Who is responsible
The apps are used by schools that run Chalkby. The school decides what is recorded about its pupils, parents and staff, and is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Chalkby runs the service for the school and processes the data on the school's behalf. Accounts are created by the school, not in the app.
In short
- Data travels only over encrypted connections (HTTPS).
- The apps have no ads and no analytics. Nothing is sold, and nothing is shared with anyone for their own use.
- Children's school records (attendance, marks, fees, bus, photos) are entered by the school and shown to their parents. They are never sold or used for advertising.
- Location: the driver app shares the bus's location only during a trip; the staff app uses location only at the moment of punching in or out; the parent app uses no location.
Chalkby for Parents
| Data | Why and when |
|---|---|
| Mobile number | Signing in with a code; numbers of adults the parent adds to collect a child from the bus; booking a visit |
| Name, e-mail | Adults added to collect a child; the parent's name and e-mail passed to the school's payment gateway for the receipt |
| Account id | The account the school created |
| Face description | Only where the school turns on face sign-in: a description of the face (a list of numbers, not a photo) is sent to the school's server |
| Payments | Fee payments, receipts and UTR numbers. Card or UPI details are typed into the payment gateway's own screen and are not stored by the app |
| Health | Only if a parent gives an illness as a leave reason or attaches a doctor's note |
| Messages | Chats with teachers, questions to the assistant, meeting feedback |
| Photos and files | Homework pages and PDFs, payment screenshots |
| What the parent enters | Leave requests, survey answers, meeting bookings, book ratings, WhatsApp consent |
| Notification token | To deliver notifications to the phone |
Not collected: location, contacts, calendar, audio, browsing.
Chalkby Staff
| Data | Why and when |
|---|---|
| Name, e-mail, mobile number, account id | Signing in and the staff record |
| Precise location | Only at the moment a staff member punches in or out, or scans at the gate, to check they are at school. Never in the background |
| Photos and files | Student photos, class-diary board photos, homework and notice attachments |
| Messages | Chats with parents, notices |
| What the staff member enters | Attendance, marks, homework, leave applications and approvals |
| Diagnostics | Whether the phone reports a fake location when punching |
| Device id, notification token | Punching from a known phone; delivering notifications |
Payslips and loans are shown to the staff member, not collected by the app. Pupils' records and photos seen in the staff app are covered by the school's rules for children's data.
Chalkby Driver
| Data | Why and when |
|---|---|
| Precise location, also in the background | During a trip only, which the driver starts and ends: every 10 seconds while moving, every minute when parked, plus trip start, trip end and SOS. Shared with the school and the parents of children on that bus. In the half hour before a scheduled trip the app checks the location on the phone, without sending it, to remind the driver to start the trip |
| Name, driver id | The attendant's name; the adult a child is handed to; the driver's sign-in |
| Trip marks and messages | Pick-up, drop, hand-over and kept-on-bus for each child; delay and problem reports |
| Diagnostics | Every 2 minutes on duty: battery level, charging, GPS on, which permissions are allowed, a fake-location flag, the app version |
| Device id, phone make and model, notification token | Knowing which phone is on the bus; delivering trip alarms |
The camera only reads the set-up QR code; nothing is saved or sent. An SOS text message is sent by the driver from the phone's own SMS app.
Who else receives data, only to do the job
- The payment gateway the school uses (for example Razorpay, Stripe, Cashfree, Flutterwave, PayU or PayPal), for fee payments.
- Google Firebase, to deliver notifications.
- SMS, WhatsApp and e-mail providers, to deliver the school's messages.
- The hosting company that runs the servers.
How long data is kept
The school decides how long its records are kept, within what the law requires of schools. Data stays only while the school uses Chalkby or the law requires it. When a school stops using Chalkby, its data is deleted after the school has had the chance to export it. Signing out of the staff app clears the records kept on the phone for offline use.
Seeing, correcting or deleting your data
Ask your school first: it holds your records and can correct or remove them. You can also write to us and we will pass the request to the school and help it act on it. Or use the contact form and choose "deletion request" in your message. The steps are on ask for your data or its deletion; complaints go to our grievance officer.
Children
The apps are meant for parents, staff and drivers. They show children's school records, which the school enters with the parents' consent that the school collects. Where a school gives pupils their own sign-in, the same rules apply.
Changes
We will update this page when the apps change what they collect, and show the date at the top.
See also the website and service privacy policy.