Who this is for
This website and the YAS Campus app serve the families, students and staff of YAS Academy (Basra, Iraq). There is no public sign-up; accounts are issued by the school office. YAS Academy is responsible for the data described here.
What we collect
Only what the school actually needs to operate, which is:
- Student enrolment records (name, national ID, grade, photo, parent or guardian names and phone numbers, address)
- Contract and payment records, and reminders of fees due
- Attendance, marks and coursework: homework a student hands in (photos, files and a note) and quiz answers
- Points and badges a teacher gives. The class board shows a student's name and points to their classmates unless it is turned off in the app.
- Chat messages and the photos sent with them, between teachers, parents and students, including class groups
- Staff and payroll records (for employees): pay and payslips, lessons taught, attendance with the check-in and check-out times a staff member records from the phone, leave requests with their reason (including the reason for sick leave), and documents a staff member uploads, such as an ID or residence card
- Gallery posts by teachers or the office, and the pictures and files a teacher adds to a lesson or a quiz
- Sign-in data: the account's email, username or ID number, its password or PIN (stored hashed), and a count of wrong passwords in a row, used to stop sign-in for 2 minutes after 5, and the network address a sign-in comes from, which the sign-in limit holds only in the server's memory, to limit repeated attempts
- The web server's access log: the address that connected, the time and the page requested, for security and troubleshooting
- From the phone app: each device's notification token, whether it is Android or iOS, and the app's language
We do not collect analytics or marketing data, and we do not use any tracking tools.
How we use it
Data is used solely to run the school: enrolling students, tracking payments and reminding families of fees due, recording attendance and marks, setting and marking homework and quizzes, letting teachers, parents and students message each other, paying and managing staff, sending notifications, and keeping accounts secure. It is never sold or shared with a third party for commercial purposes.
Who can see your data
Every account sees only what belongs to it: a parent sees their own children's records, a student sees their own, a teacher sees the classes they teach, and office staff see only what their role permits. A chat message is seen only by the people in that conversation, or by the whole class in a class group. An internal, owner-only activity log records sensitive financial and account actions for auditing.
How long we keep it
School records are kept for as long as a student or staff member is associated with the school, consistent with normal practice for an educational institution. In-app notifications are automatically deleted 60 days after being read. The web server's access log is kept for 14 days and then deleted. The phone app keeps what you have viewed on the phone itself for up to 24 hours, so it still opens without a connection, and clears it when you sign out.
The phone app
The YAS Campus app on Google Play and the App Store is another window onto this same system. It is published in the stores by its developer on behalf of YAS Academy, which remains responsible for the data. It collects nothing about you beyond what is listed above. There are no adverts, no analytics or tracking tools of any kind, and no data is sold to anyone.
The app asks for these permissions, each optional and only when needed:
- Camera and photo library: for any account, only when you choose to take or pick a photo: a homework page to hand in, a photo in a chat, a picture for a school post, a quiz or a lesson, or a document a staff member uploads. Your photo library is read only when you pick a photo yourself.
- Files (no permission needed): when a student hands in homework, a teacher adds a lesson file or a staff member uploads a document, the phone's own file picker opens and the app receives only the file chosen.
- Notifications: to tell you about a new mark, a piece of homework, a message, a fee that is due or a school notice. You can decline and the app still works.
Children's data
Students (children among them) have accounts issued by the school and managed by their parent and the school. Inside the app a student can hand in homework (photos, files and a note), answer quizzes, message their teachers (when a teacher allows it), their classmates and their class group, and choose whether their name shows on the class board. A teacher may share a link to a web page as part of a lesson; it opens outside the app. There are no adverts and no in-app purchases. A parent may ask the school to close their child's account or reset its PIN at any time, and can set the child a new PIN from the app.
Service providers
The system is hosted on a server rented from Hetzner Online GmbH, in its Falkenstein data centre in Germany, and only the school administers what runs on it. For delivering notifications only, the notification text and your device token pass through Expo's push service and then Google (FCM) or Apple (APNs). The text is short, but can include a sender's name, an attendance status, a leave decision or an amount of fees due. These services receive only that text and the token, solely to deliver the notification, under privacy terms that protect them as this policy does. We use no other third party apart from Hetzner, which rents us the server.
Deleting your account
In the YAS Campus app, students go to Me Delete my account and everyone else to More Delete my account; or email admin@yas-campus.com. A request from the app, signed in to the account, is enough on its own; for one by email we confirm your identity first. Requests are normally actioned within 30 days: the sign-in is closed permanently, and the account's email, the photo on the student's or staff member's file, the chat messages it sent with their photos, and its notification tokens are deleted. One-to-one conversations stay for the other person, who sees the account as “Deleted account”. A message someone reported stays hidden, seen only by the school's chat moderators, until the report is closed, and is deleted then. School and financial records the school must keep, including the guardians' phone numbers and address on the enrolment file, remain in the institution's own files. Full detail on the account deletion page.
Data security
Every connection between the app and the server goes over encrypted HTTPS, passwords are stored hashed rather than in plain text, and the sign-in token is kept in the phone's secure storage. After 5 wrong passwords in a row, an account cannot sign in for 2 minutes, and too many failed sign-ins from one place wait up to a minute.
Contact
For any privacy question, or to request access to or deletion of your data, reach us at admin@yas-campus.com. Other ways to reach the school are on the support page.