Privacy Policy

1. Who We Are

Nurily (“we”, “our”, or “us”) provides a cloud-based platform for managing student records, class structures, staff, and family communications. The platform is accessible via web browser at nurily.app and via the Nurily mobile app on Android.

For privacy enquiries, contact us at the details in Section 10.

2. Data We Collect

We collect only the information necessary to operate the platform. The categories below depend on your role.

We do not collect payment information, location data, photographs, or any special-category data (such as health or ethnicity) unless you explicitly provide it as part of a student record.

3. Mobile App: Biometric Login

The Nurily Android app offers an optional biometric login feature (fingerprint or face recognition). Here is exactly how it works:

• When you enable biometric login, your email address and password are encrypted and stored in the Android Keystore on your device only.
• Your biometric template (fingerprint or face data) is never accessed by us. It is processed entirely by your device’s operating system and hardware.
• No biometric data is transmitted to our servers at any point.
• You can disable biometric login at any time by clearing the app’s data or using the option within the app.

4. Mobile App: Push Notifications

The Nurily app uses Firebase Cloud Messaging (FCM), a service provided by Google, to send push notifications about relevant events (such as class updates or messages from your institution).

• When you install the app, a unique device token is generated by Firebase and shared with our servers so we can deliver notifications to your device.
• This token does not identify you personally but is associated with your account.
• Google’s use of this token is governed by the Google Privacy Policy.
• You can disable notifications at any time through your device’s notification settings.

5. How We Use Your Data

We use collected information to:

• Operate and maintain the Nurily platform and mobile app
• Manage student enrolment, class assignments, and institutional structures
• Authenticate users and secure accounts
• Send relevant notifications and communications
• Improve platform reliability and performance
• Respond to support requests
• Meet legal or regulatory obligations where required

We do not use personal data for advertising purposes or sell it to third parties.

6. Data Storage and Security

All platform data is stored in a MySQL database hosted on DigitalOcean cloud infrastructure. No personal data is stored locally on devices by the web or mobile app — the mobile app only stores your encrypted login credentials in the Android Keystore if you enable biometric login.

We apply the following security measures:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Passwords stored as hashed values, never in plain text
• Access to the database restricted to authorised personnel only
• Regular backups of platform data

While we take reasonable technical precautions, no internet transmission or storage system can be guaranteed to be 100% secure. If you become aware of a security concern, please contact us immediately.

7. Data Sharing

We share data only in the following limited circumstances:

• Within your institution: Authorised staff (administrators and teachers) can access student and class data for their institution only.
• Google Firebase: Device tokens are shared with Firebase solely to deliver push notifications (see Section 4).
• DigitalOcean: Our cloud infrastructure provider hosts the database. They act as a data processor under a data processing agreement and do not access your data independently.
• Legal requirements: We may disclose data if required to do so by law or a valid legal process.

We do not share student data with third-party advertisers, analytics platforms, or data brokers.

8. Data Retention

We retain personal data for as long as your account is active or as required to provide the service. When an institution closes its account or requests deletion:

• Student and staff records associated with that institution are deleted from our systems.
• Backups are purged on their normal rotation schedule.

If you wish to request deletion of your personal data before account closure, please contact us using the details in Section 10.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request that your personal data be deleted.
• Objection: Object to certain uses of your data.
• Portability: Request your data in a structured, machine-readable format.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

10. Contact Us

If you have any questions about this policy, your data, or a privacy concern, please get in touch:

Nurily
Email: privacy@nurily.app
Website: www.nurily.app

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For significant changes, we will notify users through the platform or by email. Continued use of Nurily after changes are posted constitutes acceptance of the updated policy.