Privacy Policy — Valley School App

Effective date: May 14, 2026

This Privacy Policy explains how Avayla, Inc. (“Avayla,” “we,” “us,” or “our”) handles information in connection with the Valley School mobile application (the “App”). The App is published by Avayla and is intended for use by parents of students enrolled at Valley School.

Avayla, Inc. is a California corporation. The App is not affiliated with, owned by, or operated by Valley School or Veracross.

1. Who this app is for

The App is intended for parents and guardians of Valley School students. It is not directed to children under 13, and we do not knowingly collect information from children under 13. If you believe a child under 13 has used the App, please contact us at the address below and we will take appropriate steps.

2. Information we collect

We have designed the App to collect as little information as possible. Specifically:

a. Information we do not collect

• We do not collect your name, email address, phone number, mailing address, or other personally identifiable information (“PII”).
• We do not collect contacts, photos, location, microphone, camera, or health data.
• We do not use third-party advertising networks or third-party analytics providers.
• We do not sell or share your personal information for cross-context behavioral advertising.

b. Information we do collect

Authentication data. The App allows you to sign in using your existing Veracross account, which you configure through the Valley School online portal. Authentication is handled by Veracross. When you sign in, the App receives an authentication token that allows it to access information from Veracross on your behalf. We do not store the username or password for your Veracross account, and we do not retain personal information from your Veracross account on our servers beyond what is technically necessary for the App to function during your session.

Your use of Veracross is governed by Veracross’s own privacy policy, available at https://www.veracross.com/privacy-policy/.

Self-hosted analytics. We operate our own analytics infrastructure (we do not use Google Analytics, Firebase, Mixpanel, or similar third-party services). The analytics data we collect is limited to non-identifying information such as:

• App screens or features used
• App version, operating system, and device type
• Session timestamps and duration
• A non-personal device identifier used solely to distinguish one installation from another

Self-hosted crash logs. When the App crashes or encounters an error, we collect diagnostic information to help us fix the problem. This may include:

• The type of error and a stack trace
• App version, operating system version, and device model
• A non-personal device identifier

We do not link any of the above information to your name, email, or other personal identifiers.

3. How we use information

We use the limited information described above to:

• Authenticate you to Veracross so the App can display your information
• Operate, maintain, and improve the App
• Diagnose and fix crashes, bugs, and performance issues
• Understand which features are used so we can prioritize improvements
• Comply with applicable law

We do not use your information for advertising, profiling, or sale.

4. How we share information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We may share limited information only in the following circumstances:

• With Veracross, as required to authenticate your session and retrieve information you have requested through the App.
• With service providers that help us host the App’s backend infrastructure, under contractual obligations to protect the information.
• If required by law, such as in response to a subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Avayla or others.
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this Privacy Policy or notify you of any changes.

5. Data retention

We retain analytics and crash log data only as long as needed for the purposes described above, and then delete or anonymize it. Authentication tokens are retained only for the duration of your session or as required by Veracross.

6. Security

We use reasonable administrative, technical, and physical safeguards to protect the limited information the App collects. No system is completely secure, however, and we cannot guarantee the absolute security of any information.

7. Your rights under California law (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share
• Delete personal information we have collected from you, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (note: we do not sell or share personal information)
• Limit the use of sensitive personal information (note: we do not collect sensitive personal information)
• Be free from discrimination for exercising your rights

To exercise any of these rights, contact us at [email protected]. We may need to verify your request before responding.

8. Geographic scope and data location

The App is available only in the United States. It is distributed exclusively through the U.S. App Store and is not available for download in any other country or region.

All data collected by the App is processed and stored on servers located in the United States. We do not transfer data to servers outside the United States.

9. Children’s privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it. Parents who believe their child has provided information to us may contact us at [email protected].

10. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” above and, if changes are material, we will provide additional notice (for example, through the App). Your continued use of the App after the effective date of an updated Policy constitutes your acceptance of the updated Policy.

11. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact: