1. Operator and scope
The Operator is Anatoliy Nikolaevich Roslyakov (Russian legal name: Росляков Анатолий Николаевич). Legal status, registration details where applicable and a postal contact address must be supplied before approval.
This policy covers this landing page, https://app.teachermate.ru and the TeacherMate mobile application. It does not govern independent processing by app stores, Telegram or calendar services selected by users.
2. Data, sources and purposes
- Account and login: email, one-time code, account identifier and session token; Telegram login involves a bot code and associated identifier, name and username. Profiles may contain an avatar URL. Purposes: account creation, access verification and communication.
- Students and groups: names or aliases, Telegram usernames, lesson prices, group names and membership; server responses may include student avatar URLs. Source: the teacher and associated profile. Purpose: lesson organisation.
- Lessons: dates, times, types, participants, descriptions, prices, payment marks, homework, deadlines and status. Purposes: schedules, homework and statistics. A paid mark is a user entry, not evidence of a bank transaction.
- Local data: session token, first-launch flag, language, interface preferences and technical caches. Purpose: preserving login and preferences.
- Technical information: network requests expose IP addresses and HTTP parameters to the server. Server log fields, retention and provider access require Operator confirmation.
- Support: sender contact and message content, used to answer requests and complaints.
Do not enter passwords, bank credentials, identity documents, health information or other special-category data. Avatars are not used for biometric identification. The reviewed client has no bank-card entry or document-upload form.
3. Lawful grounds and operations
Processing for accounts and core functions is necessary to enter into and perform the user agreement. Mandatory requests are handled under law. Account security and lawful claims require an appropriate lawful ground respecting individual rights. Additional processing requiring consent takes place only after separate, specific and informed consent.
Operations include collection, recording, organisation, accumulation, storage, correction, retrieval, use, disclosure to authorised recipients, restriction, erasure and destruction. Core processing is automated; support requests may be handled manually.
Visiting the page, accepting terms or granting an OS permission is not blanket consent. Data-processing consent is obtained separately from other confirmations. This policy does not authorise advertising, data sales, public disclosure or unspecified future purposes.
4. Students and minors
Teachers determine necessary student information, ensure a lawful basis, inform students and obtain a legal representative’s consent where required. Prefer aliases and minimum data. Public availability alone does not authorise uploading information.
When acting on a teacher’s instructions, the Operator follows the processing mandate in the Terms of Use. For its own purposes, including infrastructure security, it remains independently responsible. Operator duties are not transferred to users. A separate processing agreement must be signed before data is supplied where applicable law requires one.
The service is primarily intended for teachers. The reviewed version has no independent child-registration workflow with verified parental consent. Minors act within their legal capacity and with required representative involvement. Do not upload unnecessary child data.
The technical ability to create a record does not verify its lawful content or the basis for disclosing data. Users retain necessary evidence of lawful entry and assist with justified investigation of specific disputed records. If a lawful ground is missing, users stop the relevant processing and contact the Operator for restriction or deletion if they cannot act themselves. The Operator may take legally authorised protective measures on learning of a violation. Data-subject rights do not depend on the user meeting their duties.
5. Device permissions
Ordinary login does not require camera, microphone, location, contacts, photo-library or system-calendar access. Android uses INTERNET for API communication and ACCESS_NETWORK_STATE to detect connectivity. The merged build manifest also contains the internal DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION protecting internal receivers; it does not grant access to user files or sensors. Calendar access is requested when users choose to add a lesson to their device calendar:
- Android: READ_CALENDAR and WRITE_CALENDAR, with full access requested. This scope permits reading and writing, but the reviewed implementation creates events and does not import all calendar events to the server.
- iOS: usage descriptions cover ordinary, full and write-only access; the current code requests write-only. The dialog depends on OS version.
- Event data: title, start, end and description; these may contain user-entered student information.
You can refuse or revoke permission in OS settings. The core TeacherMate calendar remains available. External events may sync through your selected provider, such as Apple or Google. Editing or deleting a TeacherMate lesson does not guarantee changes to an external copy; check it separately.
6. Recipients and external services
Access is limited to necessary information for authorised persons, lawfully engaged service providers, user-selected integrations and lawful official requests. The Operator documents recipients, instructions and safeguards.
Telegram is involved in selected bot login and Telegram links; email is used for login codes and address linking. App Store and RuStore independently process page visits and installation. The Telegram support group may be public: never post codes, tokens or student data.
The reviewed code does not contain enabled advertising trackers or Sentry transmission initialisation; a dependency alone does not prove transmission. Server analytics, email delivery, hosting and file storage providers must be confirmed and disclosed before approval. This revision does not authorise selling data or advertising profiling.
7. Storage countries and transfers
The client repository does not establish hosting countries for databases, files, logs or backups, or identify infrastructure providers. These details require confirmation before approval. This document does not certify localisation or international-transfer compliance.
Collection of Russian citizen data is subject to applicable localisation requirements and restrictions under Article 18 of Federal Law No. 152-FZ. Cross-border transfers require Article 12 and other applicable safeguards, including necessary notices and protection assessments. Selecting an external service does not remove the Operator’s own duties. Where GDPR applies, its lawful grounds and transfer mechanisms are required; an English version does not certify GDPR compliance.
8. Retention and deletion
Account information and records remain during service use while needed for their purpose. When the purpose ends, a valid deletion request is received or consent is withdrawn, processing stops and data is destroyed within applicable statutory periods, unless another lawful ground permits limited retention. Records for legal obligations or specific claims are retained only to the necessary extent and for the necessary period.
Before approval, the Operator must establish and disclose maximum code, log and backup lifetimes and implement deletion across stores. Logging out removes the local token, not the server account. Uninstalling does not delete the account.
Submit a request using “Delete account” in settings or the contact email. See the personal data deletion page for instructions. External calendar events and third-party messages require separate removal.
When a request is submitted through the app, the account and associated personal data are deleted immediately after the user confirms the request. Requests sent to teachermate@yandex.ru are fulfilled within 30 calendar days of receipt. Any shorter deadline required by law applies.
Deletion is permanent: the account and deleted data cannot be restored. Before submitting a request, lawfully save any information you need.
If retaining particular records is mandatory by law, only the necessary information is kept for the legally required period with restricted processing. The reply explains any such exception and its legal ground. This does not permit restoring a deleted account. Deletion requirements cover relevant stores and backups subject to mandatory law; a deleted account is not restored from a backup to resume service use.
9. Rights and requests
Email teachermate@yandex.ru with the subject “Personal data”. You may request processing and recipient information, access, correction, restriction or deletion, withdraw consent and complain to Roskomnadzor or a court, subject to lawful exceptions. Identity checks must be proportionate; never send a login code or token.
Requests follow applicable statutory deadlines. Withdrawal does not invalidate earlier lawful processing or another lawful ground. Where GDPR applies, rights also include restriction, objection, portability and complaints to the competent supervisory authority. No decisions with legal effects solely through automated processing were identified in the reviewed service.
10. Landing page and local storage
This landing page has no registration, own authentication, advertising analytics or external fonts. Buttons lead to app.teachermate.ru. Its JavaScript does not write cookies or localStorage. Hosting configuration and technical logs require confirmation.
The application stores its token and preferences through SharedPreferences, using browser local storage on the web. Clearing browser/device storage may require a new login. Before optional trackers are added, information must be updated and consent obtained where required.
11. Security and incidents
The client uses HTTPS for its main API and an authorisation token. The Operator must implement legally required organisational and technical safeguards, confidentiality, access controls and incident response. No unverified database encryption at rest, audits or certification are claimed.
Following an incident, the Operator assesses effects, takes action and notifies authorities and affected people where and within the periods required by law. Users protect devices and email/Telegram access and report suspicious activity.
12. Changes
Revisions are published with a date and version. Material processing changes are communicated before they begin; separate fresh consent is obtained where necessary. Changes cannot retroactively create a lawful ground. Russian is the principal version; English is a translation. Mandatory rights remain unaffected.