Privacy policy

Who we are

The “مدارس الأقمار” (Al-Aqmar Schools) app and the website alaqmar.org belong to Al-Aqmar Private Primary School in Baghdad, which is responsible for the data described here.

What data we handle

• A parent's account: name, phone number and, if given, email address. Passwords are stored hashed and cannot be read by anyone.
• What the school records about a student: name, school number, class and section, photo, attendance, grades once published, homework and exams, behaviour notes the school chooses to share with the parent, and the school ID card.
• What a parent sends through the app: requests, messages and leave requests, and any photos attached to them.
• Device data needed for notifications: a push token and the device type, disabled when the parent signs out.
• On the website: what a parent types into the enrolment form (their name, phone, email if given, the child's name, the stage and a message), and a visit counter that uses no cookies and stores no IP address.

The app does not ask for your location or contacts, shows no ads and contains no third-party tracking or analytics. The camera and photos are used only when you choose to attach a picture to a request.

Why we use it

• To show parents their child's attendance, grades, homework, exams and school news.
• To send notifications such as absences, published grades and announcements.
• To receive and answer parents' requests.
• To contact families who enquire about enrolment.

We do not sell data, use it for advertising, or share it for any other purpose.

Who it is shared with

Data is stored on the school's own server, rented from Hetzner Online. To deliver notifications to a phone, the notification's title, text and the device token pass through Expo's push service and then Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone). Data is not shared with anyone else unless the law requires it.

How we protect it

• All traffic between the app and the server is encrypted (HTTPS).
• Passwords are hashed; staff access is limited by role and sensitive actions are recorded in an audit log.
• Parents see only their own children, and grades only after the school publishes them.
• The data is backed up daily.

How long we keep it

• A parent's account stays active while one of their children is enrolled.
• A student's school records (attendance, grades, certificates, fees) are kept by the school like its paper records, because they are official records.
• The notification token is disabled when you sign out of the app.
• Website enquiries stay with the office while they are followed up, and are deleted when the family asks or once dealt with. Visit counts are cleared after about a year.

Your rights

Parents may see and correct their own and their children's data and ask for their account to be deleted — see “Delete account & data”. For anything else, contact the school using the details below.

Children

The app is for parents, not children. Students' data is entered by the school; no child is asked to create an account.

Changes to this policy

If this policy changes we update this page and the date below, and tell parents about significant changes through the app.