Privacy Policy

1. Who we are

Skubo is a play-school companion app built by Wizer Technologies in Gurgaon, Haryana, India. Schools subscribe to Skubo; their teachers, parents and admin staff use the app to share what's happening with the children in their care. Parents always use Skubo for free.

This policy covers the Skubo mobile apps (Android and iOS), the Skubo website at skubo.app, and the back-end services that support them.

2. What we collect

From parents

• Your name, mobile number and email address (used for OTP login and to deliver notifications).
• The schools and children you are linked to, and your relationship to each child (mother, father, guardian, etc.).
• Messages you send to your child's teachers, RSVPs to school events, and any information you add to your own profile.
• Basic device information: app version, OS version, push notification token, and crash diagnostics.

From schools and teachers

• School details: name, location, classes, fee structure, staff list and roles.
• Children admitted to the school: name, photo, date of birth, parent contacts, class assignment, medical and dietary notes the school chooses to record, and the parent contacts linked to each child.
• Day-to-day activity posted by teachers: attendance, photos and videos, observations and notes, scheduled and ad-hoc activity entries, gate-pass scans, fee receipts and chat messages.

From the website

• If you join the waitlist, we collect the email address you submit so we can write back when Skubo opens in your city.
• Standard request logs (IP address, user agent, timestamp) generated by AWS for security and rate-limiting.

We do not use any third-party analytics, advertising or behavioural-tracking SDKs in the Skubo apps or on this website.

3. How we use it

We use the information above for one purpose: to make Skubo work for the parents, teachers and schools who use it. Specifically:

• To show you your child's day — attendance, photos, activities, notes, schedule, gate scans.
• To deliver the messages your school's teachers and admin staff intend for you.
• To generate SkuboAI summaries for parents. These are produced from the school's own posted data for that child — photos, observations, attendance, schedule. SkuboAI does not invent facts and does not pull from outside sources.
• To send push notifications and emails you've opted in to (or haven't opted out of).
• To keep accounts secure: rate-limiting OTPs, detecting abuse, debugging crashes.
• To improve the product. When we look at usage to decide what to build next, we work with aggregated, de-identified information — not specific people.

We do not sell your data. We do not show you ads. We do not let other companies advertise to you through Skubo.

4. Children's data

Children are the reason Skubo exists, and they are also the people whose data we are most careful with. A few specifics:

• Children do not have their own Skubo accounts. A child's record is created by their school, and access to that record flows only through (a) the school's authorised staff and (b) the parents the school has linked to that child.
• A parent's right to view, correct or delete a child's record is exercised through the parent's account (see Your rights). Where a child has more than one parent or guardian linked, each can act for the child.
• Photos, videos and notes about a child are uploaded by the school, not by us. The school decides what to share. We provide the technology that delivers it to that child's parents — not to anyone else.
• SkuboAI summaries about a child are generated only from that child's own school data, and only for that child's parents.
• Skubo does not attempt to identify children using face recognition for any purpose other than helping parents find their own child's photos within their own school's gallery. Face matching, where used, runs on the school's own posted photos only.

If you are a parent and want a child's data corrected or removed, write to us at hello@skubo.app from the email registered to your Skubo account, and we'll work with the school to make it happen.

5. Storage & security

All Skubo data is stored on Amazon Web Services (AWS) in the Mumbai region (ap-south-1). Photos and videos sit in private S3 buckets with encryption at rest; structured data sits in DynamoDB. Personal data does not leave India in the normal course of operations.

We use, in particular:

• OTP-only login. No passwords stored on Skubo's side, so there is nothing to leak in a password breach.
• Role-based access. Every API call checks who is asking and what they're allowed to see. A parent sees only their own child's data. A teacher sees only their own class. An admin sees only their own school.
• Encryption in transit. All traffic between the apps, the website and our servers is over HTTPS / TLS 1.2+.
• Encryption at rest. S3 and DynamoDB are encrypted using AWS-managed keys.
• Logging and monitoring. Access to back-end systems is logged. Suspicious patterns are alerted on.

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you and the relevant Indian authorities as soon as we can.

6. Third-party services

Skubo runs on a small number of third-party services. We pick them carefully and limit what we share.

• Amazon Web Services (AWS), Mumbai region. Hosts our compute, storage, databases, image delivery and notification infrastructure.
• Amazon SES. Sends transactional email (OTPs, school invites, waitlist replies).
• Expo Push. Delivers push notifications to your phone via Apple's APNs and Google's FCM. The notification body is generated by Skubo; the delivery transport is Expo's.
• AWS Bedrock (Mistral, Anthropic Claude, Amazon Nova). Used to generate SkuboAI summaries. We send only the data needed to summarise a single child's day or week, scoped to that child's school.
• Razorpay (planned). When school fee payments roll out, we will use Razorpay to process payments. Razorpay handles card and UPI data directly under their own privacy policy; we receive only payment status and a reference number.

We do not embed advertising SDKs, behavioural-analytics SDKs, social-media trackers or any third-party JavaScript in the Skubo apps. The waitlist form on this website posts directly to our own backend.

7. Sharing & disclosure

We share information only in the following situations:

• With your school. The school you (or your child) belong to is the source of most of the data on Skubo and is naturally a recipient of it. Different staff at the school see different things based on their role.
• With other parents linked to the same child. If two parents share custody and both have Skubo accounts linked to the same child, they see the same updates about that child.
• With our service providers. The third parties listed in section 6, only to the extent needed for them to provide the service.
• If required by law. If we receive a valid legal order from an Indian authority, we may have to share information to comply. Where allowed, we will tell the affected user first.
• In a business transition. If Skubo is ever acquired or merged, your data will move to the new owner under the same protections, and we will tell you in advance.

We do not sell, rent or trade personal information to anyone, ever.

8. Your rights

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) gives you specific rights over your personal data. We try to honour the spirit of those rights for everyone who uses Skubo, regardless of where they live. You can:

• See what we have. Request a copy of the personal data we hold about you (or your child, if you're the linked parent).
• Correct it. Most of the data flows from your school, so corrections usually go through them; we'll help if needed.
• Delete your account. You can ask us to delete your Skubo account and the personal data we hold about you. Some records (audit logs, payment receipts) we may need to retain for legal reasons; we'll tell you what stays and why.
• Withdraw consent. You can stop using Skubo at any time. Push notifications can be turned off in your device settings or in the app's notification preferences.
• Complain. If you think we've handled your data badly, write to us first (hello@skubo.app) — we'd much rather fix it than have you escalate. You also have the right to complain to the Data Protection Board of India.

To exercise any of these rights, email us from the address on your Skubo account so we can verify it's you.

9. Retention

We keep your data for as long as you have an active Skubo account, plus a short window after that for backups and audit. Specific cases:

• Photos and videos stay in the school's gallery as long as the school keeps the child's record open. Schools can delete individual posts at any time.
• Gate-pass scans and attendance are kept for the academic year so parents can look back, then archived.
• Chat messages stay until either party deletes them or the school's relationship with Skubo ends.
• Waitlist emails are kept until we've written to you to confirm Skubo is open in your city, then deleted.
• OTP logs are kept short-term (a few days) for fraud detection, then deleted.

When you ask us to delete your account, we delete or anonymise your personal data within 30 days, except where we're required by law to retain something longer.

10. Changes to this policy

As Skubo grows, this page will change. When we make a meaningful change, we'll update the "Last updated" date at the top, and — for material changes — write to the email on your account before the change takes effect. The current version of this page is always at skubo.app/privacy.html.

11. Contact us

Privacy questions, data requests or anything else — please write in. A real person reads every email.