Privacy Policy
1. Introduction
Awardio ("Awardio," "Service," "we," "us," or "our") is an educational application that helps teachers, coaches, and instructors recognize student achievements through personalized award certificates. This Privacy Policy explains how we collect, use, share, and protect information when you use Awardio on iOS, Android, or our web-based award viewer.
We built Awardio with student privacy in mind. We collect only what we need to operate the Service, we do not sell personal information, we do not show advertising to anyone, and we do not use student information to train AI or machine learning models.
Questions? Contact us at contact@awardio.app.
2. Who We Are
Awardio is operated by Awardio LLC, a California limited liability company. Our Service is designed for educators using it within the scope of their professional roles. We are a service provider to schools and educators, not a direct service to children or parents.
3. Our Privacy Commitments
- We do not sell or rent student personal information.
- We do not use student information for behavioral advertising.
- We do not build personal profiles of students beyond the educational purpose for which we were retained.
- We allow educators and schools to access, correct, and delete student information.
- We maintain reasonable administrative, technical, and organizational safeguards.
- We do not use student personal information to train AI or machine learning models.
4. Information We Collect
4.1 Information from Teachers
- Account identifiers: name, email address, and profile photo from your Google, Microsoft, or Apple account. When you sign in with Apple, you may choose to share your real email address or use Apple's private email relay; we receive only what you choose to share.
- Authentication tokens: we do not store your account password.
- User-provided content: classroom or group name, reference name, award customizations, role, and settings.
- Usage data: actions you take in the app, used for operational analytics.
- Device information: device model, OS version, app version, and crash logs via Firebase Crashlytics.
4.2 Information About Students
- Student names (first and last), as entered by you or imported from a CSV file.
- Optional parent or guardian email addresses, if you provide them.
- Award content you create: titles, subjects, custom text, and design selections.
- Award history recording which awards were created and when.
We do not request or intentionally collect birthdays, home addresses, phone numbers, student email addresses, photos or biometric data, grades, test scores, health information, location data, or government-issued identifiers.
4.3 Information About Parents / Award Recipients
When you send an award to a parent, we process the recipient email address, the award content, and basic delivery telemetry. When a recipient opens a shared award link, we may receive their IP address and basic device/browser information for security and abuse prevention. We do not require recipients to create an account.
Shared award pages are intended only for the recipient designated by the teacher, coach, instructor, parent, or guardian. Recipients should not publicly share a child's award unless they have the legal right to do so.
4.4 Google Services
If you connect your Google account, we receive gmail.send permission only — to send award emails when you explicitly take that action. We do not read, store, or access any other emails in your Gmail account. Awardio only sends email when you intentionally initiate a send action.
4.5 Microsoft Services
If you sign in with Microsoft, we receive your name, email, and a token to send award emails via Microsoft Graph (User.Read and Mail.Send scopes only).
4.6 Feedback
In-app feedback submissions include your free-text feedback, device type, OS version, account user ID, and a timestamp. Submissions are stored in a Google Sheet accessible only to Awardio staff.
4.7 Analytics
Analytics are used to understand app performance and feature usage by adult users. We do not use analytics to evaluate, rank, profile, or target individual students.
5. How We Use Information
We use information to authenticate you, display your students and awards, generate certificates, send award emails, create private award links, maintain award history, diagnose crashes, protect against abuse, and comply with legal obligations.
We do not sell or rent information to third parties, display advertising, build student profiles for non-educational purposes, track users across other apps, or train AI/ML models on any account content.
6. Sharing Information
We do not sell personal information.
6.1 Parents and Recipients You Choose
Award content and private viewing links are delivered to recipients through your connected Gmail or Outlook, or via your device's share sheet. Award links are unguessable random tokens — please share with care.
6.2 Service Providers (Subprocessors)
| Subprocessor | Purpose | Data Location |
|---|---|---|
| Google Firebase Authentication | Teacher sign-in | United States |
| Google Firebase Firestore | Account data, student rosters, award history | United States |
| Google Firebase Cloud Storage | Award images and PDFs | United States |
| Google Firebase Crashlytics | Crash diagnostics | United States |
| Google Firebase Analytics | App usage metrics | United States |
| Google Cloud Functions | Server-side PDF processing and email dispatch | United States |
| Google Sign-In + Gmail API | Authentication and sending award emails | United States |
| Microsoft Identity / Graph | Authentication and sending awards via Outlook | United States / customer region |
| Apple Sign in with Apple | Teacher authentication on iOS | United States |
| Amazon SES | Parent-initiated award delivery and resend emails | United States (us-east-2) |
| Google Apps Script + Sheets | In-app feedback | United States |
6.3 Schools and Districts
If a school or district is a paying customer, account-level information may be shared with school administrators under our agreement with that institution.
6.4 Legal Reasons
We may share information when required by law, court order, or to protect the rights, property, or safety of users.
6.5 Business Transfers
If Awardio is acquired or merges with another company, your information may transfer to the new entity subject to this Policy.
7. Children's Privacy (COPPA)
Awardio is designed for use by teachers and adults, not directly by children. Students under 13 do not sign in or create accounts. When Awardio is used by a teacher, coach, school, or educational organization for an educational purpose, we rely on the adult user or institution to provide any required authorization or consent. We use Student Data only to provide the Service and not for advertising, profiling, or unrelated commercial purposes.
A parent or guardian can request to review, correct, or delete Student Data about their child by contacting contact@awardio.app. We will respond within 30 days.
8. Educational Records (FERPA)
Where Awardio receives education records from a school or district under FERPA, Awardio acts as a school official / service provider with a legitimate educational interest, subject to the institution's direction and any applicable agreement. Student Data is used only for the educational purpose for which it was provided.
Schools may begin the DPA process by emailing contact@awardio.app with "DPA Request" in the subject line.
9. State Student Privacy Laws
9.1 California (SOPIPA / AB 1584)
We do not engage in targeted advertising using Student Data, use Student Data to amass a profile, sell Student Data, or disclose it except as permitted by SOPIPA. We delete Student Data at the direction of the school or upon account deletion.
9.2 New York Education Law § 2-d
Student personally identifiable information cannot be sold or released for any commercial purpose. Parents have the right to inspect their child's education record. We use encryption in transit and at rest. Parents may address complaints to contact@awardio.app or to the New York State Education Department, Office of the Chief Privacy Officer, 89 Washington Avenue, Albany, NY 12234.
9.3 Illinois SOPPA
We do not sell, rent, or trade Covered Information; will not use it for targeted advertising; will delete Covered Information upon school request within 60 days; and implement reasonable security practices.
9.4 Other States
Awardio is designed to support compliance with applicable U.S. student privacy laws, including Texas Education Code §§ 32.151–32.158, Tennessee's Student Online Personal Information Protection Act, Connecticut General Statutes § 10-234aa, and the SDPC National Data Privacy Agreement model.
9.5 PPRA
Awardio does not administer surveys regarding the protected categories described in 20 U.S.C. § 1232h.
10. Data Storage and Security
Awardio data is stored on Google Firebase infrastructure in the United States. Parent-initiated award delivery and resend emails are dispatched through Amazon SES (us-east-2 region).
We protect data through HTTPS/TLS encryption in transit, encryption at rest via Google Cloud and AWS, Firebase Security Rules keyed to each teacher's user ID, unguessable random tokens for share links, OAuth-based authentication, and secure credential storage in Google Cloud Secret Manager.
If we become aware of a breach, we will notify you without undue delay and within 72 hours where required by GDPR.
11. Your Rights and Choices
You may access, correct, delete, export your information, or withdraw consent for connected services. Delete your account at More → Account → Delete Account — your profile, students, settings, and award history are deleted from active systems within 30 days and from backups within 90 days.
California Residents (CCPA / CPRA)
California residents may request to know what personal information we hold, request deletion, and opt out of "sale" or "sharing" for behavioral advertising (we do not do this). Email contact@awardio.app to exercise these rights.
European Residents (GDPR / UK GDPR)
Our legal bases for processing are consent (connecting Gmail or Outlook), contract (providing the Service), legitimate interests (operating and securing the Service), and legal obligation. For EU/UK/Swiss transfers to the US, we rely on Standard Contractual Clauses. You may lodge a complaint with your local data protection authority.
12. Data Retention and Deletion
We retain account data while your account is active. Upon deletion, your data is removed from active systems within 30 days and from backups within 90 days. Award links previously shared with parents remain viewable until they expire (90 days after creation). To deactivate a specific link sooner, contact contact@awardio.app.
13. Marketing Communications
We send only transactional messages essential to operate the Service. We do not currently send optional product communications, but if we begin, every such message will include a one-click unsubscribe link. We do not sell email addresses for marketing purposes.
14. Limited Use of Google User Data
Awardio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:
- We use Google user data only to provide user-facing features within Awardio.
- We do not transfer Google user data to third parties except as necessary to provide the Service, comply with law, or as part of a merger or sale.
- We do not use Google user data for serving advertisements.
- We do not allow humans to read Google user data unless you have given explicit consent, it is necessary for security, or required by law.
- We do not use Google user data to develop or train generalized AI/ML models.
15. International Data Transfers
Awardio is operated from the United States. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission and UK ICO.
16. Do Not Track and Cookies
Awardio's mobile app does not use cookies. Our web-based award viewer may set basic technical cookies for security and load balancing only — no advertising or tracking cookies. We do not track users across other apps or websites.
17. No Push Notifications
The current version of Awardio does not send push notifications. If we add them in a future release, we will request your explicit permission before sending any.
18. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and notify you in the app or by email before changes take effect.
19. Contact Us
Email: contact@awardio.app
Mailing Address: 16 Seville, Lake Forest, California 92630
For schools and districts wishing to begin the Data Processing Agreement process, email contact@awardio.app with "DPA Request" in the subject line.
