Privacy Policy

AttendFlow ("AttendFlow", "we", "us", "our") is the data controller / data fiduciary responsible for your personal data.

2.1 Information You Provide

• Account Information: When you create an account, we collect your email address, name, and profile photo (if provided).
• Academic Data: Attendance records, class schedules, exam dates, marks, notes, and calendar events you input into the app.
• Authentication Data: If you use Google Sign-In, we collect your Google account information as permitted by your account settings.

2.2 Automatically Collected Information

• Device Information: Device type, OS version, unique device identifiers, and mobile network information.
• Usage Data: How you interact with the app, including features used, time spent, and app performance data.
• Log Data: Technical logs, error reports, and crash reports to help us improve the app. Crash and performance diagnostics are collected regardless of your analytics choice — they are necessary to keep the app working, and we rely on legitimate interests for them. Product analytics is separate and follows your choice (see 7.1).
• Advertising ID: Our advertising partner (Google AdMob) collects your device's advertising ID (ADID) in order to serve ads and apply frequency capping. See 2.3.
• Voice Input (optional): If you use the microphone button in the in-app assistant, your speech is converted to text on your device by Android's speech-recognition service. We do not record or store audio; the resulting text is sent as your assistant message (see 2.3, AI Assistant).

2.3 Third-Party Services

These are every third party that receives your data. We do not sell your data to anyone.

• Google Services: We use Google Sign-In for authentication. Google's privacy policy applies to their data.
• Firebase (Google): Data storage, authentication, analytics, crash reporting (Crashlytics) and performance monitoring.
• PostHog (PostHog Inc., United States): Product analytics — which screens and features are used, on a pseudonymous user identifier. Used in the app and on this website. App traffic is routed via a Cloudflare Worker proxy. Follows your analytics choice (see 7.1).
• Cloudflare (Cloudflare, Inc.): Files you upload in My Files are stored as encrypted objects in Cloudflare R2 object storage. Cloudflare also operates the Worker that proxies analytics traffic. See 5.1.
• Groq (Groq, Inc., United States) — AI Assistant: When you use the in-app assistant, the text of your question and your recent conversation turns are sent to Groq, which runs the language model that generates the reply. Do not enter sensitive personal information into the assistant. We also retain the transcript, linked to your account, so we can support you and improve the assistant; it is deleted when you delete your account.
• Resend (Resend, Inc.): Delivers our transactional and product emails. Receives your email address and name.
• Advertising & Billing (Google AdMob, AdSense & Google Play): The free plan is ad-supported. We serve non-personalized ads only — our ad requests are configured with no behavioural profiling and are tagged for under-age-of-consent. Note that non-personalized does not mean no identifier: AdMob still collects your device's advertising ID (ADID) to serve ads and cap frequency. We have disabled ADID collection and ad-personalization signals for Firebase Analytics. AttendFlow Pro subscriptions are sold and processed by Google Play — we do not store your payment details.

When you visit attendflow.app, we and our partners may use cookies and similar technologies.

3.1 Cookies

Cookies are small text files stored on your device. We use them for essential site functions (e.g., remembering your theme), analytics, and advertising. For visitors in the EEA/UK, non-essential (analytics and advertising) cookies are set only after you consent via our cookie banner, and you can withdraw consent at any time. You can also control cookies through your browser settings.

3.2 Analytics

We use Google Analytics / Firebase Analytics on some pages to understand aggregate usage. Analytics identifiers (such as the Google Analytics client ID) are pseudonymous and are treated as personal data under the GDPR and DPDP — we do not use them to build advertising profiles about you.

3.3 Advertising (Google AdSense)

Our website may display ads via Google AdSense. We request non-personalized ads for EEA/UK visitors who have not consented to personalized advertising. You can review or change your ad settings at adssettings.google.com.

We use your information to:

• Provide, maintain, and improve our services, and manage your account
• Process AttendFlow Pro subscriptions (via Google Play)
• Send important notifications about your account and app updates
• Provide customer support and respond to inquiries
• Analyze usage to improve the experience (aggregate)
• Detect, prevent, and address technical issues, fraud, and security threats
• Comply with legal obligations

4.1 Legal bases (GDPR Art. 6 / DPDP)

• Performance of a contract: creating and running your account, syncing your data, and providing Pro features.
• Consent: non-essential cookies, website analytics/ads for EEA/UK visitors, and optional features such as the class leaderboard. You may withdraw consent at any time.
• Legitimate interests: security, abuse prevention, and product improvement — balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with law.

Under India's DPDP Act, we process your data on the basis of your consent or a permitted "legitimate use".

5.1 Storage & security

Your account data — profile, attendance, timetable, exams, marks, notes and calendar events — is stored using Google Firebase, encrypted in transit (TLS) and at rest on Google's infrastructure. Files you upload in My Files are stored separately, as encrypted objects in Cloudflare R2 (not on Google infrastructure); their filenames and folder structure stay in Firebase. Access to a file is granted only through short-lived signed links issued to your own account. We apply access controls, authenticated access, and server-side rules that restrict each user's data to their own account.

• Encryption in transit (SSL/TLS) and at rest
• Access controls and authentication requirements
• Server-enforced authorization (a user can access only their own data)

Note: some data (e.g. your schedule and cached academic data) is also stored locally on your device to enable offline use; protect your device with a screen lock and the app's optional biometric lock.

5.2 Retention

We retain your account and academic data while your account is active. When you delete your account, your data is removed through an automated erasure process that cascades across our databases, file storage, and authentication records; residual copies in encrypted backups are overwritten in the normal backup rotation (within 90 days). Crash and log data are retained for a limited period, and analytics data is retained per the provider's configured retention.

5.3 Breach notification

If a personal-data breach occurs that is likely to result in risk to you, we will notify the competent authority — the Data Protection Board of India under the DPDP Act, and the relevant EEA/UK supervisory authority under the GDPR (without undue delay, and within 72 hours where required) — and will inform affected users where the law requires.

We may share information only in these circumstances:

• Service Providers (processors): the following process data on our behalf, and no others:
  • Google Firebase — storage, authentication, analytics, crash & performance reporting
  • Google AdMob / AdSense — non-personalized advertising (receives your advertising ID)
  • Google Play — subscription billing
  • PostHog Inc. (US) — product analytics
  • Cloudflare, Inc. — My Files object storage (R2) and the analytics proxy
  • Groq, Inc. (US) — the language model behind the in-app AI assistant (receives your assistant messages)
  • Resend, Inc. — email delivery
• Legal Requirements: if required by law, court order, or government regulation.
• Business Transfers: in the event of a merger or acquisition, your information may be transferred (you will be notified).
• With Your Consent: with your explicit consent.

6.1 Administrator access

Authorized administrators may access account data through a secured admin console (protected by one-time-password verification and access controls) solely to provide support, investigate abuse or fraud, and comply with law. Administrative actions are logged.

Depending on where you live, you have some or all of the following rights over your personal data. To exercise any right, use the in-app tools below or email support@attendflow.app. We respond within the timeframe required by law.

• Access a copy of your data, and rectify/correct inaccurate data (Settings → Edit Profile).
• Erasure ("right to be forgotten"): delete your account and all data from the in-app Settings → Delete Account option, the Delete Account page, or by emailing us.
• Data portability: request an export of the data you provided in a machine-readable form.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent at any time (e.g. cookies, leaderboard) — this does not affect prior lawful processing.
• Turn off product analytics (Settings → Privacy). This stops Firebase Analytics and PostHog. It does not stop crash and performance diagnostics, which we keep under legitimate interests so the app stays reliable — see 2.2 and 7.1.
• Complain to your data-protection authority (see §10 and §11).
• Nominate another person to exercise your rights in the event of death or incapacity (DPDP).

7.1 Advertising & other choices

Ads in the app are non-personalized by default. Manage or cancel AttendFlow Pro from Google Play → Subscriptions. You can disable push notifications in your device settings, and reset your device advertising identifier at any time.

AttendFlow is a general-audience study tool that is also used by students who are minors. We do not knowingly collect a date of birth or age, and we do not use the app to build advertising profiles of any user.

• Ads: all ads are served non-personalized and are tagged for under-age-of-consent with a general-audience content rating; we do not use behavioural profiling for advertising.
• Under 13 (COPPA): the app is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has provided data, contact us and we will delete it.
• Under 18 (India DPDP): where the DPDP Act requires verifiable parental consent for a user under 18, such processing must be authorized by a parent or guardian. If you are a parent/guardian and wish to review or delete your child's data, contact our Grievance Officer.

Your data may be processed on servers located outside India or your country of residence. This applies to Google Firebase and other Google services, and also to our non-Google processors: PostHog and Groq process data in the United States, and Cloudflare operates a global network (your My Files objects and the analytics proxy). Where personal data is transferred internationally, we rely on legally recognised safeguards — including Standard Contractual Clauses and applicable adequacy decisions offered by our providers — rather than on your consent-by-use alone. You may request details of the safeguards that apply.

If you are in India, the Digital Personal Data Protection Act, 2023 applies. AttendFlow is the Data Fiduciary (see §1). We process your personal data based on your consent or a permitted legitimate use, for the purposes described in this policy, and only for as long as necessary.

As a Data Principal you may access, correct, update, and erase your data, seek grievance redressal, and nominate another individual to exercise your rights. To exercise these rights or raise a grievance, contact our Grievance Officer:

If your grievance is not resolved, you may complain to the Data Protection Board of India.

If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR applies. AttendFlow is the data controller (see §1). Our legal bases are set out in §4.1, and your rights are set out in §7 (access, rectification, erasure, restriction, portability, objection, and withdrawal of consent).

You have the right to lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority in the EEA, or the UK Information Commissioner's Office).

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used and shared
• Access and delete your personal information, and correct inaccurate information
• Opt out of the "sale" or "sharing" of personal information — we do not sell or share your personal information
• Limit the use of sensitive personal information
• Non-discrimination for exercising your privacy rights

We honor opt-out preference signals such as Global Privacy Control (GPC) where required.

Our app and website may contain links to third-party sites or services; we are not responsible for their privacy practices and encourage you to review their policies.

We may update this Privacy Policy from time to time. We will post the new policy, update the "Last Updated" date, and notify you of material changes through the app.