Privacy Policy

• Your study data lives on your device. When you sign in, we back it up to your account so you can get it back on another device.
• We don’t sell your data, and there are no ads in Iskotify.
• A few outside services help run Iskotify, such as our database, sign-in and hosting. Each one gets only what it needs.
• You can ask to see, correct, download or delete your data. Just email teamocsph@gmail.com.
• The Data Privacy Act of 2012 protects you. If you think we’ve mishandled your data, you can complain to the National Privacy Commission.

Iskotify is a study app for Filipino students getting ready for college entrance exams and scholarships. In this policy, “we” and “us” means Online Creative Solutions, who runs the Iskotify app and website.

Online Creative Solutions is responsible for your personal data in Iskotify. Under the Data Privacy Act, that makes us the “personal information controller”.

This policy covers the Iskotify app, on your phone or on the web, and the Iskotify website. It follows the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

We only collect what Iskotify needs to work. Here is the full list.

• Your account. Your email address and password if you sign up with email, or your Google account’s email, name and profile picture if you sign in with Google. Your password is stored scrambled (hashed), so no one on our team can read it.
• Your profile. Your name, school, grade level, target exams and target courses, and the region your school is in. You give us these when you set up the app.
• Scholarship and score details (optional). Your family’s income bracket, your GWA, your province, your Grade 8 to 11 grades, your school type, your target campus, and whether you belong to an Indigenous community. We collect your grades, GWA, income bracket and Indigenous community only if you turn on sharing them, which is off until you choose. You can leave all of these blank.
• Your study activity. Your answers and scores, practice sessions, flashcard review schedule, saved decks, focus list, study plan, the scholarship requirements you tick off, your notes and note reminders, and your app settings, like your reminder time and focus mode.
• Things you send us. Bug reports (what you wrote, which part of the app, whether you’re on Android, iOS or the web, the app version, and a screenshot if you attach one), app feedback and star ratings, reports about a question (the question and your reason), and suggested date corrections (the date, your note and your source link). If you’re signed in, these are linked to your account.
• Search words. When you look for your school and it isn’t on our list, the school name you typed. Scholarship searches are ranked on your phone by keywords, so the words you type there stay on your phone and are never sent to an AI provider.
• Usage analytics. When analytics is switched on, we record when you open the app, which screens you visit, and a few actions, like finishing a practice session or adding an exam to your focus list. On the web, clicks are recorded too. If you’re signed in, this is linked to your account ID only, never your email address or name. Our analytics service also collects basic device details, like your device type and a rough location based on your IP address.
• Early access sign-ups. If you sign up for early access on our website, your name, email address, school and grade level.
• Purchases. If you buy Iskotify Full Access: whether your account has it, and a record of the purchase (where you bought it, the amount, the date and the payment reference). Your card or wallet details go to the payment service, not to us.

Some of this, like your grades and whether you belong to an Indigenous community, counts as sensitive personal information under the Data Privacy Act. We use it only for the features it powers.

When you sign up, we ask whether you’re 18 or older or under 18. We don’t ask for your birthday, phone number, home address or any ID, and Iskotify doesn’t use your phone’s GPS.

• To run the app: track your progress, plan your study and remind you to practice.
• To back up your data when you sign in, so you can restore it on another device.
• To match you with scholarships and to work out your Estimated Admission Score. The score is calculated on your device.
• To fix bugs, check the questions and dates you report, and read your feedback.
• To show better search results.
• To see which features students use, so we know what to improve (only when analytics is on).
• To email you the early access download link, if you signed up for it.

We don’t sell your data, and we don’t use it for ads.

The Data Privacy Act only lets us use your data for a reason it allows (Section 12, and Section 13 for sensitive personal information). Here is our reason for each use:

• Running the app and backing up your data: needed to provide the service you signed up for (Section 12(b)).
• Your grades, GWA, income bracket, Indigenous community and school records: only with your separate consent, which you give by turning on sharing them (Section 13(a)). It’s off until you choose, and you can withdraw it at any time.
• Usage analytics: your consent (Section 12(a)). If you’re under 18, analytics stays off unless you turn it on. If you’re 18 or older, it’s on when you finish signing up and you can turn it off at any time. Nothing is recorded before you make this choice.
• Early access sign-ups: your consent, when you fill in the form (Section 12(a)).
• Purchases and their records: needed to give you what you bought (Section 12(b)), and keeping purchase records is a legal obligation under tax law (Section 12(c)).
• Bug reports, feedback, question reports, date suggestions, and stopping spam and abuse: our legitimate interest in keeping Iskotify working, accurate and safe (Section 12(f)). We use only what we need for this.
• When the law requires it: to meet a legal obligation, like a valid court order (Section 12(c)).

• On your device. Your study data is saved in the app on your phone, or in your browser’s storage on the web. Iskotify doesn’t add its own encryption to it, so a screen lock helps keep it private. The app keeps only your latest 5,000 answers.
• In your backup. When you’re signed in, a copy of your profile, settings, study activity and notes is saved to your account on Supabase, our database provider. Only your account can read it through the app. A few people on our team can reach the database to keep it running.
• Things you send us. These are saved in the same database. A screenshot you attach to a bug report is kept in private storage, and only our team can view it.

Some of the services we use have servers outside the Philippines, so your data may be sent abroad. The next section lists each one and where it is. We choose services that protect data carefully, but no system is perfectly secure.

If a breach puts your data at risk, we’ll notify the National Privacy Commission and the affected users, as the law requires.

We don’t sell or rent your data. We share it only with the services that help run Iskotify, and each one gets only what it needs:

• Supabase stores our database and files, runs sign-in, and sends sign-in emails like password resets.
• Vercel hosts the Iskotify website and web app, and runs the small server that passes school-name lookups to Google Places. Servers: United States.
• Google handles Google sign-in if you choose it. Google Places looks up a school name you type that isn’t on our list. Servers: United States.
• Have I Been Pwned helps check whether a new password has shown up in a known data leak. When you create or reset a password, the app scrambles it on your device into a code (a SHA-1 hash) and sends only the first 5 characters of that code to the Pwned Passwords service (api.pwnedpasswords.com). Your password and the full code never leave your device, so this service gets nothing that identifies you.
• PostHog runs our usage analytics, when analytics is switched on. Servers: United States.
• Expo delivers app updates to your phone. Servers: United States.
• Resend sends early access emails, so it gets your name and email address. Servers: United States.
• Upstash briefly keeps your IP address to stop spam on some forms and searches. It’s deleted automatically within about an hour.
• RevenueCat manages Iskotify Full Access bought in the Android app. It receives your Iskotify account ID and your Google Play purchase details. Servers: United States.
• PayMongo processes web payments for Iskotify Full Access. It receives the payment details you enter on its page. Servers: Philippines.
• Google Play handles in-app payments in the Android app, under Google’s privacy policy.

We use service agreements requiring these providers to protect your data.

Some practice questions, answer choices and explanations are drafted with the help of AI tools by our team and checked before they reach the app. Nothing you type or do in the app is sent to those tools. If an explanation looks wrong or inappropriate, use Report on the question.

Our team, including the content staff who help us check questions and dates, can see the reports, suggestions and feedback you send.

We may also share data if the law requires it, for example because of a valid court order.

• On your device: until you clear it, reset the app or uninstall it.
• Your account and backup: until you delete your account (in the app, or by emailing us).
• Bug reports and their screenshots: 12 months after we close the report, then deleted.
• Feedback, question reports and date suggestions: 12 months after you send them, then deleted.
• Analytics: 12 months in PostHog, then deleted automatically. We can delete what’s linked to you sooner if you ask.
• Early access sign-ups: until 6 months after Iskotify launches publicly, or sooner if you ask us to remove them.
• Purchase records: kept for as long as tax law requires. When you delete your account, they’re unlinked from you.
• When you delete your account: your account, your backup, and the reports, feedback and suggestions you sent us are deleted at the same time, even if the periods above haven’t ended. Purchase records are kept, unlinked from you, as above.

Things you can do yourself in the app:

• Skip optional details. Scholarship and score details are optional.
• Withdraw consent. To stop sharing your grades, GWA, income bracket and Indigenous community, go to Profile, then Scholarship info, and tap Withdraw consent and clear these details. This also clears those details from the app and your backup. To turn analytics off, go to Settings, then Privacy. Withdrawing doesn’t affect what we did with your consent before.
• Turn off reminders. Go to Settings, then Notifications, or use your phone’s settings.
• Download your data. Go to Profile, then Your data, then Export Data. This saves a file with your settings, focus list, saved decks, progress, practice sessions, answer history, flashcard schedule, study plan, and notes with their labels. It doesn’t include the reports and feedback you sent us or your analytics; email us for a copy of those.
• Clear your data from a device. On the web, Clear data & sign out (in Profile, under Your data) removes everything Iskotify saved in that browser. On a phone, Reset App Data removes all your study data from that phone (your progress, answer history, flashcard reviews, study plan, focus list and settings) but keeps your notes; you can delete them in Notes. Uninstalling the app removes everything. Neither one deletes your account or your backup.

Delete your account. Go to Profile, then Your data, then Delete account, and type DELETE to confirm. This permanently deletes your login, your backup, and the bug reports (with their screenshots), feedback, question reports and date suggestions you sent us. It can’t be undone, and we keep nothing about you afterwards except where the law requires it: records of any purchase, which tax law requires us to keep, unlinked from you. Your notes and study data on that phone stay until you clear them. Can’t open the app? Go to iskotify.ph/delete-account, or email teamocsph@gmail.com with the subject Delete my Iskotify account, from the email address on your account. We’ll confirm it’s you and delete everything within 7 days. Analytics we keep in PostHog isn’t removed by the button; email us and we’ll delete what’s linked to you.

Under the Data Privacy Act, you have the right to:

• Be informed about how your data is collected and used. That’s what this policy is for.
• Access your data and get a copy of it.
• Object to how we use your data, including uses based on our legitimate interest.
• Withdraw consent you gave us, at any time (see above for how).
• Erasure or blocking: ask us to delete your data or stop using it.
• Rectification: ask us to correct data that’s wrong.
• Data portability: get your data in a format you can take elsewhere.
• Damages: be compensated if you’re harmed because your data was wrong, or used without permission.

To use any of these rights, email us. If you think we’ve mishandled your data, please tell us first so we can fix it. You can also file a complaint with the National Privacy Commission at privacy.gov.ph.

Iskotify is made for students getting ready for college, so many of our users are in senior high school and some are under 18.

When you sign up, we ask whether you’re 18 or older or under 18. If you’re under 18, you confirm that a parent or guardian has agreed to you using Iskotify, and to this policy and our terms. Please read this policy with them.

If you’re under 18, we collect your grades, GWA, income bracket and Indigenous community only if you turn on sharing them, and analytics stays off unless you turn it on. Talk to your parent or guardian before you turn either on.

Parents and guardians can email us to see, correct or delete their child’s data. Iskotify isn’t for children under 13. If we learn we have data from a child under 13, we’ll delete it.

We’ll update this policy when Iskotify changes how it handles your data. We’ll post the new version here and in the app, with a new date at the top. If a change is big, we’ll point it out in the app.

Questions, requests or worries about your data? Email us. Please use the email address on your Iskotify account so we can find your data.

teamocsph@gmail.com

You can also write to our Data Protection Officer:

• Email: teamocsph@gmail.com
• Address: Online Creative Solutions, Philippines