← Home

ClassMate Privacy Policy

Last updated: May 24, 2026

This Privacy Policy explains what data the ClassMate mobile application ("the App") collects, why we collect it, and how we use it. The App is operated by Tony Aboud ("we," "us"). By using the App you consent to the practices described here.

1. Data we collect

We collect the following categories of data so the App can function:

• Contact info — email address, name, phone number (only when you set one for SMS password reset).
• User content — direct messages, voice messages, photos, files, and announcement posts that you create or send inside the App.
• Student records — for student users: grades, attendance, schedule, assignments, exams, certificates issued by your school's teachers.
• Parent linkage — for parent users: the list of children you are approved to view.
• AI conversation data — the messages you send to the NOVA AI tutor and the responses you receive. We use this data to deliver tutoring responses through Anthropic's Claude API and to track your token usage.
• Purchase data — subscription tier, top-up purchases, and entitlement state, processed through Apple's StoreKit and synchronised via RevenueCat.
• Identifiers — a user ID generated by our server. We do not collect device advertising identifiers (IDFA / IDFV).
• Diagnostics — crash logs and basic error telemetry to keep the App working.

2. Why we collect it

• App functionality — to display your schedule, grades, messages, and announcements; to authenticate you; to power the NOVA AI tutor; to process purchases.
• Account management — login, password reset, role-based permissions (student, teacher, parent, secretary, admin).
• Communication — sending in-app notifications when something happens that involves you (a new grade, an announcement, a new direct message).
• Service improvement — anonymised error and performance data so we can fix bugs.

We do not use your data for advertising or for any kind of cross-app tracking. We do not sell your data.

3. Who we share it with

We share data only with the third-party processors required to run the App:

• Anthropic — your messages to NOVA are sent to Anthropic's Claude API to generate tutoring responses. See Anthropic's privacy policy.
• Apple / RevenueCat — in-app purchase transactions are processed by Apple and synced through RevenueCat. See Apple and RevenueCat.
• Resend — transactional emails (password reset, account verification). See Resend's privacy policy.
• Twilio — SMS password reset codes when you choose SMS as your reset channel. See Twilio's privacy policy.
• Railway — our application server and database are hosted with Railway. See Railway's privacy policy.

Within your school, your data is visible according to your role. Teachers see their students' grades. Parents see their own children's records (linked through an approved parent-child relationship). Students only see their own data. Admins manage school-wide settings. No data crosses school boundaries.

4. Data retention

We retain your account data while your account is active. If you delete your account (contact us at the email below), we permanently delete your personal data within 30 days, except where retention is required for legal or accounting reasons (for example, purchase records for tax purposes).

5. Your rights

You can request a copy of your data, request correction or deletion, or withdraw your consent at any time by emailing the contact address below. We will respond within 30 days.

6. Children's privacy

ClassMate is intended for students at participating schools, including users under 16. Student accounts are created by the school administrator on the student's behalf. No advertising or third-party tracking is used in the App. Parents linked to a student account can view and manage that student's interactions with the App.

7. Security

We use HTTPS in transit, password hashing (bcrypt) at rest, JWT-based authentication, and role-based authorisation on every endpoint. Passwords and tokens are never logged. The server hardens against brute-force attacks with per-IP rate limits on credential endpoints.

8. International transfers

Our server is hosted in the United States. By using the App you consent to your data being processed in the United States and in the countries where our processors operate.

9. Changes to this policy

If we make material changes to this policy we will update the "Last updated" date at the top and, where appropriate, notify users in-app.

10. Contact

Questions or requests? Email aboudtony22@gmail.com.