Privacy Policy

Application: Mojammaa SGS (package com.mojammaa.sgs / bundle com.youssefatalha.mojammaasgs)
Last updated: 2026-05-20

This Privacy Policy describes how the Mojammaa SGS mobile application (the “App”) collects, uses, and protects information when used by school administrators, teachers, students, and parents. The App is operated by the school administration of Mojammaa and is hosted on Google Firebase (project mojammaa-sgs).

1. Who is the data controller

The school administration that deploys the App for its pupils is the data controller. Technical operation of the backend (Firebase Authentication, Cloud Firestore, Cloud Storage, Firebase Cloud Messaging) is provided by Google LLC as a sub-processor.

2. What information we collect

• Account credentials — email address and a hashed password, managed by Firebase Authentication. We never see the plain-text password.
• School records — for pupils enrolled at the school: full name, class/level, grades (notes), attendance records, homework (devoirs) and teacher feedback. This data is entered by teachers and administrators, not by the pupils themselves.
• Uploaded files — documents and images that teachers or administrators upload (for example, course materials or class photos), stored in Firebase Cloud Storage.
• Push notification tokens — when notifications are enabled, the App registers an Expo/FCM device token so the school can send reminders (new grade posted, announcement, etc.). The token is stored against the user’s account in Firestore.
• Language preference and theme — stored locally on the device (AsyncStorage) for in-app personalisation only.

We do not collect advertising identifiers, precise location, contacts, microphone, or browsing history. The App contains no third-party advertising SDKs.

3. How we use the information

• To authenticate users and enforce role-based access (admin, teacher, student/parent).
• To display class schedules, grades, attendance, homework and messages to the people authorised to see them under the school’s Firestore security rules.
• To deliver push notifications related to school activity.
• To maintain the security and integrity of the service (abuse prevention, debugging, backups).

We do not sell personal data and we do not use it for advertising or profiling.

4. Legal basis

Processing is carried out (a) to perform the educational contract between the school and the pupil’s family, (b) on the basis of the school’s legitimate interest in running its educational activities, and (c) where applicable, with the consent obtained from the parent or legal guardian at enrolment.

5. Children’s privacy (under 13)

The App’s target audience includes pupils under the age of 13. Accounts for minor pupils are created by the school administration with the knowledge of the parent or legal guardian; pupils do not self-register. In line with COPPA (U.S.) and GDPR-K (EU):

• We collect only the information strictly necessary for the school’s educational activity.
• We do not show advertising and we do not engage in behavioural profiling of minors.
• A parent or legal guardian may, at any time, request access to, correction of, or deletion of their child’s data by contacting the school administration (see Section 9).

6. Sharing and sub-processors

Personal data is hosted on Google Firebase (Google LLC / Google Ireland Ltd.) and may be transferred and processed in data centres operated by Google. We share data only with:

• Google Firebase — Authentication, Firestore, Cloud Storage, Cloud Messaging.
• Expo (Expo Application Services, 650 Industries, Inc.) — only push-notification routing for the Expo push token, when push is enabled.

We do not share personal data with any other third party, except where required by law.

7. Data retention

School records (grades, attendance, homework) are retained for as long as the pupil is enrolled at the school and for the additional period required by local education regulations. Account credentials are deleted when the account is removed by an administrator. Uploaded files are retained until deleted by the uploader or by an administrator.

8. Security

Data in transit is encrypted with HTTPS/TLS. Data at rest is encrypted by Google Cloud. Access to data is enforced by Firestore and Cloud Storage security rules, which restrict each user (admin / teacher / student) to the records they are authorised to see. Passwords are stored only as hashes by Firebase Authentication.

9. Your rights & contact

Users (or, for minors, their parents or legal guardians) may request access to, correction of, export of, or deletion of personal data, and may withdraw consent at any time. To exercise these rights, or to ask any question about this Privacy Policy, contact:

Mojammaa SGS — Data Protection Contact
Email: youssefatalha@icloud.com

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when the latest changes took effect. Material changes will be communicated through the App or by the school administration.

This policy applies to the Mojammaa SGS mobile application distributed on Google Play and the Apple App Store.