School Buddy

Security and privacy

School Buddy holds things that matter: your children's names, their school, their week. This page explains, control by control, how we look after them. The privacy page says what we keep and for how long.

The short version

We read only your children's school emails, read-only, and never change your inbox.
Your family's details are encrypted with a key that belongs to your family alone.
The AI that reads letters gets one letter at a time, never your children's names, and cannot act. Every date, amount and link it suggests is checked against the letter.
No passwords: you sign in with an emailed link, or Face ID or a fingerprint.
No adverts, no trackers, no third-party scripts. Nobody at School Buddy reads your family's mail.

Your school email

Read-only. Google gives School Buddy permission to read, never to send, change or delete. We search only for emails from your children's schools.
One Gmail per family, usually the parent the schools write to first.
Forged mail is set aside. Anyone can type a school's name in an email. We accept a letter only when Google confirms it was signed by the school's own email domain. Anything else is never read and never becomes a job.
Disconnect in one tap, in Settings. We delete our access at once and tell Google to withdraw it.
ClassCharts is optional and off until you connect it. Because it has no official way to connect, we keep your ClassCharts password, encrypted, use it only on our server, and delete it the moment you disconnect.

How letters are read

Letters are read by Claude, an AI from Anthropic, through Anthropic's business service. Under its commercial terms, Anthropic does not use this data to train its models. Reading happens on Anthropic's servers in the United States, under the data protection safeguards in Anthropic's terms.
One letter at a time. A hostile letter cannot affect how another is read.
Your children are never named to it. It sees "child 1, Year 8", never a name, a club or a place, and nothing from any other family.
It cannot act. It has no tools, no web access and no memory. It suggests jobs; plain code decides what is kept. Nothing is sent, paid or booked without your tap.
Hidden text is removed first. White text, tiny text and invisible characters a parent would never see are stripped before reading, and a letter that tries to give the AI instructions is set aside.
Every fact is checked against the letter. A date, amount, email address or link survives only if the letter says it, and a link only if it is on the school's own website. Anything else is removed and the job says "check this against the letter".
Bank details never pass. A job never carries a sort code or account number: it tells you to pay through the school's usual system. The "Pay" button goes only to a payment site we know, never to a link from a letter.
Private letters are never summarised. A letter about one child's health, needs, behaviour or welfare becomes only "Private letter, open it in your inbox".

Encryption and keeping families apart

Your family's own key. Names, email addresses, school email content, letters and attachments, timetables, kit lists, clubs, Bag items, reminders and your Gmail and ClassCharts access are encrypted (AES-256) with a key made for your family alone. Which school and year group each child is in stays readable, so letters can be matched to them.
The keys are locked too. Each family's key is itself encrypted with a master key kept outside the database, so a copy of the database alone reveals nothing.
One gatekeeper. All family data passes through one part of our code that always checks which family is asking. Automated tests prove one family can never read another's data, and the build fails if any other code tries.
Encrypted in transit. Every page is served over HTTPS only.

Signing in

No passwords to steal. We email a link that works once, for 15 minutes. Opening it is not enough: you press a button, so email scanners cannot use it up.
Face ID or a fingerprint, if you add it in Settings. The check happens on your phone: we never receive your face, fingerprint or any biometric, only a key your phone makes for School Buddy that cannot sign in anywhere else.
See and end every sign-in. Settings lists each device signed in, and signs any of them out, or all but the one in your hand.
Limits on tries. Sign-in requests, links and codes are limited per address and per network, and asking for a link never reveals whether an email uses School Buddy.
An authenticator code for the family's owner is built and can be switched on; it will be required before School Buddy opens beyond the pilot.
Only the owner can invite another parent, by email, and remove one, which signs them out everywhere at once.

Children

Children never sign up. A parent adds a child's device with a code that works once, for 10 minutes, and agrees first that they are the child's parent or carer.
On it, a child sees only their own jobs, bag and dates. Never a private letter, an email, a payment, a brother's or sister's things, or the family's settings.
We keep no child's email, surname, birth date or photo, and a child never talks to the AI.

The website itself

No adverts, trackers or analytics. No third-party scripts run on any page, and our fonts and images are served from our own site.
A strict content security policy allows each page only its own scripts and styles, and stops other sites from framing ours.
The only cookie is the one that keeps you signed in. It cannot be read by scripts, and works only on our site.
Only the home page, this page and the privacy page are open to search engines. Everything else is kept out of them, and anything about a family needs that family's sign-in.

Who can see your data

Your family: the parents in it, and each child their own part.
Nobody at School Buddy reads your family's mail. The one exception is a letter you choose to share when you report a mistake: for 30 days at most, every look is shown to you in Settings, and you can stop it at any time. A private letter can never be shared this way.
The companies we rely on: Hostinger hosts the service and its database in its London data centre and sends our emails; Google provides Gmail access; Anthropic reads letters, as above.

Keeping and deleting

Bag ticks are deleted after 30 days, and waiting-list requests after 6 months. Automatic deletion of school email content after 90 days is being switched on during the pilot.
Delete your family from Settings at any time. It is removed from our live database at once; copies in our hosting backups remain until those backups expire.

Not done yet, said plainly

An independent penetration test, before School Buddy opens beyond the pilot.
Google's verification of our Gmail access. Until then Google shows "Google hasn't verified this app" when you connect, and limits School Buddy to 100 people.
The full privacy notice and terms, before any family beyond the pilot.

Found a problem?

Tell us through our security contact or email support@sbuddy.co.uk. We look at every report.