EduManager Student

Developer: Crazenators Technologies · Package edu.manager.student
Effective date: 12 September 2026 · Version 1.0

For parents and guardians. This app is used by school students, many of whom are children. Your child's account is created by their school, not by us and not by your child. We do not collect anything from your child beyond what their school has entered and what the app needs to run. If you want your child's records changed or removed, contact the school — they decide. Section 10 explains your rights and how to use them.

1. Introduction

This Privacy Policy explains how Crazenators Technologies ("we") collects, uses, shares, secures, and deletes personal data in the EduManager Student Android application (package edu.manager.student) and the EduManager backend services it connects to.

EduManager Student lets a student see their own school records — timetable, attendance, homework, marks, notices and fee status. Accounts are created and issued by the school that has licensed EduManager. A student cannot register themselves, and the app is not offered to the general public.

Because its users are school students, this app is directed at children. It is designed and operated to meet Google Play's Families policy requirements and internationally recognised standards for children's data, including the principles behind COPPA and GDPR-K.

2. Our role, and the school's role

The school is the data controller. It decides which student records exist, what is entered about each student, who may see them, and how long they are kept.
Crazenators Technologies is the data processor. We host and maintain the software and process data only on the school's documented instructions, under our service agreement with it.

This matters for requests: anything about the content of a student's record — a name, a class, an attendance mark, a fee figure — is decided by the school. We will forward and support a request but we will not change a school's record on our own initiative.

3. Personal data we access, collect and use

We collect only what is listed below. We do not collect anything not listed here, and we do not ask a student to provide anything beyond their login.

3.1 Data the school provides about the student

Data	Purpose	Required?
Name	Identifying the student in the app and to their teachers	Required
Admission number	The sign-in identifier, and the key linking the account to the school's records	Required
Class and section	Showing the correct timetable, homework and notices	Required
Email address	Password reset and service notices, where the school has recorded one	Optional
Phone number	Account recovery, where the school has recorded one. Usually a parent's or guardian's number	Optional
Profile photo	Display on the student profile and ID card, where the school has uploaded one	Optional

3.2 School records the student can view

The app displays records held in the school's EduManager instance: the student's own attendance history and percentage, assessment and exam marks, homework assignments and due dates, test schedules, study material shared with their class, school notices, fee status, and timetable. These records are created by the school's staff, not by the student, and the app shows each student only their own.

3.3 Data the student may submit

Where the school has enabled homework submission, a student may attach a file or photo to a homework assignment. Access is limited to the specific file the student picks; the app cannot browse the device's photo library or storage.

Delete section 3.3 and the photo-picker row in section 4 if homework submission is not in the released build. Do not describe a feature the app does not have.

3.4 Data collected automatically

Data	Purpose
App version, Android version, device model	Compatibility and support
Randomly generated install identifier	Linking crash reports to a session. Reset on reinstall, and not an advertising identifier
IP address	Security, rate limiting, abuse prevention
Push notification token	Delivering notifications about homework, notices and results
Sign-in timestamps and session tokens	Authentication and session management
Crash logs and error diagnostics	Diagnosing and fixing failures. These do not include marks or attendance data

3.5 Data we do not collect

We do not collect location of any kind — not precise, not approximate, not in the background. We do not collect contacts, SMS messages, call logs, browsing history, installed-app lists, audio, health data, financial account or payment card details, or biometric templates.

We do not use the Android Advertising ID. The app does not declare the AD_ID permission and transmits no persistent advertising or device identifier — no advertising ID, IMEI, SIM serial or MAC address. There is no advertising SDK in this app and no behavioural profiling of any kind.

4. Permissions the app requests

Android asks permission before each of these. Any of them may be declined; the related feature becomes unavailable and the rest of the app continues to work.

Permission	Why the app needs it
`POST_NOTIFICATIONS`	Alerts for new homework, notices, results and timetable changes
Photo/media picker	Attaching a file to a homework submission. Access is limited to the file the student selects — no library or storage permission is requested
`INTERNET`, `ACCESS_NETWORK_STATE`	Communicating with the school's server and detecting offline mode

The app requests no location, camera, contacts or storage permission.

EduManager Student is a read-only view of the school's records. A student does not enter, edit or submit school data through it, and the app collects no information about the student beyond what is listed in section 3.

5. How we share data

We do not sell personal data. We do not share it with advertisers or data brokers. We do not use it to train machine learning models outside the school's own instance. We run no third-party analytics that profile children.

Recipient	Data shared	Purpose
The student's school	The student's own records and audit entries; teachers and administrators see them within their role scope	Operating the school's system
Hosting provider [name it]	All application data, encrypted in transit and at rest	Hosting the EduManager backend in Malaysia
Push delivery provider [name it]	Device push token and notification content	Delivering notifications
Competent legal authority	As legally compelled	Compliance with a valid legal order

Each provider processes data under contract, on our instructions only.

Name the hosting and push providers explicitly. A generic phrase such as "third-party service providers" is a frequent cause of Play rejection under the User Data policy, and the bar is higher for a child-directed app. Any provider receiving children's data must be one whose terms permit it.

6. How we secure data

All traffic between the app and our servers uses TLS 1.2 or higher. The app rejects insecure connections.
Passwords are stored as salted hashes; they are not recoverable in plain text by anyone, including us.
Access is scoped server-side. A student account can retrieve only that student's own records — modifying the app client cannot widen what it can see.
Sessions expire, and tokens can be revoked centrally, so a lost or stolen device can be cut off immediately.
Changes to attendance, marks and student records are written to an audit log recording the user and timestamp.
Data at rest is stored on access-controlled servers with regular encrypted backups.
Our personnel access production data only where necessary for support, under confidentiality obligations.

If a breach occurs that is likely to affect users' rights, we will notify the school without undue delay and support its response and any notifications it must make to parents or authorities.

7. Data retention

Data	Retained for
Student academic and attendance records	As long as the school instructs, per its record-keeping policy and any legal requirement
The student account	Until the school deactivates it, then [90 days] before anonymisation
Authentication and session logs	[12 months]
Crash and diagnostic logs	[90 days]
Push notification tokens	Until the app is uninstalled or the account is deactivated
Backups	[30 days] on a rolling cycle, then overwritten
All school data after the licence ends	Exported to the school on request, then deleted within [60 days]

Each period above must be one you can actually honour operationally, not an aspiration. A child-directed app is judged on data minimisation, and unnecessarily long retention of children's data is the wrong answer.

8. Fee information

Where the school has enabled it, the app displays the student's fee status — amounts due and amounts paid — as a read-only figure taken from the school's records.

The app takes no payments. There are no in-app purchases, no payment gateway, and no card or bank details are collected, stored or transmitted by the app. Fees are paid to the school by its own methods, outside this app.

If in-app fee payment is ever added, this app becomes subject to Play's Families requirements on purchases and payment gating, and this section, the Data Safety form and the store listing all have to change. Do not add it without reworking the compliance position first.

9. Account deletion

Accounts are issued and controlled by the school, so deletion normally goes through it. A deletion request can be made in any of these ways:

In the app: Profile → Request account deletion
On the web: https://edumanager.crazenators.tech/deleteaccount.html
By email: [email protected], from the registered address, or from a parent or guardian identifying the student and school

What is deleted: the student's profile, contact details, photo, device and push tokens, session records, and support correspondence.

What is retained: academic and attendance records belong to the school and remain part of its institutional record, as the school's admission terms provide. The student's identity in related audit entries is replaced with a non-identifying reference.

Requests are acknowledged within [7 days] and completed within [30 days], unless the school instructs otherwise or retention is legally required.

The deletion URL must resolve to a live page before you submit the app. Play checks it.

10. Children's data, and the rights of parents and guardians

Most users of this app are under 18 and many are under 13. We treat all of their data as sensitive.

Nothing is collected directly from the child beyond their login. Every other piece of personal data in the app was entered by the school, under its admission terms and the consent it holds from the parent or guardian.
No advertising, ever. No ads, no ad SDK, no advertising identifier, no behavioural profiling, no retargeting.
No secondary use. A child's data is used to operate the school's system and nothing else — not product analytics, not marketing, not model training.
No sale or brokering. Children's data is never sold, licensed or shared with data brokers under any circumstances.
Strict scoping. A student sees only their own records. Server-side enforcement means no student can reach another student's data.
No open communication features. The app has no student-to-student messaging, no public profiles, no user-generated content visible to other students, and no external links or social features that would take a child off the app.

How a parent or guardian exercises rights. You may ask to see what personal data is held about your child, have inaccurate data corrected, ask for deletion, object to or restrict processing, withdraw consent, and receive a portable copy.

Because the school is the controller, start with the school — its administration can act on the record directly. If you would rather come to us, write to [email protected] identifying the student and the school; we will verify the request with the school and support it. We respond within [30 days] and verify identity before disclosing anything about a child.

11. Where data is processed

EduManager data is hosted on servers in Malaysia. Where a provider processes data outside Pakistan, we require contractual safeguards at least equivalent to this policy. On-premise deployment is available for schools requiring in-country hosting.

12. Governing law

Pakistan has no comprehensive personal data protection statute currently in force; the Prevention of Electronic Crimes Act 2016 (as amended) governs misuse and unauthorised transfer of personal data. We have written this policy against internationally recognised data protection principles, including those underlying COPPA and GDPR-K for children's data, so that our practices align with Pakistani legislation once enacted. This policy is governed by the laws of the Islamic Republic of Pakistan.

13. Changes to this policy

We may update this policy as the product or the law changes. The version and effective date above always reflect the current text. Material changes are notified to schools in advance and shown as an in-app notice before taking effect. Where a change materially affects children's data, schools are notified so they can inform parents and guardians.

14. Contact

If your question concerns a specific student's record, please contact the school's administration first — they hold the decision.