School Hub Privacy Policy

Effective: 28 October 2026
Who we are: School Hub is made and run by an independent developer in Victoria, Australia ("School Hub", "we", "us").
Contact: the contact form at get-school-hub.pages.dev/contact, or Settings → Privacy → Contact School Hub in the app.

This policy covers the School Hub desktop app (Mac, Windows, Linux), School Hub for phones (myschoolhub.pages.dev), and School Hub's websites and servers. It says exactly what information goes where. If something isn't listed here, School Hub doesn't collect it.

The short version

• Your school data stays on your device. Your timetable, tasks, results, attendance, chronicle, lesson plans, notes and whiteboards are kept in a file on your computer. We don't have a copy we can read.
• Your passwords never come to us. Your Compass password only goes to Compass. Your Microsoft password only goes to Microsoft.
• Messages are end-to-end encrypted. Chats, files and whiteboards with friends and groups are scrambled on your device before they leave it. Our servers only pass on data they can't read.
• No ads, no tracking, no selling. School Hub has no advertising, no third-party analytics or tracking code, and we never sell, rent or trade anyone's information.
• What we do see: a once-a-day count that tells us how many copies are in use (a random id, the app version, the kind of computer, your school's Compass address and your friend tag), and the minimum needed to run our servers. Details are below.

1. Information on your device

Everything School Hub syncs from Compass (timetable, events, learning tasks, results and feedback, attendance, chronicle, news, lesson plans), plus everything you create (notes, whiteboards, planner items, settings), is stored in School Hub's data folder on your computer. A copy is also kept in Documents → School Hub Backup so reinstalling doesn't lose anything. Both stay on your computer.

You choose how long it's kept. When you first open School Hub you pick how long it keeps your data: every year (so you can look back), the last 3 years, this year and last, or this year only. Older classes, learning tasks, attendance, events, news, chronicle entries and chat messages are then cleared from your computer automatically. Notes and whiteboards you made stay until you delete them. Change this any time in Settings → Privacy. Uninstalling School Hub and deleting the School Hub Backup folder removes everything.

Compass sign-in. You sign in to Compass inside School Hub, on Compass's own website. School Hub keeps Compass's sign-in cookie on your computer so you stay signed in, the same way a web browser does. It never sees, stores or sends your Compass password.

Your Compass calendar link is stored on your computer. It is also used, on your computer, to make the keys that encrypt your account backup (see section 3). The link itself is never sent to us.

Microsoft Teams (optional). If you sign in to Teams in School Hub, you sign in on Microsoft's own page. School Hub keeps Microsoft's sign-in tokens on your computer, encrypted with your operating system's keychain, and talks to Microsoft directly. Recent Teams messages are cached on your computer so they show offline. None of this comes to us.

Textbook logins a friend shares with you (optional) are kept on your computer only, encrypted with your operating system's keychain. They are never put in School Hub's data file, your account backup or anything Claude can read.

School Hub for phones keeps its data in your phone's browser storage on that phone.

2. Friends, groups and messages

Chats, reactions, files, pictures, whiteboards, shared timetables and anything else you share with friends or groups are end-to-end encrypted (AES-256-GCM) on your device before they're sent. Only you and the people you're talking to have the keys. With friend tags, the key is never sent at all: each app works it out from the other's public key.

These encrypted messages pass through School Hub's relay server:

• Messages are held on the relay for 24 hours so they can be delivered if your friend's app is closed, then deleted.
• Files and pictures are encrypted on your device, stored for 30 days (25 MB maximum each), then deleted automatically.
• What the relay can see: that an encrypted message was sent to a channel, when, its size, and the IP address it came from. Your IP address is used only in memory to stop spam (rate limiting) and is not stored. The relay can't see who you are, who you're talking to, or what you said.

You choose what each friend can see (timetable, tasks and so on) in the app, and you can change it or remove a friend at any time.

Phone notifications (optional). If you turn on notifications in School Hub for phones, your phone's browser gives us a push address, which the relay stores so it can wake your phone when a message arrives. Push messages travel through your phone maker's push service (Apple, Google or Mozilla). A push carries the message still end-to-end encrypted, and is encrypted again for your phone, so neither we nor the push service can read it.

You can also point School Hub at your own relay server (Settings → Friends & sharing → Connection). Then your encrypted messages go there instead of to ours.

3. Your School Hub account

Your School Hub account keeps everything that's yours in sync across your devices, a few seconds after each change: your friend tag and keys, friends, groups, profile, look and settings, notes, every message in your chats, and a short window of your school data (about four weeks back to three weeks ahead) so your phone can show it. It also lists the computers signed in to it (each computer's name, the kind of computer, and roughly when it was last used) so you can sign one out.

Your account is encrypted on your device with a key made from your private Compass calendar link before it's uploaded. Our server stores only data it can't read, under an id it can't link to you. A copy from up to a day before is kept in case something goes wrong.

Recovery code. If you make one, a small record is stored that says which account is yours, encrypted with the code, so we can't read it. Only someone with the code can use it. Making a new code deletes the old record.

To delete it, go to Settings → Privacy → Delete my backup. It's removed from our server straight away, including the copy from the day before, and School Hub stops saving from that computer until you turn it back on.

4. Usage count, announcements and Plus

Once a day School Hub sends our download site:

• a random id made up on your computer (not linked to your name, your Compass account or your device's serial number)
• the app version and the kind of computer (for example "Windows")
• your school's Compass address (for example yourschool.compass.education), not your own Compass account
• your friend tag
• whether this copy was set up on a computer that already had School Hub

We keep, for each copy: those details, the first and last day it was used, and how many days it has been used. A copy's record is deleted once it hasn't been used for 12 months. We use this to know how many people use School Hub, which versions are still in use, and which schools it's used at. We use the friend tag only to block a copy that's being used to spam or harass people, and to send an announcement to one person.

About once a minute while School Hub is open, it asks our server for announcements (for example a new feature or a school event) and whether that copy has been blocked. It sends the same id, friend tag, version and school address. The answer also says whether you have Plus.

Nothing is sent until you've agreed to this policy in the app. After that you can't turn the count off, because it's how we stop abuse. It never includes your Compass data, your name, your messages or your sign-ins.

Downloads. When someone downloads School Hub from our website, we count the download by day and platform. To avoid counting the same browser twice in a day, we keep a one-way scrambled code made from the IP address and browser that changes every day and can't be turned back into either. We don't store IP addresses.

The contact form. If you contact us, we keep your message, the reply address you give (if any), your friend tag (if you give it) and the same daily scrambled code as downloads (to stop spam). We delete them once your message is answered, and after 12 months at most.

5. The study helper (AI)

The study helper comes with School Hub Plus, and is also available to people we've given access to. If you don't have it, nothing in this section applies to you.

When you ask the study helper something, School Hub sends your question, along with the parts of your school information it needs to answer, to our server. Our server passes it to an AI provider and sends the answer back. Depending on the question, this can include:

• your timetable, lesson plans, learning tasks, results and feedback, and chronicle
• your notes and whiteboards
• textbook pages you have open
• the page open in School Hub's browser
• Teams messages School Hub has cached
• your first name, year level and school

Our server stores only a scrambled code for your device (to know it has access), your friend tag, and how much you've used the study helper: questions asked today, and this month's count and cost (to keep usage fair and within the limits of your plan). It doesn't store your questions or the answers.

AI providers. We use OpenAI, or Cloudflare Workers AI when OpenAI isn't available. We may also use Anthropic (Claude) or Google. We ask OpenAI not to store requests for later use. We only use providers whose terms say they won't use what we send to train their AI. Each provider may keep requests for a short time for safety and abuse checks under its own privacy policy.

The study helper can suggest adding a task or study session to your calendar. It only does so if you say yes.

Your study helper chats are kept on your computer.

6. Claude connector (optional)

If you turn on Settings → Claude, School Hub keeps a read-only summary of your school information in its data folder for the Claude Desktop or Claude Code app on your computer. This happens on your computer: School Hub doesn't send it anywhere. When you ask Claude something, whatever Claude reads becomes part of your conversation with Claude, under your own Claude account and Anthropic's privacy policy. Chats with friends are left out unless you choose to include them. Turn the connector off to stop it and remove the summary.

7. School Hub Plus and payments

School Hub Plus is an optional subscription. Plus is linked to your friend tag, so it comes back with your account on a new computer. Payments are handled by Stripe: your card details go straight to Stripe and never to us. Stripe tells us your friend tag, your Stripe customer number, your plan (monthly or yearly), when it renews or ends, and whether it's active. We use these to turn Plus on and show it on the Manage Plus page (get-school-hub.pages.dev/account), which shows a friend tag's plan and renewal date to anyone who enters that tag, but nothing else about you. Stripe keeps your email address, name and payment details under its own privacy policy, to take payments, send receipts and handle refunds. Payment records are kept for 5 years because tax law requires it. If you're under 18, you need a parent's or guardian's permission to buy Plus. The terms of sale are at get-school-hub.pages.dev/terms.

Everything from Compass, chatting with friends, the planner and the phone app are free and stay free.

8. Updates

School Hub checks for updates about once an hour by downloading a small file from our update server (and GitHub). Like any website, these servers see your IP address. We don't store it. Updates are downloaded from the same places.

9. Who else handles information

We don't sell or share personal information. We use these services to run School Hub:

Some of these services store data outside Australia. Where they hold information we can read, we pick services with strong security and privacy terms. Most of what passes through them (messages, files, backups) is encrypted so they can't read it either.

We'll give information to police or a court only if Australian law requires it. Because of end-to-end encryption, we don't have your messages, files or backup contents to give.

10. Young people

School Hub is made for secondary school students, so many of our users are under 18. That's why we collect so little:

• no ads
• no profiling
• no tracking across apps or websites
• no selling data
• no public profiles

People only find you by a friend tag you give them. If you're under 15, please show this policy to a parent or carer.

Buying School Hub Plus needs a parent's or guardian's permission if you're under 18.

A parent or carer can use the contact form to ask what we hold about their child, or to have it deleted.

11. How long we keep things

12. Security

• Messages, files, whiteboards and backups are encrypted on your device with AES-256-GCM.
• Sign-in tokens and shared logins are encrypted with your operating system's keychain.
• All connections to our servers use HTTPS.
• Content from Teams and the web is cleaned before it's shown.
• Our servers don't keep the keys that would unlock your data.

No system is perfectly secure. If a data breach is likely to cause serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

13. Your choices and rights

• See or delete your data. Most of it is on your device: you can see it in the app and delete it there, or choose how long it's kept (Settings → Privacy). Delete your account backup in Settings → Privacy. For anything else we hold (your usage count record, block entries, Plus), use the contact form and give your friend tag. We'll reply within 30 days.
• Correct your data. School data comes from Compass. Ask your school to correct it there.
• Turn things off. Teams, the Claude connector, phone notifications and the study helper are all optional. Removing a friend stops sharing with them.
• Complain. Contact us first through the contact form. If you're not happy with our answer, you can complain to the OAIC at oaic.gov.au or by calling 1300 363 992.

14. Changes

If we change this policy, we'll update the date at the top. If the change is significant (for example, collecting something new), we'll tell you in the app before it takes effect.