Privacy Policy - EDU360 Mobile CBT
Last updated: April 25, 2026
EDU360 Online ("we", "us", or "our") operates the EDU360 Mobile CBT mobile application (the "App") on iOS and Android. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. It applies to all users of the App on both platforms.
At a glance
- We collect only the data needed to authenticate you and deliver exams assigned by your educational institution.
- We do not use any advertising, analytics, crash-reporting, or tracking SDKs.
- We do not track you across other apps or websites. No use of Apple's App Tracking Transparency (ATT) is required and the App will not display the ATT prompt.
- All exam data on your device is encrypted; all data in transit uses HTTPS/TLS.
- You can request deletion of your account and your data at any time (see Section 9).
1. Information We Collect
1.1 Account Information
When you log in, we process:
- Student ID (Kode Siswa) – provided by your educational institution
- Full name – as registered by your institution
- Email address – for account identification and support contact
- Profile photo – only if you choose to upload one
1.2 Exam Data
During exam sessions, we collect:
- Answers and selections – your responses to exam questions
- Navigation and timing data – which questions you visited and time spent
- Doubt markers – questions you flagged for review
- Submission timestamps – when answers were saved and synced
1.3 Device Information
For security and exam integrity (account-to-device binding), we collect:
- Device identifier – a unique ID derived from your device. On iOS this is a vendor-specific identifier (identifierForVendor) that resets if you uninstall the App; on Android it is derived from non-resettable hardware attributes. This identifier is not Apple's IDFA and is not Google's Advertising ID.
- Platform and OS version – e.g., "iOS 18.2" or "Android 14", used for compatibility and troubleshooting
1.4 Security and Integrity Data
To maintain exam integrity, we may detect and log:
- App-switching events during active exams
- Network connectivity changes during exams
- Idle periods during exams
- Device security status – jailbreak / root and emulator detection. These checks are evaluated locally on the device; only the boolean result (compromised: yes / no) is logged with your exam session, never raw device fingerprint data.
1.5 Information We Do NOT Collect
We do not collect, request, or access:
- Location data of any kind (no GPS, no Wi-Fi or cellular triangulation)
- Microphone audio
- Camera input (except when you actively pick or take a profile photo)
- Contacts, calendar, full photo library, health, or financial data
- Browsing history, search history, SMS, or call logs
- Apple's IDFA or Google's Advertising ID
- Crash diagnostics, performance traces, or behavioral analytics
2. How We Use Your Information
We use your information exclusively for the following App Functionality purposes:
- Authenticating your identity and managing your exam session
- Delivering exam content and recording your answers
- Syncing exam data between your device and our servers
- Ensuring exam integrity through the security monitoring described in Section 1.4
- Displaying results including scores, rankings, and answer reviews
- Sending local notifications to remind you about unsynced answers (scheduled on-device; we do not operate a push-notification server)
We do not use your data for advertising, marketing, profiling, behavioral analytics, or product personalization.
3. Data Storage and Security
3.1 On-Device Storage
- Exam data stored on your device is encrypted using SQLCipher (AES-256)
- Encryption keys are stored in the platform secure store: iOS Keychain on iOS and Android Keystore on Android, inaccessible to other apps
- Local data is wiped on logout and when a different user logs in
3.2 Data in Transit
- All communication with our servers uses HTTPS/TLS encryption
- Authentication uses HTTP-only session cookies issued by our servers
3.3 Server Storage and Retention
- Exam data is stored on our servers only as long as required by your educational institution to deliver exams, calculate results, and provide review
- Account data is retained while your account remains active with your institution
- On a verified deletion request we remove personal data from production systems within 30 days; encrypted backups containing your data are overwritten within 90 days
4. Data Sharing
We do not sell, rent, trade, or share your personal data with third parties for marketing or any commercial purpose. The only exceptions are:
- Your educational institution – exam results and participation data are shared with the institution that administers the exam, as this is the core purpose of the App
- Hosting infrastructure – our servers run on Linode (a subsidiary of Akamai Technologies). They process data only as necessary to host the service and are contractually bound to confidentiality and equivalent data-protection standards.
- Legal requirements – if required by law, court order, or valid legal process
5. Third-Party SDKs and App Tracking Transparency
The App does not include or integrate with:
- Advertising networks or ad SDKs
- Analytics SDKs (e.g., Google Analytics, Firebase Analytics, Mixpanel, Amplitude)
- Crash-reporting SDKs (e.g., Crashlytics, Sentry, Bugsnag)
- Social-media SDKs or third-party login providers
- Any third-party data broker
Apple App Tracking Transparency (ATT): The App does not engage in "tracking" as defined by Apple's App Tracking Transparency framework. We do not link user or device data collected from this App with data collected by other companies' apps, websites, or offline properties for advertising or measurement, and we do not share user or device data with data brokers. Accordingly, the App does not display the ATT permission prompt.
6. Permissions
The App requests only the minimum permissions needed to function.
iOS
- Notifications – local reminders about unsynced exam answers; you may deny this and the App will continue to work
- Photo Library / Camera – requested only when you choose to upload a profile photo
Android
- Internet – required for login, exam sync, and data transfer
- Notifications (POST_NOTIFICATIONS) – local reminders about unsynced exam answers; you may deny this
- Boot Completed (RECEIVE_BOOT_COMPLETED) – so pending answer reminders survive device restarts
- Camera / Photos – requested only when you choose to upload a profile photo
The App does not request access to location, microphone, contacts, the full photo library, phone state, SMS, or call logs.
7. Data Linkage and Tracking
All data described in Section 1 is linked to your identity (your authenticated student account), because the entire purpose of the App is to attribute exam results to a specific student. None of this data is used for tracking purposes as defined in Section 5.
8. Children's Privacy
This App is designed for students aged 13 and above and is intended for use as part of an institutional examination program. We do not knowingly collect personal information directly from children under 13. Where required by law, the educational institution administering the exam is responsible for obtaining the necessary parental or guardian consent before provisioning a student account. If you believe a child under 13 has provided us with personal data, please contact us so we can delete it.
9. Account Deletion and Your Rights
Accounts in the App are provisioned by your educational institution; the App itself does not offer self-registration.
You have the right to:
- Access your exam data through the App (results, rankings, answer reviews)
- Correct inaccurate account information through your institution
- Request deletion of your account and associated personal data
- Withdraw consent by ceasing use of the App and submitting a deletion request
- Deny permissions – you can use the App without granting notification, photo, or camera permissions
- Lodge a complaint with your local data-protection authority where applicable
9.1 How to Request Account Deletion
You may request deletion of your account and associated data through either of the following channels:
- Contact your educational institution's administrator, or
- Email us at support@edu360online.com with the subject line "Account Deletion Request" and include your Student ID, full name, and the institution you are enrolled in. We will verify your identity and process the deletion within 30 days. Encrypted backups containing your data are overwritten within 90 days.
On logout, all locally cached exam data, questions, answers, and credentials are deleted from the device immediately.
10. International Users
The App is operated from Indonesia. By using the App, you understand that your personal data will be processed in the country where our servers and operations are located. We honour applicable data-protection rights under Indonesian law (UU PDP), the EU/UK GDPR, and the California Consumer Privacy Act (CCPA) where they apply, including rights of access, correction, portability, and deletion.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted within the App and on our website with a new "Last updated" date at the top. Your continued use of the App after a change indicates your acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy, would like to exercise any of your rights, or wish to request account deletion: