Privacy Policy

Last updated: 4 August 2026 · Version 1.2

This policy applies to the Scolefy iOS app and the Scolefy website. Scolefy is a school organizer. It holds your timetable, assignments, grades and study sessions. That is personal information about your education, and we treat it that way. This policy explains exactly what we collect, why, who else can see it, and how to get rid of it.

1. Who we are
2. The short version
3. Information we collect
4. How we use your information
5. Legal bases (EEA/UK)
6. Who we share information with
7. Where your data is stored
8. How long we keep it
9. Your rights and choices
10. Children and students
11. Security
12. Regional disclosures
13. Website, links and third-party content
14. Changes to this policy
15. Contact us

1. Who we are

Scolefy (“Scolefy”, “we”, “us”) is an iOS application published by Zinx Studios Ltd, a company registered in England and Wales under company number 17227307, with its registered office at 167-169 Great Portland Street, London W1W 5PF, United Kingdom.

For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the information described in this policy.

You can reach us at info@zinxstudios.com.

2. The short version

3. Information we collect

3.1 Account information

Scolefy requires an account and is available only to people aged 13 or older. Before showing the Terms or allowing account creation, the app asks you to confirm whether you are 13 or older. If you select that you are under 13, the app does not let you continue to account creation. You may correct the selection if it was made accidentally.

A successful 13+ confirmation is remembered locally on that device so the age screen is not shown again. We do not ask for, receive or store your date of birth, and the local confirmation is removed if the app’s local data is erased. Depending on how you later sign in, we receive:

• Sign in with Apple — a unique Apple identifier, your email address (or Apple’s private relay address if you chose to hide it), and the name you chose to share.
• Sign in with Google — a unique Google identifier, your email address, and your Google account name.
• Email and password — your email address and a password. Passwords are handled by Firebase Authentication and stored only as a salted hash. We never see your password in readable form.

We also store the display name shown on your profile, which you can change or clear at any time. After a verified account first signs in, Scolefy automatically assigns it a random unique username. This username is linked to the account but is not displayed to or searchable by other users in the current version of the app.

3.2 The school content you create

This is the substance of the app. When you use Scolefy we store, and sync to your account, the information you enter:

• Classes and subjects, teachers, rooms, colors and icons
• Your timetable, including lesson times, week patterns and term dates
• Assignments and homework: titles, notes, due dates, completion state, checklists and formatted content blocks
• Recurring assignment series and assignment templates
• Grades and marks, grading systems, weightings and calculated averages
• Terms, academic years, and archived school years you have rolled over
• Study sessions: start and end times, durations, timer configurations, and which subjects each session was spent on
• Your in-app settings and preferences, such as notification timings, timer presets, theme and dashboard layout

Grades and academic performance can be sensitive. We store this content so the app works across your devices; we do not analyze it to profile you, and we do not disclose it to anyone other than the service providers listed in §6.

3.3 Files you attach

You can attach material to assignments — photographs taken with the camera, images from your photo library, scanned documents, PDFs, freehand drawings, and web links. These files, together with any filenames and captions you give them, are uploaded to your private storage area and synced to your other devices.

We do not scan, index or inspect the contents of your attachments. Note that photographs may contain whatever you point the camera at, so avoid attaching material you do not want stored in the cloud.

3.4 Subscription and purchase information

Scolefy offers an optional paid subscription. Purchases are processed by Apple through the App Store. We never receive your card number, billing address or any other payment details.

We use RevenueCat to check whether your subscription is active. RevenueCat receives an identifier linked to your Scolefy account, your purchase and renewal history for this app, and basic device and app-version information, so that premium features unlock on every device you sign in to.

3.5 Optional usage analytics

Firebase Analytics is off by default. If you explicitly enable “Share optional usage analytics” in Settings → Privacy Choices, Firebase Analytics collects app opens, session length, feature interactions, app version, device model, operating-system version, diagnostic events, an app-instance identifier, and a coarse region derived from IP address. We do not set your Scolefy account ID as the Firebase Analytics user ID and we do not send your classes, grades, assignments, notes, attachments, or study-session details as analytics events.

During onboarding we also record two optional answers:

• How you heard about Scolefy (for example App Store search, TikTok, Instagram, Reddit, YouTube, a friend or classmate, or a teacher) — you may choose “prefer not to say” or skip the question.
• Your stage of education (middle school, high school or university) — collected purely as a statistic, so we understand who the app serves. It does not change or personalise anything in the app. This may be skipped.

If analytics is enabled, these are stored as coarse categories against a pseudonymous analytics identifier. They are not linked to your grades or your content, and they are never used to target advertising to you.

3.6 Notifications and Live Activities

If you enable notifications, Scolefy schedules reminders for lessons, assignment due dates and study breaks. Most of these are scheduled locally on your device and their contents never leave it.

The study timer can run as a Live Activity on your Lock Screen and Dynamic Island. To keep it advancing while the app is closed, your device issues a push token for that Live Activity, which we store against your account and send to Apple’s Push Notification service together with the timer stage and its remaining time. The token is deleted when the session ends. It cannot be used to identify you outside this app and it carries none of your school content.

3.7 Advertising

Scolefy includes the Google Mobile Ads SDK so that a free, ad-supported tier can be offered. Scolefy requests non-personalised, general-audience ads only. We disable Google’s publisher first-party identifier and advertising personalisation. Google may still process IP-derived coarse location, device and app information, ad impressions and interactions, and performance, crash and other diagnostic information to deliver contextual ads, limit repetition, prevent invalid traffic, and measure aggregate performance. Google’s handling of this data is described in the Google Business Data Responsibility notice.

• Advertising is never shown to subscribers with an active Scolefy premium subscription.
• We do not pass your name, email address, account ID, school content or grades to any advertising network.
• Scolefy does not request App Tracking Transparency permission and does not use Apple’s advertising identifier to track you across other companies’ apps or websites.
• Because Scolefy is used by students who may be below the age of digital consent, every ad request is tagged accordingly. Google therefore serves non-personalised ads only, and no advertising-consent form is shown — there is no personalised advertising to consent to.
• Ads remain blocked until Google confirms an ad request is permitted.

3.8 Device permissions

Scolefy asks for these permissions only when you use the related feature:

You can withdraw any of these at any time in iOS Settings → Scolefy.

3.9 Verification, password reset and service security

For email verification, email changes and password resets, we create a short-lived verification record containing the destination email address, a one-way hash of the code, its expiry time, and attempt and resend counters. The code is valid for 10 minutes. We use Resend to deliver the message, so Resend receives the destination address and email contents. Password-reset abuse prevention also uses a one-way hash of the requesting IP address and a rolling request counter.

3.10 What we do not collect

• We do not collect your precise location.
• We do not read your contacts, calendar, health data, messages or call history.
• We do not request read access to your photo library.
• We do not record audio or video in the background.
• We do not ask for your date of birth or use the 13+ confirmation to build a detailed age profile.

You must provide an email address or supported sign-in identifier to create an account; without it we cannot authenticate or sync the account. All school content and attachments are optional. Scolefy does not make decisions about you using solely automated processing that produces legal or similarly significant effects.

4. How we use your information

• To provide the app — storing your school data and syncing it between your devices, running timers, generating your dashboard and widgets.
• To manage your account — authenticating you, recovering access, and honouring deletion requests.
• To deliver reminders you have asked for.
• To operate subscriptions — unlocking premium features and restoring purchases.
• To improve Scolefy — if you opt in to analytics, understanding in aggregate which features are used, where people drop out of onboarding, and which devices and languages to prioritise.
• To keep the service safe — investigating abuse, fraud and technical faults.
• To meet legal obligations and respond to lawful requests.

We do not use your school content for advertising, and we do not use it to train machine-learning or AI models.

5. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 GDPR:

Where we rely on consent, you can withdraw it at any time without affecting processing carried out beforehand.

Our legitimate interests are operating and securing the service, preventing fraud and abuse, improving reliability, and funding the free tier without behavioural advertising. We balance those interests against your rights, with particular care for users who are children. You may object to processing based on legitimate interests as explained in §9.

6. Who we share information with

We do not sell your personal information or share it for cross-context behavioural advertising. We disclose it only to the service providers that make Scolefy work, and only to the extent they need it. Each acts as our processor under contract, except where noted. We require processors to provide protections equivalent to those described in this policy and applicable law.

We may also disclose information:

• where required by law, court order or a valid request from a public authority;
• to establish, exercise or defend legal claims, or to protect the rights and safety of our users or the public;
• to a successor entity in connection with a merger, acquisition or sale of assets — in which case we will notify you before your information becomes subject to a different privacy policy.

A small number of our personnel can technically access stored data for troubleshooting, backup and abuse investigation. We access individual accounts only where necessary for those purposes or where you ask us to.

7. Where your data is stored

Scolefy’s database and file storage run on Google Cloud infrastructure in the European Union. Your school records are held in Google’s eur3 multi-region database location, and the photos and documents you attach to them are held in Google’s EU multi-region storage location. Both replicate your data across multiple data centers, all of them inside European Union member states. Your school content does not leave the EU in normal operation.

Some limited information is processed outside the EU. Scolefy’s Google Cloud server functions run in the United States and process account identifiers, usernames, verification and security records, and Live Activity timer schedules. Google Analytics and AdMob may process optional analytics and advertising data in the United States and other countries where Google operates. RevenueCat processes subscription information and Resend processes transactional-email information in the United States. Apple may process sign-in, payment and push data in the United States and other countries described in its privacy notice. The United Kingdom is also a destination because Zinx Studios Ltd is established there.

Where personal information is transferred out of the UK or the EEA, that transfer is covered by the UK International Data Transfer Addendum, the European Commission’s Standard Contractual Clauses, or an adequacy decision, as applicable. As a UK company we rely on the UK’s adequacy findings for EEA transfers into the United Kingdom. You may ask us at info@zinxstudios.com for information about the safeguard relevant to a particular transfer.

8. How long we keep it

When you delete your account, an automated process removes your database records and your stored files. Residual copies may remain temporarily in access-restricted disaster-recovery backups until they are overwritten under the provider’s backup cycle. They are not used for ordinary processing and would be removed again if a backup had to be restored.

9. Your rights and choices

Delete your account and everything in it

In the app, open Profile → Delete Account. You will be asked to confirm your identity, then your account, your school content and your uploaded files are deleted. This cannot be undone. Full instructions are on our account deletion page.

Your other rights

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your information;
• Port your information to another service in a machine-readable format;
• Object to or restrict certain processing;
• Withdraw consent you have previously given;
• Not be discriminated against for exercising any of these rights.

To exercise any of these, email info@zinxstudios.com from the address on your account. We respond within 30 days. We may ask you to verify your identity before acting, to make sure we are not disclosing your data to somebody else.

Controls inside the app and on your device

• Optional analytics is off by default. Enable or disable it at any time in Settings → Privacy Choices. Turning it off stops future collection and clears the app’s local analytics identifier.
• Where Google requires an advertising privacy-options form, reopen it from Settings → Privacy Choices.
• Turn reminders off entirely, or per category, in Scolefy’s notification settings.
• Revoke camera, photos or notification permissions in iOS Settings → Scolefy.
• Manage or cancel your subscription in iOS Settings → Apple Account → Subscriptions.

Complaints

If you are in the EEA or UK and believe we have handled your information improperly, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to address it first.

10. Children and students

Scolefy is built for students, and we expect many of our users to be minors. We take that seriously.

• Scolefy is not directed to children under 13. The app presents a 13+ eligibility screen before the Terms and account creation. A user who selects that they are under 13 cannot continue or create an account.
• The App Store’s 4+ rating describes the type of content in the app. It does not change Scolefy’s requirement that account holders must be at least 13.
• If you are between 13 and the age of digital consent in your country (which is between 13 and 16 in the EEA, and 13 in the UK), you may use Scolefy only with the permission of a parent or guardian.
• We do not use personalised or cross-context behavioural advertising for any user. Advertising personalisation and Google’s publisher first-party identifier are disabled, and ad content is limited to Google’s general-audience rating.
• We ask for the minimum amount of information necessary to run the app. The age check asks only whether the user is 13 or older; it does not request a date of birth.

If you are a parent or guardian and believe a child under 13 has created an account, email info@zinxstudios.com and we will delete the account and its contents promptly.

Scolefy is a personal organizer used by individual students. It is not a school information system, and we do not enter into school-district or institutional data processing agreements.

We assess features against the interests of children who are likely to use Scolefy, keep optional analytics off by default, avoid precise location and social discovery, and provide privacy controls in the app. Before introducing social features, personalised recommendations, location features or new advertising uses, we will carry out a fresh child-privacy and data-protection impact assessment.

11. Security

• All traffic between the app and our servers is encrypted in transit with TLS.
• Data stored in Firestore and Cloud Storage is encrypted at rest.
• Server-side security rules restrict every document and file to the account that owns it, so one user cannot read another user’s data.
• We never store your password; authentication is delegated to Firebase Authentication, Apple or Google.
• Deleting your account triggers an automated server-side process, so removal does not depend on manual action.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

12. Regional disclosures

California (CCPA/CPRA)

In the past 12 months we have collected the categories of personal information described in §3: identifiers, commercial information (purchase history), internet or app activity, approximate location, diagnostic information, and the content you choose to create or upload. It is collected for the business purposes in §4 and disclosed to the service providers in §6.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16. You may exercise your rights to know, delete, correct, and opt out by contacting info@zinxstudios.com; we will not discriminate against you for doing so.

Scolefy configures AdMob for non-personalised advertising and does not enable cross-context behavioural advertising. If our practices change, we will update this notice and provide any legally required “Do Not Sell or Share” or targeted- advertising opt-out before the change takes effect.

United Kingdom

Zinx Studios Ltd is established in the United Kingdom and is the controller for the purposes of the UK GDPR and the Data Protection Act 2018. Our legal bases are set out in §5, and your rights are in §9. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

European Economic Area

If you are in the EEA, the EU GDPR applies to our processing of your personal data. Our legal bases are set out in §5 and your rights in §9. You can contact us about any of them at info@zinxstudios.com.

You also have the right to lodge a complaint with the data protection supervisory authority in the EEA country where you live or work.

Switzerland

If you are in Switzerland, the Swiss Federal Act on Data Protection applies where its territorial rules are met. The categories collected, purposes, recipients, destination countries, safeguards and retention periods are set out above. You may request access, correction, deletion or portability where applicable by contacting us. You may also contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

13. Website, links and third-party content

The Scolefy website is a static site hosted by Firebase Hosting. Scolefy does not set advertising or analytics cookies on the website and does not run web analytics or tracking pixels there. Google may process ordinary hosting and security logs such as IP address, requested URL, timestamp, browser information and response status to deliver and protect the site.

You can attach web links to assignments. Opening a link takes you to a site we do not control and whose privacy practices are its own. This policy does not cover them.

14. Changes to this policy

We update this policy when the app changes. The version number and date at the top always reflect the current text.

If we make a material change — for example, collecting a new category of information, adding a feature that makes your content visible to other people, or sharing data with a new kind of recipient — we will give you notice in the app before it takes effect, and where the law requires it, ask for your consent. A privacy policy describes our processing; we do not treat silence or continued use as consent. Where consent is required, we will ask for it separately.

15. Contact us