Privacy Policy

Introduction

Parent Push Limited ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our school club monitoring service.

Parent Push helps parents monitor supported school email updates and sends WhatsApp alerts when a relevant update is found.

Information We Collect

Email Access

When you connect your Gmail, Outlook or Hotmail account, Parent Push receives read-only permission to check recent messages for monitoring. This permission does not allow Parent Push to send or delete emails.

• Email messages and metadata - Recent messages and metadata may be retrieved from the connected inbox and checked against your selected monitoring settings
• Sender information - Checked to identify supported school updates and apply sender-based alert filters
• Email subject lines and content - Checked for school updates matching your keywords and selected school system, subject to approved-sender protection when enabled

New accounts require approved senders. Existing parents keep current monitoring until they enable protection.

When enabled, sender details are checked first and content is retrieved only from approved senders. Other sender details may still be checked - but NOT the email content. Read-only permission remains mailbox-wide.

Protection covers all connected inboxes. Unapproved or changed senders may mean missed updates. Removing the last approval pauses checks; protection stays enabled. Domain approvals include subdomains.

Other Information

• WhatsApp phone number - To send you club availability alerts
• Monitoring preferences - Your selected school systems and keywords to monitor
• Session data - To maintain your authenticated session

How We Use Your Information

We use your information solely to provide our core service:

• Check recent emails - We check recent messages from your connected inbox for school updates matching your keywords and selected school platform, subject to approved-sender protection when enabled
• Send WhatsApp alerts - When a relevant update is detected, we send a WhatsApp notification
• Display monitoring status - We show you which email accounts are connected and actively monitoring
• Maintain your session - To keep you securely logged in to the service

We use connected-mail data for monitoring, requested alerts, account operation, security and legal obligations as described in this policy. We do not use it for advertising or unrelated profiling.

Parent Push's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This means:

• We only request the minimum Gmail permissions necessary (read-only access to emails)
• We do not sell your Gmail data; limited sharing with processors occurs only to provide the service
• We do not use your Gmail data for advertising or marketing purposes
• We do not allow humans to read your emails except as required for security purposes or with your explicit consent
• We do not use your Gmail data to train AI or machine learning models

How We Share Your Information

We do not sell, trade, or share your personal information or email data with third parties, except:

• Twilio (WhatsApp delivery) - We use Twilio to send WhatsApp alerts. The alert may contain a minimal excerpt or metadata derived from the matching email, plus the recipient phone number
• Email providers (Gmail, Microsoft) - We authenticate with these services using OAuth 2.0 to access your emails with your permission
• Hosting infrastructure - Our service runs on secure cloud infrastructure (Replit/Neon) where data is encrypted at rest

We do not share complete mailboxes. Limited alert content or metadata may be shared with processors, such as Twilio for requested WhatsApp delivery, as described in this policy.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit - All data is transmitted over HTTPS/TLS
• Encryption at rest - OAuth tokens and sensitive data are encrypted using AES-256-GCM
• OAuth 2.0 authentication - We use secure OAuth flows with HMAC-signed state parameters to prevent CSRF attacks
• Session isolation - Each user's data is completely isolated and scoped to their session
• Secure token storage - Access tokens are encrypted and stored securely in our database
• Automatic token refresh - We maintain active monitoring without storing your password

Data Retention and Deletion

We retain your data only as long as necessary to provide our service:

• Active monitoring - While your email account is connected, we store your encrypted OAuth tokens and monitoring preferences
• Session data - Session data expires according to the configured inactivity policy; the current period is not promised here
• Email processing - We do not intentionally retain complete mailboxes, but minimal alert excerpts, message identifiers, metadata and delivery or security records may be retained as needed

How to Delete Your Data

You can delete your data at any time by:

• Disconnecting your email - Click "Disconnect" next to the account. This stops monitoring and removes or disables the relevant OAuth access; deletion then propagates through active systems, logs and backups
• Revoking access - Revoke Parent Push's access through your Google Account permissions or Microsoft Account permissions
• Clearing your session - Sign out to clear all session data

Disconnecting or revoking access stops monitoring and starts the deletion process. Some records may remain temporarily in logs or backups, and billing or legal records may be retained where required.

Your Rights and Control

You have complete control over your data:

• Access control - You can connect or disconnect email accounts at any time
• Monitoring control - You can enable/disable monitoring for specific school platforms
• Revoke permissions - You can revoke Parent Push's access to your Gmail, Outlook or Hotmail account at any time through your account settings
• WhatsApp control - You can enable or disable WhatsApp alerts at any time

Supported School Platforms

Parent Push matches school updates from these supported school communication platforms:

ParentPay (parentpay.com)

Arbor (arbor-education.com)

SchoolMoney (schoolmoney.co.uk)

ParentMail (parentmail.co.uk)

IRIS ParentMail (parentmail.co.uk)

Teachers2Parents (teachers2parents.co.uk)

School Gateway (schoolgateway.com)

Matching supported platforms helps identify relevant school updates. When enabled, sender details are checked first and content is retrieved only from approved senders. Other sender details may still be checked - but NOT the email content. Read-only permission remains mailbox-wide.

Children's Privacy

Parent Push is intended for parents, guardians and carers. It is not directed to children and we do not knowingly offer accounts to people under 16. Our service accesses adult-controlled email accounts to monitor school notifications on their behalf.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify users through the application
• Require your consent before continuing to access your email data if the changes affect how we use your information

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: Hello@ParentPush.com

Website: https://parentpush.com