Children, parents, schools — and the privacy they deserve.

Oyku(the “App”) is operated by Edustack Technologies Private Limited, a company registered in India at B130, AFOCHS, Sainikpuri, Hyderabad, Telangana, India — 500094 (the “Company”, “we”, “us”).

Oyku is a school-trusted memory book. Teachers and schools capture approved classroom moments. Parents see the moments meant for their child. Once a year, those moments can be bound into a real photo book. This Privacy Policy explains, in plain language, what information passes through the App and how we look after it.

By creating an Oyku account or using the App, you agree to this Privacy Policy. If you do not agree, please do not use Oyku.

We try to keep what we collect small and purposeful. Oyku processes the following categories of information:

Account information

• ✓Phone number — used as your sign-in identifier and for account recovery.
• ✓PIN-derived secret — stored encrypted; we never see your raw PIN.
• ✓Display name and role (Parent / Teacher / Admin).
• ✓School and classroom association created by the school admin who invited you.

Children's information (parents)

• ✓Your child's first name, classroom and (optional) date of birth — provided by the school or parent.
• ✓An optional reference photo of your child's face, used only on-device and on our private servers to help match classroom photos to the right parent feed.
• ✓Reactions, captions, and views recorded against your child's posts.

Photos, videos, and captions

• ✓Classroom photos and videos uploaded by school staff after their approval workflow.
• ✓Captions, activity tags, and event metadata added by teachers.
• ✓Generated thumbnails and derived previews used for fast, cached browsing.

Device and usage

• ✓Device model, OS version, and app version — for compatibility, debugging, and support.
• ✓Anonymised crash reports and basic interaction logs — to find and fix problems.
• ✓Apple/Google push notification tokens — only when you allow notifications, used solely to deliver notifications about your child's classroom activity.
• ✓IP address — recorded transiently for security, abuse prevention, and rate limiting.

What Oyku does not collect

• ✓We do not run third-party advertising SDKs, behavioural trackers, or analytics designed to profile children.
• ✓We do not access your phone's photo library unless you explicitly pick a photo via the system picker.
• ✓We do not save Oyku photos to your device's gallery; they stay inside the app.
• ✓We do not sell personal information.

We use the information described above only to:

• ✓Provide the App's core functionality — letting school-approved memories reach the parents they were meant for.
• ✓Match classroom photos to the right child's parent feed, where the school and parent have enabled that feature.
• ✓Generate the optional yearly photo book from a child's existing memories.
• ✓Send push notifications you've opted into, about your child's classroom activity.
• ✓Authenticate users, prevent abuse, and keep accounts secure.
• ✓Provide customer support when you reach out to us.
• ✓Comply with applicable law, valid legal requests, and our agreements with schools.

We do not use children's information for advertising, lead generation, or AI model training of third parties.

Where applicable laws require us to identify a legal basis, we rely on:

• ✓The school's instruction to operate Oyku for its community (legitimate educational interest, contractual necessity).
• ✓Parent consent for child-specific features such as face-matching and notifications.
• ✓Performance of our terms with you when you create an account.
• ✓Compliance with our legal obligations, including child safety laws.

For users in India, processing is governed by the Digital Personal Data Protection Act, 2023 and applicable rules. Parents may withdraw consent at any time by writing to privacy@oyku.app; see “Your choices” below.

Oyku is built so that visibility is the exception, not the default. Information is shared only as follows:

• ✓Parents see content tagged for their own child, plus class/group memories the school enabled for that classroom.
• ✓Teachers and approved school admins see content scoped to their assigned classes — no parent personal information beyond what is needed to operate the class.
• ✓Authorised school owners/principals can review and approve content before public sharing.
• ✓We never share children's photos with other parents outside the school's approval and visibility rules.

Service providers (sub-processors)

We use a small number of vendors to host and run Oyku. They process data only on our instructions, under written terms. Categories include:

• ✓Cloud hosting and storage (e.g. AWS, Google Cloud).
• ✓Push notifications (Apple Push Notification service, Firebase Cloud Messaging, Expo Push).
• ✓Communication (transactional email and WhatsApp Business for school onboarding).
• ✓Crash reporting and diagnostics.

The current list of sub-processors is maintained on our Trust Center. We will update it as our infrastructure evolves.

Oyku keeps data only as long as needed to provide the service, comply with legal obligations, support disputes, and honour school-specific arrangements.

• ✓Account data — while the account is active, plus a short window for recovery.
• ✓Approved photos and videos — for the duration of the school's active use of Oyku, or the parent's active subscription period.
• ✓Push tokens — until the device removes the app or notifications are disabled.
• ✓Audit and security logs — limited retention for incident investigation.

When a school ends its agreement with Oyku, school content is archived or deleted according to the agreement and retained only as required by law.

We use practical security controls appropriate for an app handling children's photos:

• ✓Transport security via HTTPS / TLS for all client-server traffic.
• ✓Encryption at rest where supported by our infrastructure.
• ✓Role-based access for school owners, principals, admins, teachers, and parents.
• ✓Sensitive secrets (auth tokens, PIN-derived material) stored in the device's secure keystore (iOS Keychain / Android Keystore).
• ✓Screenshot/screen recording blocked on the in-app feed where possible.
• ✓Audit and incident response process described in our Trust Center.

No system is perfectly secure. If you suspect unauthorised access to your account, please contact privacy@oyku.app immediately.

Subject to applicable law and your school's policies, you can:

• ✓Access — request a copy of personal information we hold about you or your child.
• ✓Correct — ask us to fix inaccurate information.
• ✓Delete — ask us to delete your account and your child's profile from Oyku (see also our in-app account deletion in Profile → Settings).
• ✓Withdraw consent — turn off optional features (notifications, face-match) at any time.
• ✓Opt out of public sharing — ask the school to add your child to its opt-out list so the child is excluded from photo/video processing.
• ✓Object or restrict — ask us to pause specific processing where the law requires.

To exercise any of these rights, write to privacy@oyku.app from the phone number / email associated with your account, or use the in-app account deletion flow under Profile. We will respond within the timelines required by applicable law (typically within 30 days).

Oyku is intended for use by parents, teachers, and school staff — not directly by young children. A child's presence in the App takes the form of:

• ✓A profile created by the school and accepted by the parent.
• ✓Photos and videos of school activities uploaded and approved by the school.
• ✓Optional age-appropriate metadata such as classroom, section, and date of birth.

Parents control their child's presence in the App — they can opt out of public sharing, request deletion, and withdraw consent for any optional feature. Schools are required by their agreement with Oyku to manage parent consent and opt-out lists.

Oyku is operated from India and uses cloud infrastructure regions selected for performance and compliance. Where data is transferred across borders (for example to a cloud region or a service provider in another country), we use contractual and technical safeguards that meet the requirements of applicable laws.

We may update this Privacy Policy as Oyku evolves or as the law changes. When we do, we'll update the “Last updated” date above. Material changes will be highlighted in-app or by email/notification before they take effect.

For privacy questions, deletion requests, or concerns, reach our privacy team at privacy@oyku.app. For general support, write to hello@oyku.app or visit our Support page.

Postal address — Edustack Technologies Pvt Ltd, B130, AFOCHS, Sainikpuri, Hyderabad, Telangana, India — 500094.