Privacy Policy

Privacy Policy

Last Updated: July 20, 2026

At MyClassHub, we are committed to safeguarding your privacy. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of information when you use our platform.

1. Information We Collect

We collect information to provide and improve our services to you:

• Personal Identification Information: If you are a staff member, we process your email address for authentication purposes via Google Firebase Authentication.
• User-Generated Content: Any content you create, including announcements, homework assignments, schedule entries, chat messages, notes, poll responses, suggestions, bug reports, support conversations, and ad submissions, is stored in our database.
• Ad Submission Data: When you submit an advertisement, we collect the ad image URL, caption, link, contact information (name, LINE ID, phone number, or email), and payment transaction details you provide.
• Device & Usage Data: We collect browser type, device information, IP address, page visit logs, and access timestamps for security, analytics, and service improvement.
• Push Notification Tokens: When you enable notifications, your browser generates a unique token that is stored solely to deliver push notifications you have opted into.
• Local Storage Data: We store theme preferences, authentication sessions, search history, reaction state, study timer settings, and PWA cache data in your browser's local storage.

2. How We Use Your Information

The information we collect is used exclusively for:

• Managing user authentication, authorization levels, and role-based access control.
• Facilitating administrative tasks such as posting announcements, homework, and schedules.
• Enabling real-time communication between students and staff via the internal chat system.
• Processing and displaying advertisements submitted by users, including moderation and expiry management.
• Delivering push notifications for new announcements and homework (only if you have enabled them).
• Operating the study timer and lo-fi music player features.
• Recording announcement reactions and poll/vote tallies.
• Maintaining audit logs of administrative actions for security and accountability.
• Preventing abuse through profanity filtering and content moderation.
• Improving the platform through aggregated, anonymized usage analytics.

3. Third-Party Services

MyClassHub integrates with the following third-party services, each governed by their own privacy policies:

• Google Firebase: Provides authentication (Google Sign-In), Cloud Firestore database, cloud functions, and hosting. Firebase Privacy Policy
• Google YouTube IFrame API: Used to embed background lo-fi music in the study timer. YouTube may collect viewing data according to Google's Privacy Policy.
• ImgBB: Used for ad image hosting when you upload advertisement images. ImgBB API
• inW Cloud Payment API: Used to verify PromptPay payment transactions for ad submissions. Transaction data (amount, timestamp, reference) is processed to confirm payment status.
• Cloudflare: Provides CDN hosting and performance optimization. Cloudflare Privacy Policy

4. Lawful Basis for Processing

We process personal data under the following lawful bases as defined by applicable data protection laws including the EU General Data Protection Regulation (GDPR) and Thailand's PDPA:

• Consent: When you create an account, enable push notifications, submit advertisements, or voluntarily provide personal data.
• Legitimate Interest: For platform security, fraud prevention, content moderation, and maintaining the educational environment.
• Contractual Necessity: To fulfill our obligations in providing the platform services to you and your institution.
• Legal Obligation: When required to retain records for school administration, audit, or regulatory compliance.

5. Data Storage and Security

• All data is stored in Google Cloud Firestore with security rules that restrict access based on user roles.
• Data in transit is encrypted via HTTPS/TLS.
• We apply data minimization — we collect only the information necessary to provide platform functionality.
• Administrative actions are logged in an audit trail for security monitoring.
• We employ content moderation tools including automated profanity filtering on user inputs.
• We do not sell, trade, or rent your personal information to third parties.

6. Data Retention

• Account Data: Retained for the duration of your enrollment or employment at the institution.
• Announcements & Homework: May be auto-archived after a configurable period (default: 7 days) set by administrators.
• Ad Listings: Expire after the purchased duration (1, 3, 7, 14, or 30 days) and may be removed by administrators.
• Chat Messages: Retained indefinitely unless deleted by administrators.
• Audit Logs: Retained for administrative review and are accessible only by administrators.
• FCM Tokens: Deleted when you disable notifications or clear your browser data.
• Push Notification Tokens: Automatically cleaned up when browsers report invalid tokens.

7. Your Rights

Under applicable data protection laws including the GDPR and PDPA, you have the following rights:

• Right of Access: You may request a copy of all personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data for direct marketing or other purposes based on legitimate interest.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decision-Making: We do not use automated decision-making or profiling that produces legal effects on you.

To exercise any of these rights, please contact the administrator. We will respond to your request within 30 days.

8. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and other countries where Google Firebase, Cloudflare, and other third-party service providers operate. These countries may have different data protection laws than your jurisdiction.

• We ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms provided by our third-party processors.
• Google LLC is certified under the EU-U.S. Data Privacy Framework.
• By using the platform, you acknowledge and consent to such transfers as necessary to provide the service.

9. Cookies and Local Storage

We utilize browser local storage to enhance your experience by persisting:

• Theme preferences (light/dark mode)
• Authentication sessions
• Search history and filter state
• Announcement reaction state (per device)
• Study timer settings
• Service worker cache for offline access
• What's New modal dismissal state

We use Google Analytics (GA4) to collect anonymized usage data such as page views and session duration. Google Analytics does not use advertising cookies or cross-site tracking on this platform. We do not use DoubleClick or any third-party advertising trackers.

10. Children's Privacy

MyClassHub is designed for use within educational institutions. Users under the age of 18 should use the platform under the supervision of their school or educational institution. We do not knowingly collect information from children outside the educational context.

11. Content Moderation and Filtering

• All user-generated text inputs are automatically screened through a profanity filter.
• Administrators may review, edit, or remove any content posted on the platform.
• Users who violate community guidelines may be banned from the platform.
• Advertisement submissions undergo admin review before being displayed publicly.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by the GDPR.
• Notify affected users without undue delay when the breach is likely to result in a high risk to your rights and freedoms.
• Document the breach, its effects, and the remedial actions taken.

13. Changes to this Privacy Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by updating the "Last Updated" date and announcing changes through the platform's What's New feature.

14. Data Protection Compliance

MyClassHub is designed to comply with applicable data protection laws, including:

• EU General Data Protection Regulation (GDPR) — for users within the European Economic Area (EEA).
• Thailand's Personal Data Protection Act (PDPA) — for users within Thailand.

We are committed to processing personal data lawfully, fairly, and transparently. Where required by law, we obtain appropriate consent before collecting or processing personal data, and we honor your rights under applicable data protection legislation.

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with a supervisory authority. For EU/EEA users, this includes the data protection authority in your member state. For Thai users, this includes the Personal Data Protection Committee under the PDPA.

15. Contact Us

If you have questions, concerns, or requests regarding your privacy or this policy, please contact the administrator via:

• The internal support chat system on MyClassHub
• The Contact Admin page at /contact
• Email: apiwish.boon@gmail.com