Privacy at Colyf

Who is responsible

Colyf is operated by The Code Lawyers. A participating school or institution decides how its education records are used and who may access them. The Code Lawyers operates the service for that institution. A request about a school record may therefore need to be verified or handled together with the institution.

Information Colyf may process

• Account details, contact information, sign-in security data, roles, and institution membership.
• Student enrollment, guardian relationships, courses, lessons, assignments, submissions, assessments, grades, attendance, timetables, and academic reports.
• Messages, notices, clubs, events, safeguarding reports, support requests, and files that authorized users provide.
• Fee records, payment status, bank or provider references, and receipts. Colyf does not ask users to enter full card details into Colyf.
• Service logs such as time, IP address, browser or device details, request identifiers, and security or audit events needed to operate and protect the service.

Why it is used

Information is used to provide institution-authorized education and administration, authenticate users, keep records consistent, support users, investigate safety or security concerns, meet applicable obligations, and maintain service reliability. Access depends on a person’s verified account, institution, and role.

Optional photos, notifications and meetings

You can choose a profile photo and upload permitted files using the device file picker. Colyf does not request unrestricted access to your photo library. Library loans, hostel allocations and related charges are visible only to authorized institution users and linked guardians.

If you enable background notifications, Colyf stores a device push token or browser subscription and uses Firebase Cloud Messaging or your browser's push service to deliver updates. Notifications use generic text on the lock screen; open Colyf to see the authorized record. You can turn notifications off in Colyf or device settings.

Where your institution enables live meetings, camera and microphone access is requested for joining a call. Media is transmitted to the meeting's configured LiveKit service (currently LiveKit Cloud) and other authorized participants. Screen sharing starts only after you choose it and approve your device's sharing prompt. Where recording is enabled, an authorized host must confirm that attendees have been informed and have given permission before starting. Recordings are stored privately and require authorized access. Camera and microphone controls remain available during the meeting, and leaving ends participation.

Optional live captions process only the microphones of participants who opt in. When enabled, that audio is processed through LiveKit Inference and its configured speech recognition provider, currently Deepgram, to show captions to the meeting. You can withdraw your caption consent during the call. Colyf does not save this live-caption text as a transcript; separately uploaded or host-written transcripts follow the institution's record policy. Browser background effects process camera frames on your device.

If guest access is enabled, a host can issue a single-use invitation. Guests provide a display name, wait for admission, and receive access only to that call. Their identity is marked as unverified and they do not receive school-record access. Guest names and session credentials are removed by scheduled cleanup after the meeting has ended for 30 days.

Children and school-managed use

Colyf supports learners across school ages. Student access and records are created or managed through a participating institution, with guardian involvement where appropriate. Children should only use Colyf through their institution’s approved process and should not send extra personal information through public contact channels. A guardian can contact the institution or The Code Lawyers about a child’s information.

Service providers and locations

Colyf uses Firebase for public-site hosting and file storage, Heroku for backend application hosting, and Supabase for the PostgreSQL database service. These providers process service data to supply infrastructure and may operate across countries under their own terms. Their published information is available from Firebase, Heroku’s Salesforce privacy information, and Supabase.

Retention and deletion

There is no single retention period for every Colyf record. Timing depends on the institution’s policy, the record’s academic or operational purpose, safety and audit needs, legal requirements, active disputes, and technical backup cycles. A verified request may result in deletion, correction, restriction, or de-identification where appropriate. Some records may need to be kept, and backup copies may take time to age out.

Choices and requests

You may ask about, access, correct, or request deletion of information associated with you. Colyf must first verify the requester and may coordinate with the relevant institution. See the account deletion guide for verified review and request options.

Security and changes

Colyf uses access controls, scoped institution data, authentication, and operational safeguards. No internet service can promise absolute security. This notice may be updated when the service or its providers change; the date above shows the current version.