Privacy policy

school.bus — Privacy policy
Updated 9 November 2026

Operator: RUDRAAYAAN AI TECHNOLOGIES PRIVATE LIMITED, Hyderabad, India ("we", "us").
Support: support@homeworkai.in
Grievance Officer: Sandeep Naredla, grievance@homeworkai.in

About this policy
This policy explains what the school.bus app and website collect, why, who receives it, how long we keep it, and how you can use your rights under India's Digital Personal Data Protection Act, 2023 and its Rules. Schools that use school.bus agree a separate written agreement with us.

Who uses school.bus
Schools use school.bus to show their own buses to adults they approve: parents and drivers. The school decides who gets access. The app is for adults (18 or older) only. We do not collect children's names, classes, attendance, photos or whether a child boarded. Please do not enter any details about a child.

How sign-in works
Parents sign in with their mobile number, a one-time code sent on WhatsApp and their school's bus code (typed, or scanned from the school's QR code). The school then assigns the parent's stop; parents do not choose it. Live tracking opens once a stop is assigned. The school can change or remove access at any time.
Drivers use "Driver sign in" with the mobile number their school registered and a WhatsApp code. If a driver's number is entered on the parent form, the app asks the driver to use Driver sign in instead.
Before a code is sent, you confirm that you are 18 or older and accept these terms, this policy and WhatsApp login codes.

What we collect and why
Mobile number: to create your account and sign you in.
WhatsApp sign-in code: delivered through WhatsApp (Meta), which receives your number and the message. We store only a scrambled (hashed) form of the code.
School, bus and assigned stop: to show your bus and the time to your stop. A stop can reveal a family's routine, so we show it only to you and your school.
Last sign-in time: to keep your account working and to spot misuse.
Push token: an identifier from your phone that lets us send trip alerts.
Driver details (drivers only): the name and mobile number the school entered, trip start and end times, and when stops were marked served.
Driver trip location (drivers only): see "Bus location".
Server logs: see "Logs and security".
Activity record: see "Activity record (audit log)".
Consent record (parents and drivers): which version of these terms and this policy you accepted, and when, saved after your WhatsApp code is confirmed.
We do not ask for your email, contacts, photos or files. There is no advertising, analytics or tracking software in the app.

Bus location
Only drivers share location. When a driver starts a trip, the driver's phone sends the bus's GPS position, speed and direction to our server, also in the background and with the screen locked, until the driver ends the trip. Nothing is collected outside a trip. Parents assigned to that bus see the bus's position and the estimated time to their own stop. Parents never share their own location.

Driver and attender contacts
A school can store a driver contact and an attender contact for each bus, and can change or remove them. Driver numbers are used by the school and are not shown to parents. During a bus transfer, the sending bus’s attender number is shown to its approved parents, who can call or copy it; Siri may read it on an authenticated device. Schools must add a contact only with that person's permission.

Trip alerts
To send alerts such as "trip started" or "bus near your stop", we store your phone's push token. Alerts are delivered through Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service; they receive the token and the alert text. You can turn alerts off in the app or in your phone's settings.

On your phone
Your sign-in is kept in your phone's secure storage. Face ID, fingerprint or passcode unlock is checked by your phone; we never receive biometric data. The camera is used only if you choose to scan a school bus QR code; the images stay on your phone and are not sent to us.

Maps
Maps may be provided by Apple Maps, Google Maps or OpenStreetMap, depending on your phone and app version. In the current app, iPhone uses Apple Maps and Android uses OpenStreetMap. When a map loads, the map provider receives your phone's IP address and the map area shown.

School details and images
Schools manage their name, office contact details, buses, routes, stops and staff contacts. A school may show its own front image to its signed-in members. We re-encode each image and remove its metadata, including location. Schools must not upload pictures of identifiable children.

Logs and security
Our servers record IP address, time, the page or address requested, the response and the browser or app type, to keep the service secure and fix problems. Error logs do not record what you typed. We use encrypted connections, limit staff access to those who need it, and encrypt backups. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Activity record (audit log)
To protect children, families and schools, we keep a record of important actions in the service, such as school console sign-ins and sign-outs, changes a school makes to buses, stops, staff and parent access, SOS alerts, stops marked served, and actions by our own administrators. Each entry records what was done and when, with short details of the action (for example which bus, stop, route or invite); who did it, by role and staff number (a parent is recorded only as "a parent", never by name or mobile number); the IP address and the browser or app type the request came from; and a reference number for the request.
Why: to keep the service secure, to investigate misuse, mistakes or incidents, and to answer questions from your school or from authorities where the law requires.
Who can see it: our authorised staff. We share a school's entries with that school when it asks.
The service does not let anyone, including the school and our administrators, change or remove entries; direct database access, which could bypass this, is limited to the operator for maintenance. Each entry is automatically deleted in the next scheduled cleanup after one year, unless longer retention is required by law.

Who receives data
Your school: your account, assigned stop and sign-in time, so it can manage access.
Meta (WhatsApp): your number and sign-in message.
Google (Firebase Cloud Messaging) and Apple: push token and alert text.
Apple, Google or OpenStreetMap map servers: IP address and map area.
Our hosting provider: stores and runs the service for us.
Payment provider (Razorpay): if a school pays online, it processes the school's payment details. Parents and drivers never pay.
These providers act for us or deliver their own service, and use the data for that purpose. We do not sell personal data, show ads, or share data for marketing. We may disclose data if the law requires it.

Why we may use it
We use your data only to sign you in, show your school's buses, send trip alerts, give support, keep the service secure and meet legal duties. We rely on the consent you give at sign-in and on the school's lawful use of its transport service.

How long we keep it
Bus GPS points: deleted automatically after 30 days.
Sign-in codes and rate-limit records: deleted within 2 days.
Alert queue records: deleted after 7 days.
Consent record: automatically deleted one year after you accept.
Server security logs: automatically deleted in the next scheduled cleanup after one year, unless longer retention is required by law.
Activity record (audit log): automatically deleted in the next scheduled cleanup after one year, unless longer retention is required by law.
Your account, assigned stop and push tokens: until you delete your account or your school removes you.
Backups: encrypted and overwritten in their normal cycle, within 30 days.
Trip times and school records are kept by the school while it uses school.bus.
If a law requires us to keep any of this longer, we keep it only for as long as that law requires.

Delete your account
In the app: Profile → Delete account. On the web: /delete-account. Or email support@homeworkai.in. Deleting removes your account, your assigned stop, your school approvals and your push tokens, and signs you out on every phone at once. Copies in backups are overwritten within 30 days. Activity record entries are not removed when you delete your account; each one is still automatically deleted in the next scheduled cleanup after one year, unless longer retention is required by law. Records the school itself keeps (such as its bus and route details) are not part of your account. Driver accounts are set up by the school: ask your school, or email support@homeworkai.in, to remove one.

Your rights
You can ask to see a summary of your data and who received it, correct or update it, delete it, withdraw consent, or name someone to act for you if you die or cannot act. Withdrawing consent means we stop the related processing; it does not undo processing already done, and the app cannot work without a sign-in number. Write to the Grievance Officer at grievance@homeworkai.in with "school.bus" in the subject. Never email passwords, sign-in codes, children's details or live bus locations.

Grievances
Grievance Officer: Sandeep Naredla, grievance@homeworkai.in. We acknowledge a grievance within 7 days and aim to resolve it within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Changes
We will tell you before a material change to this policy takes effect.

Support · Grievance · Privacy · Terms · Help · Delete account

Password sign-in and bus coordination

After WhatsApp verification, parents and drivers can set or reset a password in Profile and use it to sign in without an external code. We store salted password hashes, never plaintext passwords. Parent sign-in also requires the school-issued bus code.

Help requests and count-only transfers share meeting locations with the school and responding drivers. After both drivers confirm handover, approved parents of the sending bus may see the receiving bus location and available arrival estimates. This does not identify which children moved. The sending bus’s attender contact is provided to approved parents to confirm arrangements, with that person’s permission. Help and transfer actions are kept in the activity log. Delivery and location updates depend on network and GPS availability.