Privacy Policy

1. Overview

ExamLock is an exam and test integrity platform used by Australian schools. We are committed to protecting student privacy in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and applicable state education privacy legislation. This policy explains what data we collect, why, and how it is handled.

2. Data We Collect

• Student number: a pseudonymous identifier assigned by the school. This is the only student identifier collected. Students do not have accounts, emails, or passwords.
• Device identifier: a random device ID generated on first app launch, hashed (SHA-256) before being sent to the server. Used to associate check-ins with a specific device during an exam or test session. The server never sees the raw device ID.
• Exam check-in timestamps: records when a student checks into an exam or test via QR code or NFC tag.
• Phone lock status: whether the student's phone is locked during an exam or test, and when it was locked/unlocked.
• Violation events: records of policy violations during an exam or test (e.g., leaving the app, unlock attempts). Includes timestamp and violation type only.
• Teacher email address: used for account authentication and login. Collected only from teachers, not students.
• Teacher name: used for display purposes within the platform (e.g., identifying who created an exam). Collected only from teachers.

3. Data We Do NOT Collect

• Student names or personal identifiers
• Phone numbers
• Parent or guardian information
• Browsing history or app usage outside of exams and tests
• Contacts, photos, files, or any on-device content
• Biometric data

4. Location and Campus Boundaries

Schools may optionally set a campus boundary so that student phones lock automatically during school hours and unlock on leaving. This feature is off by default and only operates if a school turns it on.

When it is enabled, the student's device checks its own position against the school boundary locally. No coordinate is transmitted to ExamLock or to the school, and none is stored. The only information sent to our servers is a single true/false value indicating whether the device is inside the boundary.

Our database contains no column capable of holding a student location. Teachers and administrators cannot see where any student is, only whether a device is on campus during scheduled school hours.

Location checking is time-limited: it operates only during a school's scheduled hours and a short configurable period beforehand. Outside those hours, and on non-school days, no location check takes place.

5. The Parent Email Tool

Our AI safety page gives parents a pre-written email they can send to their child's school. The page opens the message in the parent's own email app, addressed to a school of their choosing. We do not send it, and we do not hold a list of school addresses.

A copy of that message is addressed to us (sales@examlock.me) as BCC. We use it only to understand how many parents have raised this with their school. The address appears in the BCC field of the parent's own email app before anything is sent, and it can be deleted there — removing it does not affect the message.

BCC rather than CC, so the school does not see a software vendor on a parent's private message. Copies received this way are not added to a marketing list, and are not shared with the school or anyone else.

6. How We Use Data

All collected data is used exclusively for exam and test integrity purposes:

• Identifying students during exam or test sessions (via student number only)
• Recording exam attendance and check-in status
• Monitoring phone lock compliance during exams and tests
• Logging and reporting violations to authorised school staff

7. Data Storage and Hosting

Data is stored in a Supabase-hosted PostgreSQL database with row-level security (RLS) policies ensuring that users can only access data they are authorised to view. All data is encrypted in transit (TLS 1.2+) and at rest. Authentication tokens are stored locally on devices using encrypted storage (Android EncryptedSharedPreferences, iOS Keychain).

8. Data Sharing

We do not sell, trade, or share student data with third parties. Data is accessible only to:

• The student (their own records)
• Authorised teachers and school administrators within the same school
• ExamLock platform administrators for technical support purposes only

9. Data Retention

Exam and test session data (check-ins, violations) is retained for the duration of the school's subscription. Schools may request deletion of all associated data at any time. Student records can be removed by school administrators through the dashboard.

10. Your Rights

Under the Australian Privacy Principles, individuals have the right to:

• Access the personal information we hold about them
• Request correction of inaccurate information
• Request deletion of their data
• Lodge a complaint about privacy handling

To exercise these rights, contact your school administrator or reach out to us directly.

11. Children's Privacy

ExamLock is used in educational settings with students under 18. Students do not have accounts; they are identified solely by their school-assigned student number. We minimise data collection to only what is necessary for exam and test integrity, and we do not collect personal names, emails, phone numbers, or parent information.

12. App Permissions

The ExamLock student app requests the following device permissions, each with a specific purpose:

• Usage Stats Access: monitors which app is in the foreground to enforce exam or test mode. No app usage data is stored or transmitted.
• Display Over Other Apps: displays a blocking overlay to prevent app switching during exams and tests.
• Camera: used solely for scanning QR codes during exam or test check-in.
• NFC: used for NFC tag-based exam or test check-in.

13. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Schools will be notified of material changes via email.

14. IT Procurement

For IT procurement teams and IT directors, see our detailed Security & Compliance document covering infrastructure security, breach analysis, and Australian Privacy Principles compliance.

15. Contact

For privacy-related inquiries or complaints, please contact us at info@examlock.me.