How your inbox handles your information.

Your school-managed inbox address

When your school imports your roster, the system creates an inbox address in the form firstname.lastname.schoolcode@theschoolinbox.com. This address is permanent for as long as your child is enrolled. You log in with school-issued credentials; you may optionally link a Google or Microsoft account later from account settings.

What lands in your inbox

All school communications addressed to your inbox are aggregated: school broadcasts, class updates, teacher messages, and notices forwarded from external school systems. Inbound HTML email is sanitized server-side and rendered inside a sandboxed frame so that external scripts cannot run. External images are routed through a Skhoolar image proxy that neutralises tracking pixels — the original sender does not see your IP address, device, or read time.

Your school may also configure a catch-all parent account that receives email sent to addresses at your school that no longer match an active parent (for example, an address that was issued to a parent whose only child has left the school). The catch-all is configured by your school administrator and exists so legitimate mail from external systems does not bounce silently. If you are the designated catch-all, you may occasionally see email originally addressed to a former parent — your school office will tell you whether this applies to you.

Attachments

Attachments are stored encrypted in Cloudflare R2 and accessed only via expiring signed URLs (downloads expire after 5 minutes, uploads after 15 minutes). Attachments are scoped to your school and your account.

AI summary

Your inbox shows a daily AI summary of action items, upcoming events, and attendance notes. The summary is generated by Skhoolar’s AI service using only the minimum excerpt of your messages required to compose the summary. AI providers do not retain or train on your content. The summary is in English in V1; multilingual support is planned.

Direct messages and group chats

Direct messages are between a teacher and a parent only. Parent-to-parent direct messaging is not supported. Your school administrator can read direct messages for safeguarding purposes; every admin view is recorded in an audit log. Group chats are moderated; moderators can mute, pin, and delete messages, and the original content of any moderator-deleted message is preserved in the audit log.

How long we keep things

• Trash (0–30 days): messages you delete remain restorable from your trash.
• Hidden (30–365 days): deleted messages are hidden from your inbox but can be recovered by Skhoolar support at your school’s request.
• Hard delete (365+ days): messages and attachments are permanently removed from the database and from R2.
• Authentication events (sign-ins, password changes) are retained for 1–3 years for security auditing.
• Direct-message safeguarding audit logs are retained for the duration of your school’s contract plus two years.

Consent and how it is recorded

The first time you sign in, TheSchoolInbox records your acceptance of this notice and of Skhoolar’s consent management policy against the current policy version. The record stores the policy version, the time you signed in, and your IP address — it is the legal evidence that you were informed of how the service handles your information. If we publish a new version of the policy, you will be asked to re-affirm consent at your next sign-in.

Skhoolar’s consent management policy describes lawful basis, parental notice, re-consent on policy change, and how rights requests are triaged. Read it at skhoolar.com/policies/consent, or ask your school office for the version your school relies on.

Your rights

You can request a copy of your data, request correction of inaccurate data, or request deletion of your data (subject to your school’s retention policy and any safeguarding obligations). You can submit requests directly from your account settings, or send them to your school office — the school will coordinate with Skhoolar support to fulfil them.

Cookies

TheSchoolInbox uses only essential cookies: a short-lived access cookie for your signed-in session and a long-lived refresh cookie that allows you to stay signed in across visits. Both cookies are HTTP-only, secure, and same-site=lax. We do not set advertising or analytics cookies.

Contact

For questions about how your school uses TheSchoolInbox, contact your school office. For platform-level questions, contact Skhoolar at privacy@skhoolar.com.