Skoul Privacy Policy

Last Updated: October 4, 2026

Introduction

Welcome to Skoul, an educational app for children aged 6 to 12, on iPhone, iPad and Android. This privacy policy explains what information Skoul uses, where it goes, how long it is kept, and how you can control it.

Your child's privacy and safety are our top priorities. Skoul is designed to comply with:

• Children's Online Privacy Protection Act (COPPA) in the United States
• General Data Protection Regulation (GDPR) in France and the European Union
• Best practices for children's privacy and data protection

This policy explains:

• What information we use and why
• What stays on the phone and what leaves it
• How long anything is kept
• Your rights and how to exercise them

By using Skoul, you agree to the practices described in this privacy policy.

What stays on this phone, and what leaves it

Stays on this phone

Your child's answers, mistakes and progress; first name, age, country, class and notebook cover (never sent, except age and country as described below); voice and drawings for read-aloud and tracing (recognised on the phone; nothing is recorded or sent); your parent PIN (stored hashed on the phone). No account, no password.

Leaves this phone

• Homework photos: sent over an encrypted connection to Skoul's server (Cloudflare), which asks OpenAI to read the exercise, with Google Gemini as backup. Sent with age, language and country, never your child's name. Skoul does not keep the photo. A parent can turn this off.
• New AI practice: subject, age, language and country go to Skoul's server, which uses OpenAI, with Google Gemini as backup. On Android, if Skoul's server cannot be reached, the app may ask Google Gemini directly (Firebase AI Logic) for maths word problems and word lists. No name.
• Server logs: IP address, an app install identifier, app version, age, country and language, kept up to 30 days to stop abuse and fix errors.
• Crash reports: technical crash details to Firebase Crashlytics (Google), only if you turn them on.
• Usage statistics: anonymous daily counts sent to Skoul's own server, only if you turn them on.
• Your email, if you give it: for the Sunday report (Skoul+), stored by Skoul and sent with Resend.
• Payments: handled by Apple or Google. Skoul never sees your card.

Data Controller

The data controller responsible for your personal information is:

HIGHTHEM
SIREN: 848274338
France

For all privacy-related inquiries, please contact us at:
privacy@skoul.fr

Information We Collect

Skoul uses as little information as possible. Most of it never leaves the phone.

Profile Information (stored on the phone)

• First name: used to greet your child. Never sent.
• Age (6 to 12): used to choose age-appropriate exercises. Sent with AI requests and homework photos.
• Country: used for the language and examples of exercises (money, measurements). Sent with AI requests and homework photos.
• Class (optional) and notebook cover: shown on the notebook. Never sent.
• Avatar photo (optional): stored on the phone only. Never sent.

Age is the only thing used to adapt the difficulty of exercises; the class is only a label.

Homework photos (Skoul+ homework help)

When your child uses homework help, the photo of the exercise is sent over an encrypted (TLS) connection to our API on Cloudflare, which asks OpenAI to read the exercise, with Google Gemini as backup. Skoul does not keep the photo. The photo is used only for the explain, check, lesson and quiz modes.

• A copy of the photo and the result stays on your device in your child's homework history
• The homework history is erased with Delete everything in the Parents area, or when the app is uninstalled
• A parent can stop photos from leaving the phone in the Parents area (privacy settings); homework help is then unavailable
• Please make sure the photo shows only the school exercise: no names, faces or other personal details
• Our instructions to the AI explicitly forbid transcribing any personal data that might appear on the page

Your email (optional)

• Sunday report (Skoul+): if you ask for the weekly report, we store your email address, the app's install identifier and the report language, and email you a 6-digit code to confirm the address. Each Sunday the app sends that week's totals (sessions, minutes, accuracy, reading speed trend and up to three skills worth a look, never your child's name); we email them and keep only the date of the last report.
• PIN recovery (Android): if you forget the parent PIN on Android, a code is sent to that same verified email.
• News from Skoul: if you sign up on skoul.fr, we store your email and language to send you our news.
• Contacting us: if you write to us from the app, we receive your name, email, subject and message, and forward them to our team's internal messaging (Slack) so we can answer.
• Emails are sent with Resend. Every report and newsletter has a one-click unsubscribe link; "Delete everything" in the app also deletes the report subscription.

Skoul+ Subscription

• Your Skoul+ subscription status (active, in trial, expired) is stored on your device
• Billing is handled entirely by Apple (App Store) or Google (Google Play); we receive only the subscription status
• No payment details (card number, billing address, Apple ID or Google account) ever reach us

Practice Data (Stored Locally Only)

• Exercise results and the mistake box
• Accuracy, time spent and difficulty progression
• Session history and the reading speed trend

Technical Information

• An app install identifier (Apple's identifier for vendor on iOS, the Android ID on Android), the app version and your IP address, sent with requests to Skoul's server (see Server Logs)
• Anonymous daily usage counts, only if you turn them on (see Anonymous Usage Statistics)
• Crash reports, only if you turn them on (see Crash Diagnostics)

Information We Do NOT Collect

• Your child's email address or phone number
• Precise location data
• Payment information (purchases are processed by Apple or Google; we never see them)
• Social media profiles
• Voice recordings or biometric data (Face ID, Touch ID and fingerprints stay with the phone's system)
• Contacts or your photo library (except the avatar and the homework photos you choose, with your permission)
• Advertising identifiers or browsing history outside the app

How We Use Your Information

We use information solely to provide and improve Skoul:

Personalization (LOCAL ONLY)

• Display the child's name, class and avatar in the app
• Choose exercises for the child's age
• All personalization data stored locally on device

Educational Content Generation

• ON-DEVICE: Maths drills (numbers, operations, times tables, fractions, measures), the mistake box, tracing, read-aloud and most reading and writing drills are generated on your device. Nothing is sent and no network is needed.
• SERVER DRILLS: Some drills are downloaded from Skoul's server. The request carries only the drill, the age and the language (plus the details in Server Logs); the server uses no AI and keeps nothing else.
• AI PRACTICE: For AI reading texts, AI word lists and maths word problems, the subject, age, country, language and difficulty are sent to Skoul's server, which asks OpenAI, with Google Gemini as backup. On Android only, if Skoul's server cannot be reached, the app may ask Google Gemini directly through Firebase AI Logic for maths word problems and word lists, with the same information. No name, no class, no avatar and no practice history are sent.
• The free version includes 7 AI practices in total; Skoul+ removes the limit.

Homework Help (Skoul+)

• The photo of the exercise is sent to the Skoul API (Cloudflare) and to our AI provider (OpenAI, with Google Gemini as backup) solely to produce the explanation, the check, the lesson or the quiz
• The photo is discarded by us as soon as the response is returned; only the local copy on your device remains
• Wrong answers can be added to the mistake box on your device so your child can practise them again
• The free version includes 5 homework exercises in total; Skoul+ removes the limit

Progress Tracking (LOCAL ONLY)

• Record session results, scores and time spent
• Calculate accuracy and progress
• Adapt difficulty and the mistake box schedule
• All progress data stored locally on device

Anonymous Usage Statistics (off unless a parent turns them on)

To understand which features are used and to find problems, the app can send our own server (the Skoul API, hosted by Cloudflare) anonymous daily counts, for example "exercise completed – addition: 3".

• What is sent: the name of an action from a fixed list (app opened, screen shown, exercise started or completed with its subject and type, word list created with its method, homework help used with its mode, Skoul+ screen shown, type of error), how many times it happened, the platform (iOS or Android), the app version and the app language (English, French, Spanish or German).
• What is NOT sent: no name, age, country, avatar, answers, scores, durations, photos, device identifier, advertising identifier or account. No time of day: only the day is recorded, by our server.
• How it is kept: only as daily totals added to everyone else's (for example "12 March: 240 addition exercises completed on iOS 2.0.0 in French"). No log of individual events is kept, and the totals cannot be linked to a child, a device or a family. They are kept for up to 25 months.
• Your IP address is seen by our hosting provider when the app connects, as with any internet connection, and is used for a few minutes to limit abuse. It is not stored with the statistics.
• Not shared: these statistics are never sold or shared, and never used for advertising or profiling.
• Off by default; a parent can turn them on or off at any time in the Parents area (privacy settings).
• Legal basis (GDPR): your consent, which you can withdraw at any time.

Purposes We Do NOT Use Data For

• Selling or sharing with third parties for marketing
• Creating user profiles for advertising
• Tracking across other apps or websites
• Social media integration
• Advertising of any kind. Skoul contains no advertising, no advertising SDK and no third-party analytics SDK. We never will.

Data Storage

Skoul stores your child's information on your device:

Local Storage

• All profile information and progress is stored only on your device (SwiftData on iPhone and iPad, an app database on Android)
• Avatar photos and homework photos are stored on the device only
• No cloud synchronization, no user accounts and no login
• On Android, Skoul's data is excluded from device backups

What Is Kept on Our Servers

• Server logs (IP address, install identifier, app version, age, country, language, endpoint and result): up to 30 days
• AI usage records (provider, model, size of the request and response, cost; no content): up to 30 days
• Daily totals without any identifier (usage statistics if turned on, request and AI counts): up to 25 months
• Your email for the Sunday report: until you unsubscribe or delete it from the app
• Your email for news from Skoul: until you unsubscribe
• Messages you send us: as long as needed to answer, then deleted on request
• Homework photos and AI prompts: never stored

Data Encryption

• Data stored on the device is protected by the operating system's encryption
• If you have a device passcode or biometric lock, your data is further protected
• All connections to our server and to our providers use HTTPS (TLS)

What This Means

• Your child's information stays on your device
• Uninstalling the app permanently removes everything stored on the device
• We cannot recover data if you delete the app or lose your device
• Each device is independent; data does not sync across devices

Third-Party Services

Skoul uses a small number of service providers. None of them receives your child's name.

Skoul API (Cloudflare)

• Purpose: AI practice, homework help, server drills, the Sunday report, the newsletter, contact messages and, if turned on, anonymous usage statistics
• Data Shared: as described in this policy for each feature
• Privacy: HTTPS (TLS) and an app key on every request
• Location: Cloudflare's network processes each request in a data centre near you; Cloudflare acts as our processor under its Data Processing Addendum, including the EU Standard Contractual Clauses
• Retention: see What Is Kept on Our Servers

AI Providers (OpenAI and Google Gemini)

• Purpose: read homework photos and write AI practice. Skoul's server asks OpenAI first and Google Gemini if OpenAI is unavailable. On Android, the app may also ask Google Gemini directly (Firebase AI Logic) for maths word problems and word lists when Skoul's server cannot be reached.
• Data Shared: the homework photo or the practice request, with age, country, language and difficulty
• Data NOT Shared: your child's name, class, avatar or practice history
• Location: United States (both providers), under their data processing terms and the EU Standard Contractual Clauses
• Privacy Policies: OpenAI - https://openai.com/policies/privacy-policy; Google - https://firebase.google.com/support/privacy

Resend (Emails)

• Purpose: send the Sunday report, confirmation and PIN recovery codes, and our news
• Data Shared: your email address and the content of the email
• Privacy Policy: https://resend.com/legal/privacy-policy

Apple App Store and Google Play

• Purpose: process Skoul+ subscriptions, the free trial, renewals and refunds
• Data We Receive: only the subscription status (active, in trial, expired)
• Data We NEVER Receive: payment details, billing address, Apple ID, Google account or any identity information
• Privacy Policies: https://www.apple.com/legal/privacy/; https://policies.google.com/privacy

Crash Diagnostics (Google Firebase Crashlytics)

• Purpose: when the app closes unexpectedly, a diagnostic report helps us find and fix the problem
• Data Shared: device model, operating system and app version, the technical stack trace, and a Firebase installation identifier
• Data NOT Shared: name, age, answers, photos or homework content
• Default: off; a parent can turn it on or off in the Parents area (privacy settings)
• Privacy Policy: https://firebase.google.com/support/privacy

Server Logs

• Each call to the Skoul API is recorded with the endpoint, the result, how long it took, the IP address, the install identifier, the app version, and the child's age, country and language. Never the content of the request.
• Purpose: security, abuse prevention and troubleshooting
• Retention: 30 days, then deleted automatically
• Anonymous usage statistics are excluded from this logging entirely
• To request deletion of these records, contact privacy@skoul.fr

No Other Third Parties

• No advertising networks or advertising SDKs (Skoul contains no ads and never will)
• No third-party analytics services (Firebase Analytics is not included in the app)
• No social media integrations
• We do not sell or share data with data brokers

International Data Transfers

All profile information and practice data stay on your device. Data leaves the device only as described in this policy:

• Skoul API (Cloudflare): requests are processed in Cloudflare's network, including outside the EU, under Cloudflare's Data Processing Addendum and the EU Standard Contractual Clauses
• OpenAI and Google Gemini (United States): homework photos and AI practice requests may be processed in the United States under their data processing terms and the EU Standard Contractual Clauses
• Resend: emails may be processed in the United States under its data processing terms and the EU Standard Contractual Clauses
• Apple and Google: subscriptions are processed under their own terms

Legal Basis

• Providing the service you asked for (homework help, AI practice, the Sunday report)
• Consent for optional processing (crash reports, usage statistics, the newsletter), which you can withdraw at any time
• Legitimate interest for security logs kept 30 days

Your Rights

For EU/French residents, you have the right to object to international transfers. This may limit some features. Contact us at privacy@skoul.fr for more information.

Children's Privacy (COPPA Compliance)

Skoul is designed for children aged 6 to 12 and is built to comply with the Children's Online Privacy Protection Act (COPPA) in the United States and the General Data Protection Regulation (GDPR) in France and the European Union.

A parent sets up the app and gives consent during onboarding. Sensitive actions (settings, purchases, deleting data, privacy choices) require a grown-up: Face ID, Touch ID, fingerprint or the device passcode, or a Skoul parent PIN.

What the app uses about your child

• First name, class and avatar (stored on the phone only)
• Age and country (stored on the phone; sent with AI requests and homework photos)
• Answers and progress (stored on the phone only)
• Homework photos (sent for analysis, not kept by us)

We DO NOT:

• Collect a child's email address, phone number or precise location
• Share children's personal information with third parties for marketing purposes
• Show advertising of any kind or use children's information for advertising
• Allow children to publicly share personal information

Parents have the right to:

• Review the information we hold
• Request deletion of their child's information
• Refuse further collection of information

For privacy-related questions or to exercise these rights, contact us at privacy@skoul.fr.

Your Rights (GDPR Compliance)

Under the General Data Protection Regulation (GDPR) and applicable privacy laws, you have the following rights:

Right of Access

• Everything about your child is on your device, where you can see it
• For what we hold on our servers (server logs, your email), contact us at privacy@skoul.fr

Right to Rectification

• Edit the profile directly in the app
• Contact us to correct your email address

Right to Erasure ("Right to be Forgotten")

• "Delete everything" in the Parents area removes all data on the device and your Sunday report subscription
• Uninstalling the app removes everything stored on the device
• To delete server logs or other records sooner than their automatic deletion, contact privacy@skoul.fr

Right to Data Portability

• The Parents area can export your child's progress
• Contact us for a copy of what we hold on our servers

Right to Object and to Withdraw Consent

• Turn off crash reports and usage statistics at any time in the Parents area (privacy settings)
• Stop homework photos from leaving the phone in the Parents area
• Unsubscribe from emails with the link in every email
• Note: some choices make features unavailable (for example homework help)

Right to Restrict Processing

• Contact us at privacy@skoul.fr to discuss specific restrictions

Right to Lodge a Complaint

• French residents: Commission Nationale de l'Informatique et des Libertés (CNIL) - https://www.cnil.fr
• EU residents: Your national data protection authority
• US residents: Federal Trade Commission - https://www.ftc.gov

Exercising Your Rights

To exercise any of these rights, contact us at privacy@skoul.fr. We will respond within 30 days. Most rights can be exercised directly in the app.

Data Deletion

You have complete control over your child's data and can delete it at any time:

Delete Everything

In the Parents area, Delete everything removes the profile, progress, homework history and settings from the device, and deletes your Sunday report subscription from our server. It requires a grown-up check and cannot be undone.

Uninstall

• Uninstalling the app removes everything stored on the device
• Reinstalling the app starts afresh with no previous data

On Our Servers

• Server logs and AI usage records are deleted automatically after 30 days
• Homework photos are not retained by us or kept for our use by our AI providers after the response; there is nothing to delete on our side
• Email subscriptions end when you unsubscribe or delete them from the app
• Your Skoul+ purchase history is held by Apple or Google under their privacy policies

For assistance, contact us at privacy@skoul.fr.

Security Measures

We implement appropriate technical and organizational measures to protect your child's information:

Technical Security Measures

• Data on the device is protected by the operating system's encryption and app sandbox
• All network traffic uses HTTPS (TLS)
• Every request to our server carries an app key; requests are rate-limited
• The parent PIN is never stored in clear; the Parents area requires a grown-up check
• No HIGHTHEM employee can access data stored on your device

Data Minimization

• We collect only what each feature needs
• Practice data stays on the device
• No user accounts, so no passwords to leak
• Homework photos and AI prompts are never written to our storage

Organizational Measures

• Privacy-by-design approach in all development
• Regular security reviews of code and infrastructure
• Prompt security updates through the App Store and Google Play
• Incident response procedures for any security concerns

Limitations

No system is 100% secure. You can enhance security by:

• Using a device passcode or biometric lock
• Keeping your device updated
• Only downloading Skoul from the App Store or Google Play
• Supervising your child's device usage

Reporting Security Issues

If you discover a security vulnerability, please report it to privacy@skoul.fr. We take all security reports seriously and will respond promptly.

Policy Updates

We may update this privacy policy to reflect changes in our practices, technology or legal requirements.

How We Notify You

• The "Last Updated" date at the top of this policy will change
• For material changes affecting children's privacy, we will notify you through the app
• Material changes may require renewed parental consent
• The current policy is always available at https://skoul.fr/privacy and from the app

What Constitutes a Material Change

• New types of personal information collected
• Changes to how we use or share information
• Changes to data retention practices
• New third-party services that access data
• Changes to children's privacy protections

Your Options

• Review the updated policy when notified
• Contact us with questions at privacy@skoul.fr
• If you disagree with changes, you may stop using the app and delete all data

Minor Changes

Clarifications, grammatical corrections, or formatting changes that don't affect your rights will not trigger notifications.

Version History

• Current Version: 2.3
• Last Updated: October 4, 2026
• 2.3 — October 4, 2026: aligned with the app: homework photos read by OpenAI with Google Gemini as backup; crash reports and usage statistics off unless a parent turns them on; no Firebase Analytics; email for the Sunday report, PIN recovery, news and contact messages; Google Play billing and Android; Spanish and German; reading back in the app
• 2.2 — September 21, 2026: crash diagnostics, the device identifier sent with API requests, and request records named explicitly
• 2.1 — September 19, 2026: anonymous first-party usage statistics
• 2.0 — September 10, 2026: homework photo processing, Skoul+ subscription, advertising removed
• First Published: October 29, 2025

Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

Email: privacy@skoul.fr

Data Controller:
HIGHTHEM
SIREN: 848274338
France

We will respond to all legitimate privacy-related inquiries within 30 days.

For residents of France, you also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority.

Summary

Key Points:

• ✅ Your child's profile, answers and progress stay on your device
• ✅ Maths drills, the mistake box and most reading and writing drills work on the device
• ✅ Only age, country, language and difficulty are sent for AI practice; never the name
• ✅ Homework photos are read by OpenAI (Google Gemini as backup) and not kept by us
• ✅ Crash reports and usage statistics are off unless a parent turns them on
• ✅ No advertising, no ad SDK, no third-party analytics, no cross-app tracking — ever
• ✅ No user accounts; your email only if you ask for the Sunday report or our news
• ✅ Server logs deleted after 30 days
• ✅ Delete everything from the Parents area at any time
• ✅ Built for COPPA and GDPR

This privacy policy is effective as of October 4, 2026