Privacy Policy

1. What we collect

• Teacher account: an email address and a password. The password is stored only as a salted hash, never in readable form.
• Class data a teacher enters: groups, sessions (date and price), students' names and phone numbers, and the attendance and payment status the teacher records.
• Payment submissions made by a student or parent on a session's public payment page: full name, phone number and an uploaded screenshot of the payment confirmation.
• Meet participant names (extension): while a teacher has Google Meet open, the extension reads the display names listed in Meet's People panel. It does not read participants' email addresses, and it does not record or access audio, video, chat or shared screens.
• Sign-in state: a session cookie in the web app and a sign-in token in the extension.

2. What stays on your device

The extension keeps the teacher's sign-in token and email, and the most recent list of participant names, in the browser's local extension storage. The participant list is not sent anywhere until the teacher presses “Confirm attendance”.

3. What we send to our servers

• When a teacher signs in, the email and password are sent over HTTPS to authenticate.
• When a teacher confirms attendance, only the confirmed matches (a participant's display name and the student it was matched to) are saved to the teacher's account. Participants the teacher marks as “not a student” are not sent.
• Groups and sessions a teacher creates or edits are saved to the same account.

4. How we use it

Only to provide the service: showing teachers their groups and rosters, recording attendance and payments, and operating their accounts. We do not sell personal data, use it for advertising or profiling, use it to assess creditworthiness, or share it for purposes unrelated to the service. The extension contains no analytics or advertising code. Hadart's use of data complies with the Chrome Web Store User Data Policy.

5. Where data is stored

We use Vercel to host the application, a managed PostgreSQL database provider to store account and class data, and Amazon Web Services (S3) to store payment screenshots. Screenshots are accessed only through short-lived signed links, and every request is scoped to the teacher who owns the data, so one teacher cannot see another's. We share data with these providers only as needed to run the service.

6. Retention and deletion

We keep data while a teacher's account is active. Teachers can delete groups, sessions, students and payments inside the app at any time. To have an entire account and its data deleted, or to ask about data held on a student, email husseinsamy.dev@gmail.com and we will delete it on request.

7. Students and minors

Students' details are entered by their teacher, who is responsible for having the right to do so. We do not knowingly collect data directly from children through the extension. The public payment page asks only for a name, a phone number and a payment screenshot.

8. Security

Data is transmitted over HTTPS, passwords are hashed, and access is limited to the owning teacher. No system is perfectly secure, so we cannot guarantee absolute security.

9. Changes to this policy

If our practices change, we will update this page and its effective date.

10. Contact

Questions or requests about your data: husseinsamy.dev@gmail.com