Privacy Policy

The short version

• We collect what ClassMates needs to work: your account, what you share in your groups, and your study activity.
• Messages, shared notes, flashcard decks, files and links are checked for safety before your group sees them.
• Parents and guardians see summaries only. Never messages, notes or quiz answers.
• No ads. No tracking. This website sets no cookies.
• You can download a copy of your data, or delete your account, at any time.

Who we are

ClassMates is run by TBD-OWNER: the legal name of the company or person that operates ClassMates, its registered address and its business registration number.

If you use ClassMates through a school or another organisation, that organisation also decides some things about how ClassMates is used there, such as how long group chat is kept. TBD-OWNER: say whether the school or ClassMates is the data controller for school accounts, as confirmed by legal counsel.

For privacy questions or requests, write to hello@classmates.lk.

TBD-OWNER: say whether a Data Protection Officer has been appointed and, if so, how to reach them.

What we collect

Your account

• Your e-mail address, so you can sign in. ClassMates has no passwords. You sign in with a code we send by e-mail, or with Apple or Google where those are offered. If you use Apple or Google, they share your e-mail address with us and may share your name. Google also shares a link to your profile picture, which ClassMates doesn't use.
• Your name. Your display name, and your full name if you or your school add it.
• Your role and organisations: student, teacher, parent or guardian, moderator or admin, and the schools or organisations you belong to.
• For students: your birth year (never your full date of birth), your grade or level, your subjects and your language. We use your birth year to apply age rules.
• Your country and time zone. We take your country from your device's region when you sign up, and we use your time zone so days, limits and quiet hours follow your clock. Other people can't see your country.
• A profile photo, if you choose to add one.
• Your agreement to the community promise, and when you gave it.

What you create and share

• Messages in your groups and study rooms.
• Notes, comments, flashcards, quizzes and quiz answers, goals, assignments and submissions.
• Files and links you share. We remove location, camera details and other hidden information from photos before anyone else sees them.

Your study activity

• Study time, focus rounds, streaks, badges and progress.
• Daily limits, quiet hours and break settings, if you or a parent set them.

Safety

• Reports you make, people you block, appeals, and safety notices about your account.
• When Guardian AI checks something, a record of that check: a masked copy of the text, with names and personal details replaced, and the result.

Your devices and settings

• A notification token for each device where you turn notifications on.
• Your settings, such as your language and who can see your progress.

If you pay for a plan

Only adults can pay. When someone pays ClassMates directly, we keep the payer's name, e-mail address and phone number, the order, the amount, the payment method as the payment provider reports it, and a numbered receipt or invoice. We never see or store card numbers.

Purchases in the iPhone app are handled by Apple through the App Store. We receive a record of the subscription so the plan can work in ClassMates. We don't receive card details. Nothing is sold in the Android app.

If you contact us through this website

Your name, e-mail address and message, and anything else you choose to add, such as your organisation, role, country, phone number or the number of learners. To stop spam we use a scrambled form of your internet address. We don't store it.

Testimonials

We only publish a quote with the person's recorded consent. For anyone under 18 we also need a parent's or guardian's consent. We never publish a photo or video of anyone under 18.

What we don't do

• We don't show ads.
• We don't track you across other apps or websites.
• This website (classmates.lk) sets no cookies and loads no analytics, trackers or third-party scripts.
• The web app (web.classmates.lk) sets only the cookies it needs to keep you signed in.
• Our server logs never contain what you write. They record things like which page was asked for, when, and whether it worked.

How we use your information

• To run ClassMates: to sign you in, show your groups, keep the shared focus timer in step, save your work, and send the notifications you've turned on.
• To keep people safe: to check content before it's shared, to let people report, block and appeal, and to help moderators decide.
• To apply rules: age rules, daily limits, quiet hours and rate limits. These are enforced on our servers, not just in the app.
• To give summaries: class-level information for teachers and schools, and summaries for linked parents, as explained below.
• To handle payments: to take payments, send receipts and keep the records the law requires.

TBD-OWNER: the lawful basis for each of these uses under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as confirmed by legal counsel.

How Guardian AI handles your content

• Guardian checks messages, shared notes and flashcard decks, uploaded files and shared links before your group sees them.
• It runs fixed rules first, on our own servers. These look for things like phone numbers, unsafe links and words that suggest someone is in crisis.
• Before any text could reach an AI safety model, we replace names, phone numbers, e-mail addresses, links, ID numbers, card numbers and social media names with placeholders. Images can't be masked, so we remove their hidden information first.
• An AI safety model would receive only the masked item and, for a message, up to five masked messages around it.
• Your private notes are never checked unless you share them.
• If Guardian can't check something, it holds it for a person. Nothing unchecked is posted.
• AI never restricts, pauses or bans anyone. People make those decisions.

Safety model provider: TBD-OWNER: name the AI safety model provider and where it processes data, or state that none is used (Q-300). Any provider must have a data-processing agreement in place, keep little or no data, and not train on what it receives.

Who can see what

• Your groups. Members see what's posted in the group: messages, shared notes and decks, files and links. They see your display name and profile photo. People who share only open community groups with you see your display name, never your full name.
• Teachers. They see what's posted in groups they belong to. They see your progress only if your "Who can see my progress" setting allows it.
• Parents and guardians. Only after you approve the family link, and only summaries: study time, streaks, badges, goals, whether you're within your limits, and short safety summaries. Never your messages, notes, quiz answers or calls. If you choose "Only me", your study time and goals stay private, while limits and safety summaries still work. Paying for a plan never lets a parent see more.
• Moderators and safeguarding leads. They never read group chat directly. When a case needs them, they see the item and up to five messages around it, with names replaced by letters. If they reveal a name, that's logged.
• School admins. They never read group chat. School reports show totals, and groups of fewer than 10 students are left out. Exports need the principal's approval.
• ClassMates staff. A small number of staff can use platform tools, only with two-step sign-in, and their actions are logged. Staff have no directory of members.
• Other students. They never see your progress unless you choose to show your streak to your groups. There are no rankings or leaderboards.
• Payments. Only the payer can see their payments. For an organisation licence, that organisation's admins can see its billing. Nobody else can tell whether you're on a paid plan.

Features that are off for now

Study help with your own ChatGPT account

This feature isn't turned on yet. When it is, a student can choose to connect their own ChatGPT account:

• The sign-in happens on OpenAI's own page. ClassMates never sees the ChatGPT password.
• The sign-in tokens stay on the student's device. They never reach our servers.
• Only the text the student picks, and can edit first, goes from the device to OpenAI.
• Our servers keep only a record of when the student connected, changed or disconnected. Only the student can see it.
• OpenAI's own terms apply to the student's ChatGPT account. Disconnecting doesn't delete what OpenAI has already processed.
• It's never used to check anyone else's content.

Voice and video calls

Calls aren't turned on yet. Where they are:

• Calls happen only between people who already share a group, and only when someone chooses to start or join one.
• Audio and video are encrypted so the media server can't read them. Each call has its own key, which our servers hand only to the people in the call and delete when it ends.
• Nothing is recorded or stored.
• We keep call details (who was invited, who joined and left, and when) for 180 days. They're in your data export. Parents never see them.

We'll name the calls service provider on this page before calls are turned on.

Service providers and where your data is stored

We use these providers. Each one gets only what it needs.

• Supabase: our database, sign-in and server functions. It holds the app's data. Location: TBD-OWNER: confirm the region of the production Supabase project (Q-001).
• Cloudflare: stores uploaded files (Cloudflare R2) in its Asia-Pacific region, which is outside Sri Lanka. Cloudflare treats this region as a preference, not a guarantee. Cloudflare also hosts this website and the web app.
• Apple and Google: deliver push notifications. They receive the notification and a device token.
• OnePay (Spemai (Pvt) Ltd): processes payments made to ClassMates outside the App Store. It receives the payer's name, e-mail address and phone number, the amount and an order number. It never receives anything about the student a plan is for.
• Apple (App Store): processes purchases made in the iPhone app.
• The AI safety model provider: see "How Guardian AI handles your content" above.
• OpenAI: only for a student who connects their own ChatGPT account, once that feature is on.
• E-mail: TBD-OWNER: name the service that sends sign-in codes and receipts.

Some of these providers store or process data outside Sri Lanka. TBD-OWNER: the legal safeguard used for transfers outside Sri Lanka, as confirmed by legal counsel.

How long we keep it

• Group chat: your school chooses. The default is one school year, and chat is cleared on 31 December. Chat in open community groups is kept for 365 days. Messages linked to an open safety case are kept until the case is closed.
• Your notes, decks and other work: until you delete them or your account is deleted. Your school may set files in archived groups to be deleted after a set time.
• Uploads still waiting for their safety check: deleted after 24 hours.
• Files that weren't shared because of a safety check: kept for 30 days so you can appeal, then deleted. Nobody can download them.
• Safety records (checks, cases, appeals and escalations): 3 years.
• Your data export: the file is deleted 7 days after it's ready.
• Call details: 180 days.
• Billing records: TBD-OWNER: the retention period the accountant specifies (Q-704). If you delete your account, they're kept without your name, e-mail address or phone number.
• Website enquiries: TBD-OWNER: how long contact-form messages are kept.
• Server logs: TBD-OWNER: how long server logs are kept. They never contain what you write.

Your choices and rights

• Get a copy of your data. In your profile, under "Your data", choose "Request a copy of my data". We'll let you know when it's ready, and the download link works for 7 days. The file includes your profile, settings, groups, the messages you sent, notes, flashcards, quiz answers, study time, goals, badges, appeals, reports you made, safety notices, family links, notifications, devices and call details. Files you uploaded are listed, and you can download the files themselves in the app. Billing records aren't in the export yet; ask us and we'll send them.
• Correct your details. Edit your profile in the app. For details your school manages, ask your school.
• Control who sees your progress. Use "Who can see my progress", and choose whether your groups see your streak or online status.
• End a family link. A student or a parent can unlink at any time.
• Delete your account. In the app, open Settings and choose Delete account, or go to Delete your account. Deletion has a 7-day grace period: sign in before it ends to cancel. It completes within 30 days. If you're part of a safety case that's still open, deletion waits until a person closes it.
  • What stays: a line in your school's audit log saying an account was deleted, classes a teacher created (they stay with the school), billing records without your name or contact details, and safety records where safeguarding or the law requires them.
• Ask, object or complain. Write to us at the privacy address above. You can also complain to Sri Lanka's Data Protection Authority.

Children and young people

• You must be at least 13 to use ClassMates.
• Students below the consent age need a parent or guardian to approve their account before they can join groups. Schools set this age; the default is 16. Outside a school it's 16, or higher where a country's rule says so (18 in Sri Lanka).
• We work out ages from the birth year only, assuming your birthday hasn't happened yet this year.
• Parents see summaries only, as described above.
• People under 18 never see a price or a checkout. They can only ask a linked parent.

How we protect your data

• Data is encrypted when it travels and when it's stored.
• Access rules in our database decide who can see each piece of data, whatever the app asks for.
• Files are stored privately. Download links expire after 10 minutes.
• Secret keys live only on our servers, never in the apps or the browser.
• Staff need two-step sign-in, and important actions are written to logs that can't be edited.
• On a shared computer, the web app starts in shared-computer mode. It stores nothing on the computer and signs you out after 15 minutes without use. Always sign out when you're done.

Changes to this policy

When we change this policy, we update the date at the top of this page.