parental/guardian consent or other lawful basis under the NDPA before doing so. We recommend Schools inform parents/guardians, at enrollment, that their child's academic records will be processed through Schoolary, and reference this Privacy Policy.

3. How data is used

To operate the core features Schools sign up for — result management, attendance, fee tracking, and parent access to those records;
To verify payments and activate subscriptions;
To send service-related notifications (e.g. subscription expiry reminders) to School admins;
We do not sell personal data, and we do not use student or parent data for advertising.

4. Where data is stored

Schoolary is built on Google Firebase (Firestore and Firebase Authentication) and Netlify for hosting. Data may be stored on servers located outside Nigeria, depending on Google's and Netlify's data center locations. Where personal data is transferred outside Nigeria, we rely on the safeguards provided by these providers' standard data processing terms, consistent with the NDPA's cross-border transfer requirements.

5. Third parties we use

Google Firebase — database and authentication
Netlify — application hosting
Flutterwave — payment processing (Schoolary never receives or stores your card details)
Fee and attendance reminders sent "via WhatsApp" are generated as a pre-filled link that a School's own staff member sends manually from their own device — Schoolary's servers do not send or store WhatsApp message content.

6. Data retention

We retain School data for as long as the School's account is active. If a School's account is closed, data will be deleted or anonymized within [e.g. "90 days"], except where we're required to keep records for longer (for example, payment records, which we may retain for tax/accounting purposes).

7. Security

We use industry-standard measures to protect data, including encrypted connections (HTTPS), Firebase Authentication for staff accounts, and database access rules restricting who can read or write each School's data. No system is 100% secure, and we continuously work to improve these protections.

8. Your rights under the NDPA

Where you are the data subject (or a parent/guardian acting for a student), you have the right to:

Know what personal data is held about you or your child;
Request correction of inaccurate data;
Request deletion of data, subject to the School's own record-keeping obligations;
Object to certain processing.

Since your School is the data controller, these requests should generally go to your School first. If you're unable to resolve it with your School, you can reach us at schoolaryapp@gmail.com.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to School admins through the app or by email.

10. Contact

Data protection inquiries: schoolaryapp@gmail.com