Privacy Policy

Effective date: 29 July 2026 Last updated: 29 July 2026

Draft, not yet reviewed by legal counsel. This is a working draft to unblock pilot testing. Get qualified legal counsel to review it (India DPDP Act, 2023 and Play Store / App Store requirements) before you deploy it to a real school.

1. Who we are

MyKydd is a school operations platform for K-12 schools in India. We do live bus tracking, attendance, guardian pickup verification, meals, homework, announcements, and manual finance workflows, all in one place.

• Operator: MyKydd (the “we”, “us”, “our”)
• Contact: support@mykydd.com
• Grievance officer: support@mykydd.com (interim). We’ll appoint a dedicated grievance officer before public launch, as Rule 5 of the DPDP Act framework requires.

2. Scope

This policy covers:

• The MyKydd Parent app
• The MyKydd Driver app
• The MyKydd Admin Dashboard that school staff use
• The MyKydd backend APIs behind all three

Each school using MyKydd is the data fiduciary for its students, parents, drivers, and staff. We’re the data processor, acting on the school’s behalf under the DPDP Act. In plain terms: the school owns the data, we just run the software.

3. What personal data we collect

We’re a small team, and we only collect what the product actually needs to work. Here’s the full list.

From parents and guardians

• Full name and phone number (the phone number is your unique identifier)
• A Firebase auth identifier (a hashed token, not your raw phone number wherever we can avoid it)
• A push-notification device token from Firebase Cloud Messaging (FCM), so we can send you alerts
• Profile photo, only if you upload one
• Rough device info (Android/iOS version, app version) so we can debug problems you report

From students (minors)

• Full name
• School, class/section, and academic year
• Attendance records
• Bus route and stop assignments
• Meal records (only if the school uses MyKydd meals)
• Homework and announcement receipts

We do not collect biometric or facial-recognition data from students. Ever. It’s not a feature we want to build.

From drivers

• Full name and phone number
• Assigned route and vehicle
• Live GPS location of the bus, but only while a trip is active
• Trip start/end times and manual student taps

When there’s no trip running, we don’t track the driver. The GPS turns off with the trip.

From school staff (admin, office, teachers, meal manager, canteen, finance)

• Name, work email, phone number
• Role and school-scoped permissions
• An audit trail of sensitive actions they take in the platform

Collected automatically

• Server logs (IP address, request path, timestamps, HTTP status codes)
• Push notification delivery receipts
• Device tokens needed to deliver push notifications

4. How we use personal data

Only for the things below. Nothing else.

• Bus safety and transport: show parents the live bus location, send boarding and arrival alerts, flag missed boardings, and verify who’s authorized to pick up a child.
• Attendance: record classroom and transport attendance, and let authorized staff make post-midnight corrections.
• Meals and canteen: track which students collected their meal on which day, and generate served-meal reports for the school.
• Homework and announcements: deliver homework and class notices from teachers to the linked parents.
• Finance: issue invoices, record manual payments (cash, cheque, bank transfer, external payment link), and keep an immutable payment ledger for each school.
• Login: verify phone numbers through Firebase Phone Auth so parents and drivers can sign in.
• Notifications: send time-sensitive alerts (boarding, arrival, approach, missed boarding, pickup handoff) via FCM.
• Support: figure out what went wrong when you report a bug.
• Security: catch abuse, audit sensitive actions, prevent fraud.

Some things we deliberately don’t do:

• We don’t run ads. There are no ads anywhere in the product.
• We don’t sell your data to anyone. Not aggregated, not anonymised, not ever.
• We don’t do cross-school analytics unless the school has explicitly signed a contract for it.
• We don’t run facial recognition or biometric surveillance on students.

5. Legal basis for processing

Under the DPDP Act, 2023, we process data on these grounds:

• Contract: we need to process the data to actually deliver the service the school has signed up for.
• Consent: where the DPDP Act asks for it, we get informed consent from the person (parent, driver, or guardian, and from a lawful guardian on behalf of a minor) before processing.
• Legal obligation: when Indian law requires us to keep or hand over certain data.

6. Who we share data with

The list is short:

• The school running your account. Each school only sees its own students, staff, parents, and transport data. Cross-school access is technically blocked.
• Service providers who help us run the platform, all under contract:
  • Firebase (Google LLC): phone verification and push notifications
  • Neon Postgres: managed database hosting (Singapore region)
  • Oracle Cloud Infrastructure: compute for the backend
  • Cloudflare (planned): DDoS protection and DNS
  • Grafana Cloud: logs and metrics for monitoring
• Law enforcement or government, but only when compelled by a valid legal order under Indian law.

We do not sell your data. Never have, never will.

7. International data transfers

A few of our providers store or process data outside India:

• Neon Postgres: Singapore (ap-southeast-1)
• Firebase: multiple regions. Google picks based on how it’s configured
• Grafana Cloud: India / Asia Pacific where possible

They all encrypt data in transit and at rest and are contractually bound to protect it. Any transfer out of India relies on the contractual safeguards the DPDP Act permits.

8. How long we keep data

• Live bus GPS pings: 30 days, then deleted automatically.
• Attendance records: the current academic year plus 3 years after, to match school record-keeping norms.
• Payment ledger entries: 7 years. Indian tax and audit law requires it.
• Server logs: 14 days, for debugging.
• Authentication records: as long as the account is active, plus 90 days after deletion.
• Push notification device tokens: deleted when you sign out or uninstall the app.

When a school stops using MyKydd, we delete or return its data within 90 days, unless the law tells us to hold onto something longer.

9. Your rights under the DPDP Act

You can:

• Access the personal data we hold about you.
• Correct anything that’s wrong or incomplete.
• Delete your personal data, subject to what the school and the law require us to keep.
• Withdraw consent for anything we do based on consent. Anything we already processed under your earlier consent stays valid.
• Nominate someone to exercise these rights for you if you die or become incapacitated, as the DPDP Act allows.
• Complain to the Data Protection Board of India if you think we’ve crossed a line.

Email support@mykydd.com with the subject line “Data rights request” and we’ll get back to you within 30 days. Usually much sooner.

Parents and guardians can exercise these rights on behalf of their minor children.

10. Children’s data

The DPDP Act treats data about children (under 18) with extra care, and so do we. For students under 18:

• We only collect what Section 3 lists. Nothing more.
• We don’t use children’s data for behavioural tracking or targeted ads.
• We rely on the school and the parent or guardian to consent on the child’s behalf.
• School administrators have tools to correct or delete a student’s record.

11. Security

Here’s what we actually do to keep the data safe:

• In transit: every request between the apps and our servers uses HTTPS with TLS 1.2 or later.
• At rest: Neon (our database host) encrypts the data on disk.
• Login: short-lived JSON Web Tokens (JWT) with periodic key rotation, and phone verification through Firebase.
• Tenant isolation: every database query is scoped to the caller’s school. Cross-school access is blocked at the query layer, not just the UI.
• Least privilege: each staff role only sees the data it needs to do its job.
• Audit trail: payments, corrections, deletions, and approvals are all recorded immutably.
• Vulnerability management: we scan container images and audit dependencies in CI.

No system is 100% secure. If you think your account has been compromised, email us right away at support@mykydd.com and we’ll act on it.

12. Cookies

The mobile apps don’t use browser cookies.

The Admin Dashboard uses:

• Strictly necessary cookies: session and authentication cookies (JWT) that keep you signed in. You can’t turn these off and still use the dashboard.
• No third-party tracking cookies.
• No advertising cookies.

We might add analytics cookies later (something like Google Analytics or Plausible). If we do, we’ll update this page and ask for consent where the law requires it.

13. Changes to this Policy

Software changes, and so will this document. When it does:

• We update the “Last updated” date at the top.
• Material changes get announced by email and inside the app.
• Old versions stay in our public repository so you can see what changed.

14. Contact

• General privacy questions: support@mykydd.com
• Grievance officer: support@mykydd.com (interim)
• Address: Hyderabad, Telangana, India

For any right in Section 9, email us with the subject line “Data rights request”.