ASA Explorer — Privacy Policy
ASA Explorer (“the app”) is a private, staff-only companion application for Austin Spanish Academy (“ASA”, “we”, “us”), published on the app stores by ASA Creations. It is provided to ASA teachers and administrators for internal operational use and is not intended for the general public or for students.
Who can use the app
Access is restricted to Austin Spanish Academy staff. Sign-in requires a Google account on the @austinspanishacademy.co Google Workspace domain; accounts outside this domain cannot sign in.
Information we collect
Account information. When a staff member signs in with Google, we receive their name, email address, and profile photo from their @austinspanishacademy.co Google account, used to identify them within the app.
Email content and metadata. ASA Explorer includes an email client for the staff member’s ASA Google Workspace mailbox. With their Google authorisation, the app reads, searches, composes, sends, and organises messages in that mailbox, including message bodies, subjects, sender and recipient addresses, timestamps, labels, and attachments. ASA does not operate a mail server, and the app does not copy your mailbox to our servers. When you read, search, or send mail in the app, messages are fetched directly from Google’s Gmail service to your device, and messages you send are delivered through your own Gmail account. One optional feature is an exception — see “New-mail notifications” below.
New-mail notifications (optional, off by default). If you turn on “Notify me when new email arrives”, you grant ASA’s server standing permission to check your mailbox for new messages on your behalf and deliver a preview of each one to your device. To do this, ASA’s server holds a Google credential that lets it read your mail, and it checks on a schedule even when the app is closed. The preview it creates — sender, subject, and the first line of the message — is stored briefly in ASA’s database only for as long as it takes to deliver the notification. Turning the feature off ends this.
Access to a colleague’s mailbox (administrators only). An ASA administrator may add a second staff mailbox to their own device — for example a shared departmental account, or the account of a staff member who has left. Doing so requires signing in to that mailbox with its own Google credentials, and the same mail features and protections described here then apply to it.
Email stored on your device. So that mail is readable offline, recently accessed messages — sender, recipients, subject, body, and labels — are cached in an encrypted database on your own device, with the key held in the device’s secure keystore. Attachment contents are not cached; attachments are downloaded from Gmail when you open them. Messages composed while offline are held in an on-device outbox until the device reconnects. This cache stays on the device and is erased when you sign out or uninstall the app.
Biometric app lock. If enabled, unlocking uses your device’s own biometric system (Face ID, Touch ID, or Android fingerprint). Biometric data never leaves the device and is never transmitted to or accessible by us; the app only receives a yes/no result from the operating system.
AI drafting assistant. You may optionally ask the app to draft or revise an email reply. When you do, the message being replied to and your instructions are transmitted over an encrypted connection to an ASA-operated service, which sends them to Anthropic’s Claude to generate suggested wording and returns the draft to the app. This happens only when you explicitly request a draft — it is never automatic, and no message is sent for drafting unless you ask. Anthropic processes that content under its own terms. We do not sell this content and we do not use it for advertising or profiling.
Photos, camera, and files. If you choose to attach an image to an email, the app requests access to your photo library or camera at that moment and for that purpose only. You may also attach a document or other file, in which case the app shows the operating system’s file picker. The app does not scan, browse, or index your photo library or device storage — only the specific item you select is attached to the message you are composing. Access may be declined, and the rest of the app continues to work.
Operational data entered by staff. Class schedules and details, class rosters, class notes, attendance records, payroll hours, and the staff directory. Class records include each enrolled student’s name and a parent or guardian contact email; for classes taught in person at a student’s home, they also include a phone number and home address, which the teacher needs in order to travel there. Class notes are free-text messages exchanged between administrators and teachers about a class, and may incidentally mention a student.
Device identifiers. If you enable notifications, the app registers a push-notification token for your device and stores it against your email address so notifications can be routed to you. The app also carries an installation identifier used to deliver software updates.
Diagnostics (optional, off by default). The app does not collect crash reports or performance data in the background. If you turn on “Share diagnostics” in Settings while reproducing a problem, the app streams technical events to ASA’s database so support can watch what is happening. These records are redacted — no message contents, email addresses, passwords, tokens, or student information — and each is associated with your email address so support knows whose session it is. It stops automatically after about two hours.
The app does not collect location data, contacts, or advertising identifiers, and it contains no advertising.
How we use information
Information is used solely to operate the app for ASA staff: to display schedules and class information, to send and receive your ASA email, to enable class notes, attendance and payroll, to show the staff directory, to produce email drafts you have asked for, to send notifications you have opted into, and to diagnose problems you have asked us to look at. We do not use it for advertising or profiling, and we do not sell it.
How information is stored and protected
Operational data is stored in ASA’s Supabase database. Access is controlled by row-level security and the staff-domain sign-in gate. Student and parent contact details are restricted at the database itself: administrators can see them, and a teacher sees a student’s phone number and home address only for an in-person class taught at that address.
Cached email and the outbox are stored in an encrypted database on your own device, with the key held in the device’s secure keystore; sign-in credentials are held in the same secure keystore. Some other information the app keeps on the device for speed — such as a copy of the staff directory — is stored in ordinary app storage, protected by the operating system’s own app sandboxing and device encryption rather than by a separate key.
All data is encrypted in transit (HTTPS/TLS). Push notifications are delivered via Google and Apple push services and the Expo push service. Images hosted on other companies’ servers are blocked by default when you read a message, because loading them can tell the sender that the message was opened; you can choose “Show images” for an individual message. The app also periodically checks an ASA-operated server for software updates; that request identifies only the app version and platform, contains no personal information, and updates are cryptographically signed.
How to request deletion of your data
To request deletion of your ASA Explorer account and the personal information associated with it, email admin@austinspanishacademy.co from your ASA address, or write to Austin Spanish Academy, Austin, Texas, USA. We will confirm and action the request. You can remove the data the app keeps on your device at any time by signing out or uninstalling the app.
Signing out ends the app session and erases the on-device cache. If you have enabled new-mail notifications, sign-out does not by itself revoke the credential ASA’s server holds — turn the feature off, or revoke the app’s access in your Google Account settings, to end that access.
Sharing
We do not sell personal information, and we do not share it with third parties for their own purposes. Data is processed only by the service providers that operate the app on ASA’s behalf: Google (Workspace and Gmail, which already host your mailbox), Supabase (database), Anthropic (the AI drafting assistant described above), and Google, Apple and Expo (push notification delivery), each under their respective terms.
Google API Services disclosure
ASA Explorer’s use of information received from Google APIs — including Gmail — adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the mail features described in this policy to the signed-in staff member; we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and de-identified.
The app requests the following Google permissions: openid, email and profile to identify the signed-in staff member; gmail.modify to read and organise mail in the mailbox; gmail.send to send the messages you compose; and, only if you enable new-mail notifications, gmail.readonly so that ASA’s server can check the mailbox for new messages as described above.
Data retention
Operational data is retained while it is needed for ASA’s operations. Your access ends when your ASA Google account is deactivated.
Children and students
ASA Explorer is a staff tool. It is not directed to children, is not offered to students or parents, and no student or parent can sign in — sign-in is restricted to @austinspanishacademy.co staff accounts. The app does, however, hold information about students that ASA staff enter in order to teach their classes, as described under “Operational data entered by staff” above. That information is visible only to ASA administrators and to the teacher of the class concerned, and is handled under this policy. Parents and guardians may contact us at the address below with any question about their child’s information.
Changes to this policy
We may update this policy; material changes will be reflected by the “Last updated” date above.
Contact
Questions or data requests: admin@austinspanishacademy.co, Austin Spanish Academy, Austin, Texas, USA.