Privacy Policy
Effective date: 14 August 2026 · Last updated: 14 August 2026
Who controls your data. Campus Shield AI is used under the direction of an institution — a school, college or coaching centre. The institution decides what is recorded about its students, staff and parents, and is the data controller for those records. Campus Shield AI operates the platform as a data processor acting on the institution's instructions.
This matters when you want something changed or deleted: for teacher, student, parent and driver accounts, your institution's administrator is the first point of contact. See Your rights.
1. Scope
This policy covers the Campus Shield AI mobile application (Android and iOS) and the web administration console at campusshieldai.in. Both are backed by the same Google Firebase project.
Accounts are provisioned by the institution. There is no public self sign-up for students, parents, teachers or drivers — an administrator creates each account and issues its credentials. The only public form is an institution's own request for access, which is reviewed before an institution workspace is created.
2. What we store
2.1 Institution profile
Institution name, type, address, contact phone and email, the institution's login code, and an optional logo image uploaded by an administrator.
2.2 Account and profile data
| Role | Stored about them |
|---|---|
| Administrators | Name, email address, login ID, role, and the institutions they administer. |
| Teachers | Name, internal staff ID, phone number, optional recovery email, and the classes and subjects they are assigned to teach. |
| Students | Name, roll number, class and section, a guardian phone number, links to their parent account(s), and a sign-in account whose password is set and resettable by an administrator. |
| Parents / guardians | Name, phone number, optional email, an optional separate WhatsApp number, a WhatsApp consent and opt-out flag, and the list of children they are linked to. |
| Bus drivers | Name, phone number, and the bus route assigned to them. |
Passwords are handled by Firebase Authentication and are never stored in readable form by the platform.
2.3 Attendance, remarks and academic records
- Attendance — per class, subject and period, marked present, absent or late, with the date and the teacher or administrator who recorded it.
- Remarks — short free-text notes a teacher or administrator writes about an individual student. A remark may optionally name the subject and the teacher it is addressed to.
- Incidents — discipline or welfare notes recorded against a student, handled with the same restrictions as remarks.
- Class timetables — the weekly period grid for each class: subject, assigned teacher and period timings. Published by administrators.
- Notices and holidays — announcements and the institution's calendar of non-teaching days.
2.4 Guardian phone numbers
A guardian phone number is entered by the institution against a student record. It is used to contact the guardian about that student and, where WhatsApp consent has been recorded, to deliver attendance alerts (see 2.6).
Changing a student's guardian number revokes any previously recorded WhatsApp consent until an administrator makes a fresh, explicit consent decision for the new number. Consent does not silently follow a phone number to a different person.
2.5 Push notifications
When you install the mobile app, Firebase Cloud Messaging issues the device a registration token. We store that token against your account so notifications reach the right device. Tokens are stored per device, are never readable by any app user, and are removed when you sign out, when the device is re-registered by another account, or when the messaging service reports the token as no longer valid.
Notifications are used for attendance alerts, announcements, and student pickup and drop-off updates.
2.6 WhatsApp messages
For attendance alerts only — a student marked absent or late — the platform can send a linked guardian a WhatsApp message. To deliver it, the guardian's phone number and the message text are sent to the Meta WhatsApp Cloud API, operated by Meta Platforms, Inc., which is the delivery channel. Meta's handling of that data is governed by Meta's own terms and privacy policy.
WhatsApp messages are sent only where the institution has recorded the guardian's consent and the guardian has not opted out. Consent and opt-out are recorded per student and can be changed by an administrator at any time. Student accounts are never messaged over WhatsApp.
2.7 Bus location (drivers only)
- While a bus trip is active, the driver's device streams its location, speed and bearing so parents and students can see the bus on a map. The stream stops when the driver ends the trip. The app does not run a background location service — closing the app stops the stream.
- The route taken during a completed trip is saved so an administrator can review it.
- Each pickup and drop-off the driver marks is recorded, with the coordinates at that moment if location permission was granted.
Location is collected from drivers only, and only on the driver screen during an active trip. No other role's location is collected at any time.
2.8 Diagnostics
The mobile app uses Firebase Crashlytics in release builds to report crashes. A crash report contains the error and stack trace, the device model and operating system version, and a crash-reporter installation identifier. It is used to diagnose faults and is not used to profile users.
The web console does not include Crashlytics. It uses Firebase App Check with reCAPTCHA Enterprise to verify that requests come from the genuine console rather than an automated client; this involves Google assessing the browser's interaction with the page.
Firebase records standard operational logs for the requests our servers handle.
3. What we do not collect
- No advertising SDKs, advertising identifiers, or ad profiling.
- No third-party analytics or behavioural tracking SDKs.
- No biometric data, contact lists, calendars, SMS, call logs, browsing history, or financial information.
- No background location, and no location at all from students, parents, teachers or administrators.
- We do not sell, rent, or share personal data for advertising or any other commercial purpose.
4. How the data is used
- To operate the service — signing users in, showing each person the records they are entitled to see, and recording attendance, remarks, timetables and notices on the institution's behalf.
- To communicate — sending attendance alerts, announcements and transport updates by push notification and, with consent, WhatsApp.
- To keep accounts secure — verifying sign-ins, enforcing access rules, and recording administrative actions in an audit trail so an institution can see who created, changed or removed an account.
- To fix faults — diagnosing crashes and errors.
We do not use institution data to train machine-learning models, and we do not use it for any purpose the institution has not asked for.
5. Who the data is shared with
| Recipient | What they receive | Why |
|---|---|---|
| Google Firebase (Google LLC) |
All platform data — accounts, records, files, notification tokens, crash reports | Our cloud infrastructure provider: authentication, database, file storage, push delivery and hosting |
| Meta Platforms, Inc. (WhatsApp Cloud API) |
A consenting guardian's phone number and the alert text | To deliver attendance alerts over WhatsApp |
| OpenStreetMap | Map tile requests from the device while viewing a bus map | To display the map background |
That is the complete list. We may also disclose data where we are legally required to do so, or where it is necessary to investigate a security incident.
Data is stored in the Firebase project campus-shield-3fb98. The database is hosted in Google's asia-south1 (Mumbai, India) region; some backend functions run in Google's United States region, so data may be processed there in transit.
6. Who can see what
Access is enforced on the server by Firebase Security Rules, not merely hidden in the interface. Every institution is a separate tenant, and no account can read another institution's data.
| Role | Can see |
|---|---|
| Administrator | Everything within their own institution. |
| Teacher | Only the classes and subjects they are assigned: that class's attendance, remarks, timetable and roster. Not other classes, and not other teachers' records. |
| Student | Only their own records — their attendance, their class timetable, notices addressed to them, and their own bus status. |
| Parent / guardian | Only the records of the children linked to them. |
| Bus driver | Only their assigned route and its boarding list. Not attendance, remarks or the wider roster. |
Campus Shield AI staff hold administrative access to the Firebase project in order to operate and support the service. We access institution data only when necessary to run the platform or to respond to a support or security request.
7. How the data is protected
- Encrypted in transit. All traffic to Firebase and to the WhatsApp Cloud API uses HTTPS/TLS. Google Cloud encrypts stored data at rest as standard.
- Server-enforced access rules. Permissions are evaluated on Google's servers on every read and write, and are derived from server-written records that a client cannot alter. An account cannot widen its own access by editing its own profile.
- Tenant isolation. Access is scoped to a single institution at every level, and is tested against deliberate cross-institution attempts.
- App Check. The web console and sensitive backend operations require an attestation that the request came from the genuine application.
- Least privilege. Sensitive operations — creating or deleting accounts, resetting passwords, sending messages — run on the server with authorisation checks and an audit record, rather than in the client.
- Notification tokens are never readable by any user of the platform, only writable by the device that owns them.
No system can be guaranteed completely secure. We do not claim any formal security certification for the platform.
8. How long it is kept
- While the workspace exists — records are kept for as long as the institution's workspace exists. There is no automatic time-based deletion of attendance, remarks, notices or trip history; an administrator can delete records at any time.
- When an individual account is deleted — the sign-in is destroyed immediately and the personal record is erased: name, login ID, email, phone numbers (including the WhatsApp number and consent flag), roll number, class and section, assigned classes, subjects and routes, parent–child links, uploaded files, notification tokens, and every search index built from them. What remains is a non-identifying marker holding only a record id, the institution id, the former role, an inactive flag, and when and by whom it was deleted — so historical records do not point at a missing entry.
- Attendance history — references in attendance records are anonymised on deletion and may be retained for up to seven years for the institution's recordkeeping and for legal or security claims. Seven years is a maximum, not a requirement; a shorter applicable period takes precedence.
- When an institution is deleted — the institution record, every account it manages, all of its records and all of its uploaded files are deleted. Only a non-identifying deletion audit — hashed identifiers and counts, no names, codes, emails or user ids — is kept, for no longer than seven years, to evidence that the deletion happened.
- On your device — the app keeps a local copy so it works offline. Signing out and choosing "Forget this device" clears it. Android auto-backup is disabled, so this local copy is not copied off the device by the operating system's backup service.
9. Students and children's data
Students are genuine users of Campus Shield AI, and in a school setting some of them are children.
- Accounts are created by the institution, never by the child. There is no public sign-up. The institution is responsible for obtaining any parental or guardian consent required by law before entering a child's data or issuing them a login.
- Only what the service needs is stored about a student: name, roll number, class and section, the link to their guardian, their attendance and notices, their class timetable, and their bus pickup and drop-off status.
- Students have read-only access to their own records and can reach no one else's.
- No advertising, no profiling, no advertising identifiers, and no third-party analytics — for any user, and specifically for children. Children's data is never sent over WhatsApp.
- A parent or guardian can have a child's account and data corrected or deleted by asking the institution's administrator.
The institution is the data controller for student records under India's Digital Personal Data Protection Act, 2023; Campus Shield AI acts as the data processor on the institution's instructions.
10. Your rights
You can ask to access, correct, or delete the personal data held about you, and to withdraw consent where processing is based on it — most directly, WhatsApp messaging.
- Teachers, students, parents and drivers — your account is created and managed by your institution, so please contact your institution's administrator, who can correct, disable or delete it. If your institution cannot be reached, contact us at the address below and we will help.
- Administrators — you can manage every account in your institution from the console's user management section, and delete the institution account itself.
- Withdrawing WhatsApp consent — ask your institution's administrator to record an opt-out against the student. Messaging stops; nothing else about the account changes.
- Notifications — you can revoke the notification permission in your device settings at any time. The rest of the app keeps working.
We aim to provide an initial response within 7 hours. Resolution time depends on the nature, urgency, and complexity of the request.
11. Deleting an account
An institution administrator can permanently delete the institution account — including every teacher, student, parent and driver account it manages and all of its data — from the app's settings, after re-entering their password and confirming.
An administrator can also submit a deletion request without using the app:
Account deletion request form:
https://campusshieldai.in/account-deletion
This form and the web console are for institution administrators. If you are a teacher, student, parent or driver, your institution's administrator deletes your account for you — see Your rights.
12. Changes to this policy
If we change how data is handled, we will update this page and change the "Last updated" date above. Material changes will also be noted in the app's release notes. This page always reflects the practices currently implemented.
13. Contact
For data access, correction or deletion requests, or any privacy question or complaint:
- Email: campus.shield29@gmail.com — we aim to provide an initial response within 7 hours. Resolution time depends on the nature, urgency, and complexity of the request.
- Urgent security issues (for example a leaked password): email the same address with [URGENT] at the start of the subject line. Urgent security issues are prioritized, with an initial response target of 7 hours.
- Operator: Campus Shield AI, Kethepally, Nalgonda, Telangana 508211, India.
If your request concerns records held by a specific institution, that institution is the data controller and is the fastest route — but you may always write to us and we will forward it and follow up.