Privacy Policy

📋 Overview

Effective date: June 8, 2026  ·  Last updated: October 21, 2026

Eskwela ("the App") is a student scheduler built for Filipino students, developed by Ivan (independent developer, Minglanilla, Cebu, Philippines). This policy explains what data we collect when you use the Eskwela Android app, how we use it, and who we share it with. By using the App, you agree to this policy.

This App is intended for users 13 years of age or older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can delete it.

📦 Data We Collect

We collect only what's necessary to provide the App's features:

Data	Why we collect it	Where it's stored
Google account (name, email, profile photo)	Sign-in via Google OAuth — so you have a personal account	Supabase (our database)
Email & password (if you sign up with email instead of Google)	Creates and secures your account; a 6-digit code is emailed to verify it's really you	Supabase (passwords are hashed — we never see or store them in plain text)
Display name & user code	Used for your profile and so friends can find and add you by name or code	Supabase
Class schedule, tasks, allowance, quizzes & app settings	Core features. Saved on your device so the App works offline. If you are signed in, they are also synced to your account so they are backed up and appear on your other devices.	Device, and Supabase when signed in (cross-device sync)
Study material you choose for AI Quiz Maker, AI Summary and "Why?" explanations (text read from your PDFs, slides or photos, and selected images)	Only when you tap Generate or Summarize. The text is sent through our server to an AI model to create your quiz, summary or explanation. Usage counts are logged to enforce free limits.	Finished quizzes and summaries are saved on your device (and synced if signed in). Explanations may be cached on our server so the same question isn't re-generated. Your source files are not stored by us.
Lecture Files (PDFs, slides, photos and links you add to subject folders)	Organizing your study files. Premium members get cloud backup so files are restored on a new phone.	Device; Supabase Storage for Premium cloud backup only
Quizzes you publish to the Quiz Marketplace (title, questions, optional display name, course and year)	Only if you choose to publish a quiz so other students can find and use it. Stars and reports on quizzes are counted to rank and moderate them.	Supabase (public to other users until you delete it)
Device identifier (one-way hashed)	A salted SHA-256 hash of your phone's Android ID, used only to stop the same phone from claiming one-time rewards (welcome points, friend referral Premium) more than once. The original ID never leaves your phone and cannot be recovered from the hash.	Supabase
Friend referral records	If you invite friends or enter a friend's code: which account referred which, when, and any free Premium days earned, so rewards can be granted and abuse prevented.	Supabase
Esky AI chat history	Saved locally so your conversation persists between sessions	Device only (SharedPreferences)
Friends list & friend requests	To connect with other Eskwela users and manage friend requests	Supabase
Friend-to-friend chat messages	Real-time messaging between friends inside the App	Supabase
Developer support messages	When you send a message to the developer through the in-app chat feature; the developer can reply directly	Supabase
Esky AI chat messages (Groq)	Sent to Groq to generate a response. Groq does not retain inference inputs/outputs by default, but may temporarily log them for up to 30 days if needed to troubleshoot reliability issues or investigate suspected abuse — subject to Groq's privacy policy.	Not stored by us (Groq only)
Schedule image (Gemini import)	If you use the photo-to-schedule import feature, the image is sent to Gemini for parsing	Not stored by us (Gemini only)
Google Classroom data (course names, assignment titles, due dates, instructions)	Optional — if you choose to connect Google Classroom, used to import your assignments into your task list	Device only (SharedPreferences) — never uploaded to our servers
Calendar events (title, date and time, location, notes) from your phone's calendars and/or Google Calendar	Optional — only if you turn on Calendar sync. Used to show your events and reminders in the Schedule and Tasks tabs. Read-only: the App never creates, edits or deletes anything in your calendar.	Imported events become tasks on your device. If you are signed in, tasks are backed up to your own account in Supabase to sync across your devices, like any other task. Not shared with anyone else.
Location — saved School/Home coordinates, and live device location (including in the background)	Optional — powers Location Alerts: a notification when you arrive at or leave a School/Home spot you've set, and the live "how far away am I" map. See the dedicated section below.	Saved spot coordinates: device (SharedPreferences) and Supabase, for cross-device sync. Live position: processed on-device only, via Android's Geofencing API — never sent to our servers or any third party.
Advertising ID, device info, and ad interactions (Google AdMob)	Free users see a banner ad at the bottom of the App, and can choose to watch rewarded ads to earn points or unlock a feature. Google AdMob uses this data to show ads, confirm a rewarded ad was finished, measure ad performance, and prevent fraud. Premium members don't see banner ads.	Collected and processed by Google AdMob, not stored by us
App install and sign-up events (TikTok Business SDK)	Lets us measure which of our TikTok ads led to app installs and new sign-ups. The SDK may collect your advertising ID, device and app information, and IP address.	Collected and processed by TikTok, not stored by us

📍 Location Alerts & Background Location Access

Location Alerts is an optional, opt-in feature that notifies you the moment you arrive at or leave a School or Home spot you've saved — so you never miss your stop, without having to keep the App open.

To do this, Eskwela requests "Allow all the time" (background) location access, in addition to the standard foreground location permission. Background access is required specifically because the notification must fire even when the App is closed or your phone is locked — with only foreground access, Android would stop checking your location the moment you switch away from the App, and the whole point of the feature (not having to keep it open) would break.

What actually happens with your location:

• You choose the School/Home spot yourself — either by standing there and tapping "Use My Current Location," or by picking a point on the map. Nothing is captured until you do this.
• Detecting that you've arrived or left is handled entirely on-device by Android's own Geofencing API (Google Play services) — your live location is not streamed to, processed by, or stored on our servers, and is not shared with any third party. It works fully offline.
• Only the School/Home spot's coordinates (the fixed point and radius you set, not your live position) are saved — to your device, and to Supabase so the same spot appears if you sign in on another device.
• The optional "Live Location" map view (opened from the Location Alerts widget) shows your live position only on your own screen, for as long as that screen is open, to display distance/ETA to your saved spots. This live position is never uploaded anywhere.

This feature is entirely optional. Eskwela functions normally without it. You are asked for location permission only when you choose to set up Location Alerts — never on first app open. You can:

• Decline location access, or skip Location Alerts setup entirely, with no effect on any other feature.
• Delete a saved School/Home spot at any time from Location Alerts in the App, which also stops the background geofence for that spot.
• Revoke location access entirely at any time via Android Settings → Apps → Eskwela → Permissions → Location — Location Alerts will simply stop working until access is granted again.

⏳ Background Processing (Foreground Service)

Making an AI quiz or summary can take 1 to 3 minutes. So that you don't have to keep the App open the whole time, Eskwela uses an Android foreground service (the FOREGROUND_SERVICE_DATA_SYNC permission) to keep that one request running if you switch to another app.

• It starts only when you tap Generate (Quiz Maker) or Summarize (AI Summary). It never starts on its own.
• While it runs, Android shows an ongoing notification with progress and a Cancel button, so you always know it's working.
• It only sends the study text you selected to our server and downloads the finished quiz or summary. It does not access your location, contacts, camera, microphone, or any other files.
• It stops as soon as your quiz or summary is saved, fails, or you cancel it.

No extra data is collected because of this service. It handles the same study material described in "Data We Collect" above.

⚙️ How We Use Your Data

Your data is used solely to operate Eskwela's features:

• To authenticate you and maintain your account
• To save your class schedule, tasks, and Esky chat history locally on your device
• To power the Friends feature — finding users, sending/accepting requests, and messaging
• To enable the Developer Support chat so you can contact us and receive replies
• To power the Esky AI tutor (chat messages are sent to Groq per session; Groq does not retain them by default but may log them temporarily per their policy)
• To allow you to import schedules from photos via Gemini
• To display Philippine public holidays in your calendar (fetched from the Nager.Date API — no personal data is sent)
• If you choose to connect Google Classroom, to read your course list and coursework due dates so they can be imported into your task list
• If you turn on Calendar sync, to read events from your phone's calendars or Google Calendar so they appear in your Schedule and Tasks tabs and can remind you
• If you set up the optional Location Alerts feature, to detect on-device when you arrive at or leave a saved School/Home spot and notify you
• To show banner ads to free users, and optional rewarded ads through Google AdMob when you choose to watch one for points or a feature unlock
• To sync your schedule, tasks, allowance, quizzes and settings across your devices when you're signed in
• To generate AI quizzes, summaries and answer explanations from study material you choose, including in the background via a foreground service
• To back up Lecture Files to the cloud for Premium members
• To run the friend referral program and stop one-time rewards from being claimed twice on the same phone
• To measure which of our TikTok ads led to installs and sign-ups

We do not sell your data. Your schedule, tasks, notes, quizzes, chats, and Google Classroom data are never used for advertising or shared with advertisers. The only advertising in the App is optional rewarded ads served by Google AdMob, which uses your device's advertising ID as described below. You can reset or delete your advertising ID at any time in your device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy & Security → Tracking).

Google API Services User Data Policy. Eskwela's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

🔗 Third-Party Services

The App uses the following third-party services. Each has its own privacy policy:

• Supabase Stores your account info, display name, user code, friends list, friend chat messages, developer support messages, synced app data (schedule, tasks, allowance, quizzes, settings), Premium Lecture Files backups, published Marketplace quizzes, and referral records. supabase.com/privacy
• Google OAuth Handles sign-in. Your Google profile info is accessed for account creation. policies.google.com/privacy
• Groq API Processes your Esky AI chat messages to generate responses. Groq does not retain inference inputs/outputs by default. However, Groq may temporarily log inputs and outputs for up to 30 days when troubleshooting reliability issues or investigating suspected abuse. You can learn more at groq.com/privacy-policy and console.groq.com/docs/your-data.
• Google Gemini API Used for the photo schedule import feature and for reading images in AI quizzes. Images are processed and not stored by us. ai.google.dev/terms
• OpenRouter Routes the study text you choose for AI Quiz Maker, AI Summary and "Why?" explanations to the AI model that generates the result. Requests go through our own server, not directly from your device. openrouter.ai/privacy
• TikTok Business SDK Measures app installs and sign-ups that came from our TikTok ads. May collect your advertising ID, device and app information, and IP address. TikTok Privacy Policy
• Nager.Date API Fetches Philippine public holidays for calendar display. No personal data is sent to this service.
• Google Calendar API Optional — if you choose to connect Google Calendar, we use the read-only scope calendar.readonly to list the calendars you have selected in Google Calendar and read their events (title, date and time, location, description). We use this only to show those events and reminders to you inside the App. We never write to your calendar, never use this data for advertising, never sell it, and never share it with third parties. We do not allow humans to read it except with your explicit consent for support, for security or legal reasons, or when it is aggregated and anonymized. policies.google.com/privacy
• Google Classroom API Optional — if you choose to connect your Google Classroom account, we read your class list and coursework due dates using read-only scopes. This data is used only to populate your task list and is stored locally on your device, never on our servers. policies.google.com/privacy
• Cloudflare Turnstile Used only when you sign up, sign in, or reset your password with email — silently verifies you're a real person, not a bot, to prevent abuse. It runs invisibly and shows no visual challenge. See Cloudflare's Turnstile Privacy Policy.
• Resend Delivers the email containing your 6-digit verification or password-reset code when you use email sign-up/sign-in. resend.com/legal/privacy-policy
• Google AdMob Shows a banner ad to free users and optional rewarded ads you choose to watch in exchange for points or a feature unlock. AdMob may collect your device's advertising ID, IP address, device and app information, and ad interaction data to serve ads, measure them, and prevent fraud. Premium members don't see banner ads. See how Google uses data in ads and policies.google.com/privacy.

🗂️ Data Retention & Deletion

Your account data (profile, friends, friend chat messages, and developer support messages) is stored in Supabase for as long as you have an active account.

Your class schedule, tasks, allowance, quizzes and settings are stored on your device. If you're signed in, a copy is also kept in Supabase for cross-device sync, until you delete your account. Esky AI chat history and assignments imported from Google Classroom stay on your device only. Clearing the App's data or uninstalling the App removes the on-device copy. You can disconnect Google Classroom access at any time from within the App, or by revoking Eskwela's access directly at myaccount.google.com/permissions.

Events imported by Calendar sync are stored as tasks on your device and, if you are signed in, in your own account in Supabase so they sync across your devices. They are removed from the App when you turn Calendar sync off, when the event is deleted or moved in your calendar, when you delete the task, or when you delete your account. We keep only events from about one week ago to 90 days ahead.

To request deletion of your account and all associated server-side data, contact us at ivancreatordeveloper@gmail.com. We will delete your account and all associated data within 30 days. You may also submit a data deletion request via the Eskwela website.

AI chat messages (Esky/Groq), schedule import images, and the study text you send for AI quizzes and summaries are not stored by us. They are sent to the AI provider per request and are subject to that provider's retention policy. AI answer explanations may be cached on our server (without your account details) so the same question isn't re-generated.

Premium Lecture Files backups are kept until you delete the file or your account. Quizzes you publish to the Marketplace stay public until you delete them. Referral records and the hashed device identifier are kept while your account exists, to keep one-time rewards from being claimed again.

Saved School/Home spot coordinates are kept until you delete them from Location Alerts in the App (which removes them from your device and Supabase, and un-arms the background geofence), or until your account is deleted. Your live location during Location Alerts is never stored — it is evaluated on-device in real time and discarded.

🔒 Security

All data transmitted between the App and our services is encrypted via HTTPS/TLS, and Supabase encrypts data at rest.

Your profile, friends list, and friend chat messages are protected by database-level Row Level Security (RLS) — rules enforced by the database itself, not just checks inside the App:

• Profile visibility is limited to yourself and your friends. Your display name, friend code, avatar, and grade/year are only readable by you and by users you've already added as friends — not by every signed-in user.
• Messages are readable only by the two people in that conversation, and can only be sent between users who are already accepted friends — enforced at the database level, so this holds even if the App's own checks were ever bypassed.
• Adding a friend by code uses a narrow, exact-match lookup. It can confirm a code you already have, but cannot be used to browse, list, or scrape other users' profiles.
• Friend requests are protected against race conditions by a database-level uniqueness rule, preventing duplicate or conflicting requests even if two people add each other at the same moment.
• Friend requests are rate-limited to prevent automated scripts from mass-adding accounts or probing large ranges of friend codes.

Schedule, task, and chat data stored locally on your device is protected by Android's standard app sandboxing — other apps cannot access it.

Friend chat messages are not end-to-end encrypted — they're stored securely on our servers (encrypted in transit and at rest) to support features like message history, but not in a way that prevents authorized server-side access. No method of transmission or storage is 100% secure; please avoid sharing passwords, financial details, or other sensitive personal information in chat messages.

👦 Children's Privacy

Eskwela is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it promptly.

🛡️ Your Rights & Choices

You have the following rights regarding your personal data:

• Access — You can request a copy of the personal data we hold about you (name, email, friends list, chat messages stored in Supabase).
• Correction — You can update your display name and profile at any time within the App.
• Deletion — You can request deletion of your account and all associated server-side data by contacting us at ivancreatordeveloper@gmail.com. We will complete the deletion within 30 days. Data stored locally on your device (schedule, tasks, Esky chat history) can be deleted at any time by clearing the App's data or uninstalling it.
• Opt-out of AI processing — You can choose not to use the Esky AI tutor, photo schedule import, AI Quiz Maker, AI Summary or "Why?" explanations to avoid sending data to Groq, Gemini or OpenRouter. You can cancel a quiz or summary in progress from its notification at any time.
• Disconnect Google Classroom — Connecting your Google Classroom account is entirely optional. You can disconnect it at any time within the App, or revoke access directly at myaccount.google.com/permissions.
• Turn off Calendar sync — Calendar sync is entirely optional. Switch each source off in the App (Tasks or Schedule tab, ⋮ menu, Calendar sync) and the events it imported are removed. You can also revoke Google Calendar access at myaccount.google.com/permissions, and revoke the phone calendar permission in Android Settings → Apps → Eskwela → Permissions → Calendar.
• Turn off Location Alerts — Delete a saved School/Home spot within the App at any time to stop that geofence, or revoke Location permission entirely via Android Settings → Apps → Eskwela → Permissions → Location.
• Manage permissions — You can revoke the App's permissions (e.g. camera, location) at any time through your Android device settings.

To exercise any of these rights, contact us at ivancreatordeveloper@gmail.com.

🔄 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top. Continued use of the App after changes constitutes acceptance of the updated policy.

📊 Google Play Data Safety

In accordance with Google Play's Data Safety requirements, here is a summary of our declarations:

Category	Collected	Shared with 3rd party
Personal info (name, email)	Yes — via Google OAuth or email/password sign-up	Yes — Supabase (service provider), and Resend/Cloudflare Turnstile (email delivery & bot protection, email sign-up only)
Messages	Yes — friend chat & developer support chat	Yes — Supabase (service provider)
App activity	Yes. Schedule, tasks, allowance, quizzes and settings (synced when signed in); app install and sign-up events	Yes. Supabase (service provider, sync); TikTok (install and sign-up measurement)
Files and docs	Yes. Study text you choose for AI quizzes and summaries (ephemeral); Lecture Files (Premium cloud backup); published Marketplace quizzes	Yes. OpenRouter and Google Gemini (service providers, ephemeral); Supabase (storage)
Photos / images	Ephemeral — schedule import only	Yes — Google Gemini (service provider, ephemeral)
AI chat messages	Ephemeral — Esky AI only	Yes — Groq (service provider, ephemeral)
Calendar events	Optional — only if you turn on Calendar sync (read-only)	No. Stored on your device and in your own Supabase account (service provider) for sync
Google Classroom coursework	Optional — only if you connect your account (device only)	No
Location (precise)	Optional — only if you set up Location Alerts. Saved School/Home coordinates only; live position is processed on-device and not collected by us.	Yes — saved spot coordinates only, to Supabase, for cross-device sync
Device or other IDs	Yes. Advertising ID (ads and TikTok measurement); one-way hashed Android ID (one-time reward abuse prevention)	Yes. Google AdMob (ads, analytics, fraud prevention); TikTok (install measurement). The hashed ID is stored only in Supabase.

Service providers (Supabase, Groq, Gemini, OpenRouter, Resend, Cloudflare) process data on our behalf and are not permitted to use it for their own purposes. Google AdMob and TikTok process advertising and measurement data under their own privacy policies. No data is sold. This declaration is consistent with our Data Safety form in Google Play Console.