XUS Schools is a school management service made by XusCorp. Schools use it to run attendance, homework, timetables, exams, fees, transport and notices, and to give parents, teachers and students one app for the school day. This policy explains what information the apps handle, why, and what your choices are. It is written in plain language on purpose.
Who is responsible for the data
Your school decides what information goes into XUS Schools and who can see it. In privacy terms the school is the data controller and XusCorp is the data processor: we store and process the information on the school's instructions and do not use it for our own purposes. Questions about a specific record (a mark, an attendance entry, a fee) go to the school office first; they can correct it, and they can ask us to delete it.
Information the apps handle
| What | Where it comes from | Why |
|---|
| Account details: name, role (parent, teacher, student, admin), email address or a school-issued roll number for students, and a password stored only as a hash | Created by the school when it onboards you | To sign you in and show you only what your role allows |
| School records linked to you: attendance, homework, timetable, exam results, fee invoices and receipts, transport route, notices, observations, ID card | Entered by the school | This is the service: showing parents, teachers and students their part of the school day |
| Messages and homework submissions you send through the app | You | Delivered to the school staff or class they are addressed to |
| Campus posts and replies, and the likes, reposts and saved posts a student makes (only if the school has turned Campus on; see below) | The student | To show the post to the students of the same school, or of a shared space both schools approved |
| Campus private messages between two students of the same school (only if the school has turned Campus chat on) | The student | To deliver the message to the one student it is addressed to |
| Campus safety records: a parent's permission, the student's acceptance of the rules, reports, blocks, strikes and every moderation decision with who made it | The parent, the student and the school's moderators | To keep Campus safe, and so the school can answer a parent's question with facts |
| Push notification token, and a record of whether each notification sent to your device was delivered and whether you opened it | Your device, if you allow notifications | To deliver attendance, homework, fee updates and receipts, marks, requests, complaints, notes about your child, events, feedback, and Campus posts and messages to your phone |
| Technical logs: request time, IP address, app version, error reports | Your device and our servers | To keep the service secure and working; kept for a limited time |
A notification never says more than what happened, your child's first name, and "Open to see": never a full name, admission number, mark, grade, percentage, fee amount or balance, a health or disciplinary detail, the text of a Campus post or message, or a moderation reason. The hidden data behind it carries only record numbers and which screen to open, nothing readable.
The apps do not collect your precise location, contacts, photo library or advertising identifiers, and they contain no third-party analytics trackers and no advertising networks. The one exception to "no advertising" is described under Campus: a school may show clearly labelled sponsored posts, which are never targeted at an individual student and never measured per student.
Device permissions
- Camera: used only when you choose to scan a student ID QR code or attach a photo. Nothing is captured in the background.
- Face ID, Touch ID or fingerprint: optional, to unlock the app quickly. The biometric check happens on your device; we never receive biometric data.
- Notifications: optional, for school notices and alerts. Turn them off altogether, set quiet hours, choose a daily summary time, or switch off one kind at a time from Account → Notifications in the app (staff cannot switch off Campus alerts), or turn them off for XUS Schools in your device settings; signing out removes your device from our servers either way.
Children and student accounts
Students sign in with a roll number and a password issued by their school, never with an email address, and the school controls whether a student gets a login at all. Outside Campus, a student account sees only that student's own timetable, homework, attendance and results. There are no in-app purchases, and nothing a student does is ever visible to anyone outside their school, except inside a shared Campus space that both schools have approved. We do not knowingly collect information from a child except as directed by the child's school for the purpose of running the school.
Campus: the student feed
Campus is a short-post feed for students, and private messaging between them. It is off for every school until the school turns it on, and chat has a second, separate switch that is also off by default. When a school does turn it on:
- A parent says yes first. A student cannot open Campus until a parent has given permission in their own XUS Schools app. The parent can take that permission back at any time, and the student then loses access at once.
- Older students only. The school sets the youngest grade that may use Campus.
- Real names. Every post shows the student's name, grade and section. There are no handles and no anonymous posts. Staff never post as themselves; the school has one labelled account.
- Who sees what. Posts are seen by the students of the same school. In a shared space, students of every school that approved the space see them, with each student's school shown. A private message is seen only by the one student it is sent to.
- Text only. No photos, no files and no links from students. A post or message containing a link, a phone number or an email address is refused.
- Every post and message is checked before anyone sees it. A set of rules runs first. The text may then be sent to our moderation provider, which returns only a decision: publish, hold for a person to review, or refuse. Only the words are sent, with no name, roll number or school attached. Something refused is kept, not deleted, so the school and the parent can see what was attempted.
- Private messages stay private unless reported. The school's moderators cannot read a conversation. If either student reports a message, that conversation becomes readable by the school's moderators from that moment, so they can act on the report.
- Parents can see their own child's Campus. A parent sees every post their child wrote, including anything refused or held, any strikes, who their child messages, and every message their child sent. A parent never sees the messages another child wrote.
- Reports, blocks and strikes. Any student can report a post or message and block another student of their school. Moderators can remove a post and issue a strike; repeated strikes pause a student's posting for a set number of days. Posts about self-harm, threats of violence or sexual content alert the school's staff immediately.
- Views. We count how many times a post was seen, once per student per day, and keep only that number on the post. The record of which student saw a post is deleted after 30 days. Whether students can see view counts is the school's choice and is off by default.
- Saved posts are private to the student who saved them. Nobody else, including the school, can see what a student saved.
- Sponsored posts. A school may show a post from a sponsor, always labelled "Sponsored" with the sponsor's name. It is shown to a whole school or a range of grades, never to a chosen student, and the only figure anyone receives is the total number of times it was seen. No information about any student is given to a sponsor.
- Campus Daily. A labelled automated account posts a few items each morning, built from the school's own calendar, exams and notices, plus short summaries of public news from named sources, each with a link to the original.
Where the data lives and who can see it
Data is stored with our hosting providers in encrypted databases, and every school's data is isolated from every other school's at the database level. Access inside XusCorp is limited to the people who operate the service, and only when needed to support a school. We share personal information with no one else, except the service providers that host the platform, deliver email and push notifications — Expo (Expo Push Service), which relays a notification to Apple (APNs) on iPhones and Google (FCM) on Android, each receiving only the notification text described above and your device's push token, never account or record details — and check Campus posts and messages for moderation (TypeSafe Jev, which receives only the text of a post or message, with nothing identifying the student), each bound by contract to process it only for us. We never sell personal information.
How long we keep it
School records stay for as long as the school uses XUS Schools, because the school needs its history (past enrolments, fee receipts, results). When a school leaves, its data is exported on request and then deleted. Technical logs are deleted automatically after a short retention period. Password reset links expire within minutes and can be used once. On Campus, the record of which student saw a post is deleted after 30 days; posts, messages and the moderation record stay while the school uses Campus, and a post or message the student deletes is removed from everyone's view straight away. Your device's push notification token is deleted the moment you sign out, and disabled automatically if your device stops accepting notifications; a record that a notification was sent to your phone, with whether it was delivered and whether you opened it, is kept for reporting. A notification's short text is the same as the entry in your in-app notifications list and is kept alongside it; queued notification records are removed after 30 days, and no notification text is used for anything but showing it to you.
Your choices
- Change your password at any time from the app or the web app; students are asked to set their own password at first sign-in.
- From Account → Notifications in the app: turn notifications off altogether, set quiet hours (default 9pm–7am), choose when the daily summary arrives (default 7:30am), switch off single kinds such as homework or fee reminders (staff cannot switch off Campus alerts), and send yourself a test notification. Or turn camera, biometric unlock and notifications on or off in your device settings; signing out removes your device from our servers either way.
- Parents can give or take back a child's Campus permission at any time, from the child's Campus screen in their own app.
- Students can delete their own Campus posts and messages, and block, unblock or report any student of their school.
- Ask your school to correct or delete information about you; the school can also close your account. If you would rather write to us directly, use the address below and we will work with the school to resolve it.
Security
Connections use HTTPS. Passwords are hashed, sessions expire, and a password change or a reset by the school ends the sessions on other devices. Row-level security in the database means the service cannot read another school's records even by mistake.
Changes to this policy
If we change what the apps collect or how it is used, we will update this page and the date at the top, and tell schools through the admin web app.
Contact
XusCorp · XUS Schools
Email: support@xuscorp.com
Web: schools.xuscorp.com