Privacy Policy
1. Overview
SSH Mobile App is the official school-management application of Samar Study Hall (the School). The app is used by school staff, students, and their parents/guardians to access information that the School already holds about its students and employees — fees, attendance, marks, communications, timetable, homework and similar academic and administrative records.
This privacy policy explains what personal information the app handles,
how that information is used, who it is shared with, how long it is kept,
and the choices you have. This policy applies to the SSH Mobile App Android
application (Google Play package com.techvm.sshksp) and
the linked web application served from erp.samarstudyhall.com.
2. About the app
SSH Mobile App is a private, school-internal tool. It is not a public service. Access is limited to people who already have an account created by the School — typically:
- School administrators (the Principal and authorised office staff).
- Teaching and non-teaching employees of the School.
- Currently-enrolled students of the School and their parents/guardians.
You cannot self-register through the app or the website. Accounts are provisioned by the School. If you are reading this policy because the app showed it to you at sign-in, your account was created for you by the School administration.
3. Who controls the data
Data controller (decides what is processed and why)
Samar Study Hall is the data controller. The School decides which information about students and employees is collected, who is given an account, and how long records are kept, in line with its existing admission, employment, and academic record-keeping practices.
Data processor (operates the technical platform)
VM Technologies is the technology provider that builds and operates the SSH Mobile App platform on the School's behalf. VM Technologies only processes data on the School's instructions; it does not use the information for its own purposes, does not sell it, and does not share it with advertisers.
4. What we collect
The app handles the following categories of information:
Provided by the School (not by you)
| Category | Examples |
|---|---|
| Student profile | Full name, admission number, class & section, roll number, house, gender, date of birth, category, religion, contact phone, address, parent/guardian names, occupations and contact numbers, emergency contact, student photograph, and Aadhaar numbers of the student and parents where the School records them. |
| Student health information | Height, weight, blood group and vision readings recorded by the School for the report card and for student care. Visible only to authorised staff, the class teacher, and the student/parent where the School shows it. |
| Employee profile | Full name, designation, role, employee phone, email, address, date of birth, joining date, emergency contact, employee photograph, and any link to the employee's own children studying at the School. |
| Fee records | Fee head, due dates, fines, discounts, payments collected, transport fees, payment mode, payer notes. |
| UPI payment submissions | When you pay school fees via UPI, the app records: the amount you requested to pay, the screenshot of the UPI confirmation you uploaded, and the transaction remark (formatted as <class>-<first name>-<admission number>, capped at 50 characters). The remark also appears in the school's bank statement so the accountant can reconcile your payment to your child's account. We do not store your UPI PIN, bank account number, or card details — those never leave your UPI app. |
| Academic records | Attendance, exam marks (with statuses Normal/Absent/Medical Leave/Withheld where applicable), letter grades resolved from the school's configured grade scheme, term-end co-scholastic grades (Discipline, Music, Physical Education and similar non-academic subjects), homework, notes, timetable, leave requests, transfer certificates. |
| Campus and front-desk records | Student gate passes (who collected the student, their relationship, ID proof type and time) and staff out-passes (reason, approval, time out and back). |
| Teacher remarks | Free-text remarks recorded by teachers against a student's performance: per-subject remarks (e.g. “needs more reading practice”), per-exam class-teacher remarks (e.g. “missed half the paper due to illness”), and term-end holistic class-teacher remarks meant for the report card. Remarks are only visible to a student/parent in the portal after the relevant exam or term has been published by the school administration. |
| Audit information | An automatic record of changes made in the system: which account made the change, what the record held before and after, the time, the IP address and the device or browser used. Used for internal accountability. Passwords and other secrets are masked in this record. |
Collected from you when you use the app
| Category | Examples |
|---|---|
| Account & sign-in | Username (typically your registered mobile number or admission number) and password. A password you choose yourself is stored as a one-way salted hash, so nobody can read it. The first password issued to you by the School is also kept in encrypted form so that authorised office staff can give it to you again; it is erased as soon as you change your password. |
| Messages and attachments | Messages you send to staff or students through the in-app Communicate feature, and any files (PDF, image, document) you choose to attach. |
| Photographs and documents | Any photograph or document you upload — for example, when an administrator adds a student photo, or a teacher submits a task deliverable. |
| Device and notification information | Firebase Cloud Messaging (FCM) device token (required to send push notifications), device model, operating system version, app version, an app install identifier, and the date you last opened the app. If you turn on notifications in a web browser, the browser name and device type are recorded instead. The School uses this to send notifications and to see who has the app active. We do not collect your contacts, calendar, location, IMEI, advertising identifier, or browsing history. |
| Operational logs | HTTP error logs (route, status, error message) captured to diagnose technical issues. These are kept for a short period and are not used for advertising or analytics. |
What the app does NOT collect. No location data, no contacts, no calendar entries, no SMS/call logs, no microphone recordings for advertising or analytics, no advertising ID, no browsing history outside the app, no biometrics. We do not use third-party analytics, advertising, or attribution SDKs.
5. How we use it
- To let you sign in and identify you as a staff member, student, or guardian.
- To show fee receipts, dues, attendance, homework, exam results, and timetable that belong to you (or to your child, if you are a guardian).
- To deliver messages and tasks within the School community.
- To send push notifications when something happens that concerns you — for example, a new fee receipt, an attendance mark, a homework assignment, a message, or an exam result becoming available.
- To accept UPI payment screenshots you upload from the parent portal so the school can verify and approve the corresponding fee receipt.
- To produce school documents such as fee receipts, bills, report cards, tabulation sheets, gate passes, and transfer certificates.
- To let authorised staff call a parent or emergency contact from the student profile. The call is made by your phone's own dialler; the app does not record calls or store call history.
- To keep an internal audit trail of staff actions for accountability.
- To debug technical errors and keep the platform reliable and secure.
We do not use your information for advertising, profiling for marketing, or any purpose unrelated to running the School's day-to-day operations.
6. App permissions explained
The Android app requests the following device permissions when needed:
| Permission | Why the app uses it |
|---|---|
| Internet & network state | To connect to the School's secure server to read and update records. |
| Notifications (Android 13+) | To deliver push notifications for fees, attendance, messages, homework, tasks, and exam-result publication. You can turn this off any time from the device's app settings. |
| Camera | Only when you choose to capture a photograph — for example, a staff member taking a student's profile photo or attaching a picture to a message. Optional. |
| Photo picker | The app uses the system photo picker, so it only ever receives the photo you pick and cannot browse your gallery. Optional. |
| Files / documents | Only when you choose a document (PDF, DOC, XLSX, etc.) to attach to a message, task, or fee record. Optional. |
| Saving files | To save receipts, report cards, Excel files and other documents you download to your phone's Downloads or Pictures folder. Older Android versions (7 to 9) ask for storage permission for this. Optional. |
| Phone dialler | Tapping a call button opens your phone's dialler with the number filled in. No call permission is requested. |
| Vibration | For brief haptic feedback when you tap a button. No external use. |
The app does not request access to your contacts, calendar, microphone for audio recording, precise location, body sensors, or call logs.
8. Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| Google Firebase Cloud Messaging (FCM) | Deliver push notifications to your Android device. | FCM device token, notification title, short body, deep-link target inside the app. |
| Google Play Services (on Android) | Receive FCM messages on the device. | As required by the platform; no profile or message content sent to Google by us beyond the notification itself. |
| Web browser push services (Google, Apple, Mozilla or Microsoft) | Deliver notifications if you turn them on in a web browser or an iPhone home-screen app. | Browser push token, notification title, short body, link target. |
| Hosting and backup providers | Run the server and hold encrypted off-site backups. | The server holds the School's records under access control; off-site backups are encrypted. |
We do not use third-party advertising networks, analytics (Google Analytics, Firebase Analytics, Crashlytics, Mixpanel, etc.), attribution, social-login, or any other third-party tracker, and the app does not send crash or usage data to any third party.
9. Data security
- All traffic between the app and the server is encrypted using HTTPS (TLS).
- Passwords you choose are stored as one-way salted hashes; the platform cannot recover them. A password issued by the School is held encrypted until you change it.
- Sensitive form fields and uploaded files are protected by per-account access controls; you only see what your role and permissions allow.
- Each school's data is stored in a logically separate database (per-tenant isolation), so one school cannot access another school's records.
- Changes to records are captured automatically in an internal audit log with the account, the before and after values, the time, the IP address and the device. Secrets are masked.
- Backups are taken on a regular schedule, encrypted, and kept on the server and with an off-site provider for a limited time.
- You stay signed in for up to 15 days after you last used the app. A password reset by the School, or the School disabling your account, ends existing sign-ins.
No system is perfectly secure. If we become aware of a breach that affects your information, we will notify the School promptly so the School can inform affected users and the relevant authorities as required by law.
10. Data retention
- Active students and employees: Records are kept for as long as you are enrolled or employed at the School.
- Past students and employees: Once a student leaves or an employee separates, their academic and accounting records are retained for the period required by the School's record-keeping policy and by Indian education/accounting regulations (typically several years, for the purpose of issuing transfer certificates, verifying past attendance/marks, and meeting audit obligations).
- Operational logs and backups: Logs are kept for diagnostic purposes and then rotated out. Encrypted backups are rotated too; the oldest is kept for about one year.
- Audit records: Kept as part of the School's records until the School deletes them.
- Push notification tokens and device details: Removed when you sign out, and automatically if the app has not been opened for 30 days or Firebase reports the token as no longer registered.
11. Children and minors
The SSH Mobile App is intended for use within an educational setting and will, by its nature, hold information about children (school students). Personal information about students is provided to the platform by the School in the course of its lawful educational activities, with the consent of the parents/guardians that the School obtains at the time of admission.
Student accounts are created and managed by the School. Where a student is a minor, the student's parent/guardian is treated as the responsible adult for the purposes of this policy. Parents/guardians who do not want their child's information in the app should contact the School directly to discuss alternatives.
The app is not designed for, marketed to, or intended for use by children outside the School's enrolment.
12. Your rights
Subject to applicable law, you may have the following rights with respect to your personal information:
- Access — ask what information is held about you.
- Correction — ask for inaccurate information to be corrected.
- Erasure — ask for your information to be deleted, subject to lawful retention requirements.
- Grievance — raise concerns about how your information is being handled.
- Withdraw push notifications — turn off notifications any time from the device settings.
Because the School is the data controller, requests of this kind should be addressed to the School (see Contact us). Requests will be answered within a reasonable time, normally within 30 days.
13. How to request account / data deletion
To request deletion of your account or the personal information held about you, send a written request to the School at the contact details below, with:
- Your full name and your role at the School (student/parent/employee).
- Your admission number (for students) or employee ID (for staff).
- Your registered mobile number.
- A short description of the data you want deleted.
The School will verify your identity, action the request, and confirm back. Some information may be retained for legitimate accounting, regulatory, or transfer-certificate purposes even after the rest is deleted — the School will tell you exactly what is being retained and why.
If you simply want to stop using the app, you can uninstall it from your device at any time. Uninstalling does not delete the records the School holds about you on the server.
14. Changes to this policy
We may update this privacy policy from time to time — for example, when we add new features or when a relevant law changes. The "Last updated" date at the top of this page shows when the most recent change was made. For material changes, the School will notify users in-app or by direct message. Continued use of the app after a change means you accept the updated policy.
15. Contact us
The School is the data controller for purposes of this policy. To exercise any of the rights described above, or to ask anything about how your information is handled, please contact:
Samar Study Hall
Kundeshwari, Kashipur,
Distt. Udham Singh Nagar, Uttarakhand, India
Phone: +91 63964 48375
Email: samarstudyhall@hotmail.com
For technical questions relating to the platform (VM Technologies is the data processor), the School can forward your enquiry on your behalf, or you may contact the developer directly:
VM Technologies (developer & maintainer)
Website: www.techvm.in
Email: support@techvm.in