SchoolOS Privacy Policy

Effective date: 2 November 2026. Applies to the SchoolOS mobile app (Android and iPhone) and the SchoolOS web service it connects to.

1. Who we are

ForwardAxis Technologies Pte. Ltd. ("ForwardAxis", "we", "us"), a company incorporated in Singapore, UEN 202645105N, registered address 456 Segar Road, #07-119, Segar Meadows, Singapore 670456.

Privacy contact: hello@forwardaxis.sg (subject line "Personal data - SchoolOS").

2. Who the app is for

SchoolOS is a timetabling, relief-planning and leave service for schools. The app is for school staff: teachers, Key Personnel, relief coordinators and administrators. It is not for students, parents or the general public, and it is not directed at children. You cannot register in the app: your school's SchoolOS administrator creates your account.

3. Who is responsible for your data

ForwardAxis provides SchoolOS to your school, on the school's behalf. Your school decides what personal data is entered into SchoolOS and why. We use that data only to provide, secure and support the service for the school, not for our own purposes. Your school's own policies and its agreement with us also apply.

4. What data is processed

Health-related information. A leave request can carry the category "medical leave", and the optional private note is free text. We treat this as health information. Please enter only what your school needs and no medical details. A private note is visible to you, your school's administrators, relief coordinators and Key Personnel, not to other teachers.

Free-text fields (leave notes, handover messages, decline reasons, relief instructions) contain whatever you type. Please do not enter more than the school needs.

5. What the app does on your phone

• When you first open the app you enter your school's code. The app then connects only to your school's SchoolOS address (a sub-domain of timetable.forwardaxis.sg), always over HTTPS. Unencrypted connections are blocked by the app.
• The app keeps your sign-in session in its private storage so that you stay signed in. Signing out ends the session on the server and on the phone, and clears notification banners. Sessions also end after a period of inactivity. On Android, the app's data is excluded from device backups. On iPhone, app data may be included in your device backup according to your iPhone's backup settings.
• The camera and your photos are used only when you choose to take or pick a photo to attach to relief instructions. Files are sent only when you choose to attach them. When you open an attachment, the app may keep a temporary copy in its private storage so that your phone can display it. Uninstalling the app removes its data from the phone, except that on iPhone the notification-registration secret in the iOS Keychain (section 6) may stay on the phone. Sign out before uninstalling so that the registration is also withdrawn at your school.
• The app does not use your location, contacts, microphone or calendar, does not read other apps' data, and does not use an advertising identifier.
• The app contains no advertising and no analytics, crash-reporting or tracking software.
• The app's screens are hidden in the recent-apps view on iPhone (a cover in the app switcher) and on most Android phones.

6. Notifications

While the app is open or running, it checks your school's SchoolOS server for new in-app notifications and shows a banner on your phone. The banner contains only a fixed, generic text such as "New relief assignment" and "Open SchoolOS to view details", never names, classes, subjects, dates, leave details or message text. The details load inside the app after you have signed in.

No notification content is currently sent through Google or Apple push-notification services. On iPhone, if you allow notifications, iOS gives the app a push-notification token, which the app stores with your account on your school's SchoolOS server, together with a random identifier of this installation. The server returns a secret that stays on your iPhone in the iOS Keychain and lets the app withdraw the registration later. The registration is withdrawn when you sign out or change school (if your phone is offline at that moment, the app retries later), and when your school deactivates your account. A withdrawn registration can no longer be used and is deleted when your account is removed. Registrations are never used for tracking or advertising and are not shared. A notification meant for a different school than the one the app is set to is discarded without being shown. You can turn notifications off in your phone's settings at any time; the in-app notification list keeps working. The Android app does not create a push registration.

If we start to deliver notifications through Google Firebase Cloud Messaging or Apple Push Notification service, we will update this policy first. Those services would receive only a device token and the same generic text and link, and their servers may be outside Singapore.

7. Where your data is stored and who processes it for us

• Google Cloud (hosting). The SchoolOS service, its database, uploaded files, automatic database backups and service logs are hosted on Google Cloud in the Singapore region (asia-southeast1). Google processes the data as our hosting provider under its cloud data processing terms. We are still confirming that the extra database backups taken before software updates are also stored only in Singapore.
• Zoho (e-mail). Our e-mail, including messages you send to us (for example support, privacy or deletion requests) and automatic operational alerts from the service, is handled by Zoho. This e-mail may be processed outside Singapore. Please do not put sensitive details in e-mails to us.
• Apple (iPhone only). Apple issues the notification token described in section 6. No notification content is sent through Apple today.

8. Who can see your data

• Staff of your school, according to their role. Teachers see their own timetable, duties and leave, and the handover threads they take part in. Administrators, relief coordinators and Key Personnel see what their role permits.
• ForwardAxis personnel, only as needed to run, secure and support the service, under a duty of confidentiality.
• The service providers named in section 7, only as needed for their service.
• Others only where the law requires it.

We do not sell personal data, do not share it for advertising or marketing, and the SchoolOS service does not send school data to artificial-intelligence services.

9. How long data is kept

We do not yet delete most school data automatically after a fixed period. Where there is no fixed period, this section says so. To ask for deletion, contact your school's SchoolOS administrator first, then us (section 10).

• Account and school-work data (timetable, relief, leave, instructions, messages, attachments): kept for as long as your school uses SchoolOS, with no fixed time limit, unless your school deletes it or asks us to.
• When your account is removed: your account record, sign-in sessions, notification registrations and in-app notifications are deleted at once. Records of school work you took part in (for example leave records, relief duties and handover messages) belong to the school and are not deleted with your account; your school decides whether to keep them.
• Copies in backups: automatic database backups and recovery logs are kept for 7 days, so deleted data normally leaves them within about 8 days. Extra database backups taken before software updates are normally deleted after 3 days, but this is not yet automatic, so such a copy can occasionally be kept longer until we delete it.
• Deleted files: an earlier or deleted version of an uploaded file is kept for 7 days and can then be recovered for a further 7 days, so it is gone within about 15 days.
• Security and audit records (your e-mail address, IP address and the actions taken) are not deleted automatically. They are kept for as long as your school uses SchoolOS, also after your account is removed, because schools need an accountable record of sign-ins and changes.
• Service logs (IP address, time, address requested) are kept for 400 days and then deleted automatically.
• Unused accounts: SchoolOS has a check that suspends accounts not used for 90 days and removes accounts suspended for 6 months. It is not yet run automatically for every school, so do not rely on it to remove your account; ask for deletion instead.
• When a school stops using SchoolOS: we return the school's data to it on request and delete it from the live service. Copies in backups, deleted-file versions and service logs then expire as described above. The school's contract may set further terms.
• Google's own systems: after we delete data, Google completes its deletion from its own systems under its deletion process; Google states this can take up to about 6 months.

10. Your choices and how to make a request

You can ask to see or correct your personal data, ask for it to be deleted, or withdraw your agreement to a use of it. Because your school controls the data, please contact your school's SchoolOS administrator first. If your school cannot help, write to us at hello@forwardaxis.sg; we will pass your request to your school and help it respond.

You can stop phone notifications at any time in your phone's settings, and sign out to withdraw this phone's notification registration.

Deleting your account: see How to delete your SchoolOS account.

11. Security

Sign-in is required. Access is checked on the server according to your role and your school. Connections are encrypted (HTTPS). Passwords are stored only as one-way hashes, accounts lock for 15 minutes after 6 failed sign-ins in a row, passwords must be changed at first sign-in and at least every 90 days, and sessions end after a period of inactivity. Sign-ins and changes are logged. We do not claim any security certification, independent security test or approval by any authority.

12. Changes to this policy

We publish any change on this page and update the effective date. We tell schools that use SchoolOS about material changes before they take effect.

13. Contact

ForwardAxis Technologies Pte. Ltd., 456 Segar Road, #07-119, Segar Meadows, Singapore 670456, Singapore.
E-mail: hello@forwardaxis.sg