Privacy Policy

1. Introduction & Scope

This Privacy Policy governs the collection, processing, and protection of information across the BCAway mobile applications (iOS and Android distributed via Apple App Store, Google Play, and Expo), the web application (app.bcaway.app), the informational landing site (bcaway.app / www.bcaway.app), and associated backend services, serverless edge workers, and notification dispatch pipelines (collectively, the "Service").

The Service is published by Savera Continental LTD. and developed and maintained by Kabir Sekhon (collectively referred to as "we", "us", or "our"). BCAway is an independent student utility designed to provide real-time teacher absence viewing, daily bell schedule integration, and customizable notifications for students attending Bergen County Academies ("BCA").

By downloading, installing, accessing, or using BCAway, you expressly acknowledge that you have read, understood, and agree to the data collection, processing, and retention practices described in this Privacy Policy. If you do not agree with this policy, you must discontinue use of the Service immediately.

2. Information We Collect and Technical Data Flows

We adhere strictly to the principle of data minimization. We only collect and process the absolute minimum data required to verify school enrollment, secure faculty attendance information, manage push notifications, and deliver core utility features:

A. School Email & Passwordless Authentication

Faculty absence data is sensitive internal school information. To safeguard faculty records against unauthorized public or web crawler access, students must verify active student status using an authorized school district email address:

• Mandatory Domain Verification: Registration and sign-in are strictly restricted to email addresses ending in @bergen.org. Backend database constraints and Row-Level Security (RLS) policies automatically reject non-school domains.
• Passwordless Verification: We do not collect, store, or handle user passwords. Sign-in is handled through secure, single-use, cryptographically verified email confirmation links (magic links) or one-time codes delivered directly to your school email address.
• Authentication Records: Our Supabase authentication database stores your verified email address, internal user identifier (UUID), account creation timestamp, and last sign-in timestamp.

B. Starred Teachers & Personalized Notification Subscriptions

BCAway allows you to star or favorite specific faculty members to receive personalized push notifications when those teachers are absent, have modified period coverage, or return to school:

• Database Storage: When you star a teacher, the association between your account UUID and the selected teacher identifier (user_starred_teachers) is stored in our secure PostgreSQL database managed via Supabase.
• Strict Row-Level Isolation: Starred teacher records are protected by database Row-Level Security (RLS) policies. Only you can read or modify your starred teacher list; other students, faculty, or unauthorized parties cannot view or query which teachers you follow.
• Notification Matching: When daily absence records are synced from school notices, our backend notification worker (Cloudflare Worker) queries starred teacher mappings to dispatch targeted push alerts solely to students subscribed to those specific teachers.

C. Push Notification Tokens & Delivery Metadata

If you grant notification permissions, your device generates an anonymous push notification token via Expo Push Notification service (routed through Apple Push Notification service [APNs] on iOS and Google Firebase Cloud Messaging [FCM] on Android):

• Token Storage: Push notification tokens are stored in our secure database linked to your account UUID solely to deliver scheduled morning absence digests and real-time alerts for your starred teachers.
• Cooldown & Deduplication Records: To prevent notification spam and protect students from duplicate alerts when school notice boards undergo minor edits, our Cloudflare edge infrastructure stores temporary delivery timestamps (last_notified_at) and cryptographic message hashes. These records are used strictly for rate-limiting, deduplication, and multi-teacher batching.
• Device Privacy: Push tokens are randomized, revocable alphanumeric strings. They are never linked to your personal telephone number, hardware IMEI, MAC address, or physical location.
• Revocation: You can revoke notification permissions at any time through the app settings or via your device's system settings (Settings → Notifications → BCAway).

D. Teacher Addition Requests (/requestteacher)

If a faculty member is missing from the directory, you may submit a request through our designated request form (bcaway.app/requestteacher), which redirects to a secure Google Form:

• Data Handled: Any teacher names, departments, or notes you provide in the request form are transmitted directly to Google Forms infrastructure and processed in accordance with Google's Privacy Policy.
• Purpose: Information submitted via this form is used exclusively by app maintainers to verify faculty rosters against public school listings and update the faculty directory. We do not sell or share request submissions with third parties.

E. Local On-Device Sandbox Data

Personalized schedule details and offline data remain entirely on your physical device and are never uploaded to our servers:

• Local Schedule Customization: Custom period labels, personal course names, free-period markers, and schedule notes are saved exclusively in your device's local sandboxed storage (AsyncStorage on mobile, localStorage on web) and never transmit across our network.
• Offline Cache: Master bell schedules, period timings, and daily absence snapshots are cached locally on your device to enable instant offline viewing and reduce network overhead.
• Authentication Sessions: Encrypted JWT access and refresh tokens are stored locally on your device to maintain your session between launches without requiring re-authentication.

F. Technical Logs & Network Security

Standard non-identifying technical request metadata (such as IP address, HTTP request headers, user-agent string, operating system version, and app build version) is processed transiently by our edge infrastructure (Cloudflare and Supabase) solely for DDoS mitigation, rate-limiting, automated bot filtering, and firewall protection. These operational logs are retained temporarily for security auditing and are never used for behavioral advertising or student tracking.

3. Information We Explicitly Do NOT Collect

We are dedicated to safeguarding the privacy and security of high school students. BCAway does NOT collect, request, access, or store:

• No Passwords: We do not collect or store account passwords. Authentication is exclusively passwordless.
• No Student Identifiers: We do not collect student ID numbers, state student identification numbers (NJ SMART), or lunch account codes.
• No Personal Contact Details: We do not collect student home addresses, personal telephone numbers, or guardian contact information.
• No School Information System Credentials: We do not integrate with, collect credentials for, or access school management or gradebook platforms, including Genesis, PowerSchool, Google Classroom, Naviance, Canvas, or Blackboard.
• No Academic Records: We do not collect or view grades, GPA, transcripts, test scores, attendance histories, or disciplinary records.
• No Location Tracking: We do not access GPS hardware, cell-tower triangulation, Wi-Fi location services, or Bluetooth beacon tracking.
• No Sensor or Media Access: We do not request or access your device's camera, microphone, photo library, or contacts.
• No Advertising Identifiers: We do not collect Apple IDFA (Identifier for Advertisers), Google Advertising ID (GAID), or cross-app tracking beacons.
• No Data Monetization: We do not sell, rent, lease, trade, or monetize student data under any circumstances.

4. Legal Bases & Purpose of Processing

We process collected information strictly for legitimate, non-commercial educational utility purposes:

• Authentication & Verification: To verify that users querying faculty absence information are active students within the Bergen County Academies community.
• Service Delivery: To operate, maintain, and display accurate bell schedules, period timings, and daily teacher absences.
• Personalized Alerts: To route notifications to your device when teachers you have voluntarily starred are reported absent, modified, or returned.
• System Integrity: To prevent brute-force attacks, DDoS attempts, unauthorized automated scraping, and API abuse.

5. Third-Party Service Providers & Subprocessors

We utilize carefully selected, industry-leading infrastructure providers to host our databases, route network traffic, and deliver notifications. These service providers process data strictly on our behalf under confidentiality and data protection obligations:

• Supabase Inc.: Provides hosted PostgreSQL database infrastructure, Row-Level Security (RLS) enforcement, user authentication, and serverless Edge Functions.
• Cloudflare Inc.: Provides global edge worker compute, D1 database storage for push notification dispatch, CDN caching, SSL/TLS termination, and DDoS mitigation.
• Expo (650 Industries Inc.): Routes push notifications to platform-specific mobile notification gateways.
• Apple Inc. (APNs): Delivers encrypted push notifications to iOS devices.
• Google LLC: Delivers push notifications to Android devices via Firebase Cloud Messaging (FCM) and hosts the optional teacher request form via Google Forms.

We do not share student information with any third-party marketing networks, commercial analytics brokers, or behavioral advertising platforms.

6. Children's Privacy (COPPA & FERPA Compliance)

BCAway is designed specifically for high school students attending Bergen County Academies (typically ages 14 through 18) and operates in strict accordance with federal student privacy standards:

• Children's Online Privacy Protection Act (COPPA): The Service is not directed to children under the age of 13. We do not knowingly solicit or collect personal information from individuals under 13. If we become aware that personal data from a child under 13 has been inadvertently collected, we will take immediate steps to permanently delete that information.
• Family Educational Rights and Privacy Act (FERPA): BCAway is an independent utility and is not an educational agency or institution subject to FERPA. BCAway does not maintain official school "education records" as defined under 34 CFR Part 99. Teacher absence information displayed in the app is derived from notices made available to the school community and does not contain confidential student educational records.

7. Data Security & Storage Safeguards

We implement comprehensive technical, administrative, and physical security measures to safeguard student information against unauthorized access, loss, alteration, or disclosure:

• Encryption in Transit: All data transmitted between your device, Cloudflare edge servers, and our Supabase backend is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
• Row-Level Security (RLS): Our database employs granular PostgreSQL Row-Level Security policies ensuring that authenticated users can only view and mutate their own account mappings.
• Zero Password Architecture: By using passwordless authentication, the risk of credential stuffing, password leaks, or unauthorized account takeovers is eliminated.
• Edge Rate-Limiting: Automated rate-limiting algorithms protect against brute-force enumeration and abusive traffic patterns.

8. Data Retention, Sign-Out, and Permanent Account Deletion

You retain complete control over your account and data:

• Signing Out: You can sign out at any time within the app (Settings → Account → Sign Out). Signing out immediately purges local authentication tokens, user preferences, and cached absence data from your device.
• Right to Deletion: You have the absolute right to permanently delete your account and associated data. To request permanent account deletion, send an email to support@bcaway.app from your registered @bergen.org address with the subject line "Account Deletion Request".
• Purge Scope: Upon processing your deletion request, your Supabase Auth record, all starred teacher mappings (user_starred_teachers), and all associated push notification tokens will be permanently erased from our databases.

9. Non-Affiliation Declaration

BCAway is an independent student utility developed by Kabir Sekhon and published by Savera Continental LTD. It is NOT affiliated with, authorized by, endorsed by, sponsored by, or in any way officially connected to Bergen County Academies (BCA), the Bergen County Technical School District (BCTS), the Bergen County Board of Education, or any of their administrative offices or trustees.

Bergen County Academies and the Bergen County Technical School District assume no legal responsibility or liability whatsoever for the operation, data handling, accuracy, or privacy practices of BCAway. For complete terms governing the use of this service, please consult our Terms of Service & Legal Disclaimers.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect new features, security enhancements, infrastructure updates, or legal compliance requirements. When changes are made, the "Last Updated" date at the top of this policy will be revised. Significant changes will be announced through the application interface. Continued use of BCAway following the posting of an updated Privacy Policy constitutes your express acceptance of the revised terms.

11. Contact & Legal Publisher Information

If you have questions, comments, data protection inquiries, or deletion requests regarding this Privacy Policy, please contact: