Privacy Policy

1. Who we are

Krifak is provided by Olmo Technologies ("we", "us"), a sole-trader business based in Norway, which is the data controller under the General Data Protection Regulation (GDPR) for the limited data processed in connection with subscriptions and access codes, described in Section 2.

We do not receive or process the class and student data you enter in the app. See Section 3.

Contact: kontakt@krifak.no

2. What data Krifak handles

Data you enter, stored only on your device

Krifak stores the following on your device, in the app's own protected storage:

• Your name, used as the signature under term reports
• Classes, class schedules, topic plans, lesson plans, your own topics and fitness tests
• Students' first names, and optionally gender, an activity background, notes and a photo
• Attendance, lateness, goal attainment assessments, theory grades, test results, points and goals for the student
• Teams, roles, match results, fair play points and notes in season-based learning
• Your own assessment criteria and app settings

This data is never transmitted to us or to any server we operate. Krifak has no user accounts.

Photos, files and text recognition

You can take or pick a photo of a class list to import students' names. The text is recognised on the device, using Apple's Vision framework on iOS and Google ML Kit's on-device text recognition on Android. The photo and the recognised names are not sent anywhere, and the temporary image is deleted after import. On Android, ML Kit may send anonymous usage and performance metrics to Google. These metrics do not include the image or the recognised text. You can also import names from a file (Excel, CSV or text) or paste a list. The names are then read on the device as well. Student photos you add are stored only in the app's storage on your device.

Subscriptions and access codes

If you subscribe, the purchase is handled by Apple (App Store) or Google (Google Play). Krifak uses RevenueCat to confirm whether your subscription is active. RevenueCat receives an anonymous app user ID, your purchase receipt and basic device and app information, such as app version and platform. If you enter an access code, the code is used as your app user ID with RevenueCat. No student data is ever sent to RevenueCat.

What we do NOT collect

• Any class or student data you enter
• Location data
• Contacts
• Advertising identifiers
• Analytics, usage tracking or crash reports
• Card or bank details, which are handled only by Apple or Google

3. Who is responsible for student data

The student data in Krifak is entered and controlled by you. When you use Krifak as part of your work as a teacher, your school or school owner is normally the data controller for that data. When you use Krifak as a coach or activity leader, the club or organisation you coach or lead for is normally the data controller. The data controller is responsible for having a lawful basis for processing the data and for approving the tools that are used.

Because the data never leaves your device, we do not process it on behalf of you, your school or your club, and we have no access to it. We cannot view, recover or delete it for you.

To keep the data you store to a minimum, Krifak uses first names only, and the attendance status «Not participating» does not record a reason. Krifak is not designed for sensitive personal data. Do not record diagnoses, medical information, mental health conditions, medication use or other special categories of personal data, including in notes.

An information sheet for your school's data protection officer, describing what Krifak stores and where, is available in Norwegian: krifak.no/skole.

4. How data is used

Data stored on your device is used only to provide the app's features: recording attendance and assessment, making teams, running tournaments and seasons, tracking tests, setting goals for students and drafting term reports.

Subscription data is used only to unlock the features you have paid for or been given access to. The legal basis is the performance of the contract with you (GDPR Article 6(1)(b)).

We do not use any data for advertising, profiling or any purpose beyond operating the app.

5. Third-party services

Apple

On iOS, payments are handled by the App Store, and text recognition uses Apple's on-device Vision framework. Apple's data handling is governed by the Apple Privacy Policy.

Google

On Android, payments are handled by Google Play, and text recognition uses Google ML Kit on the device, as described in Section 2. Google's data handling is governed by the Google Privacy Policy.

RevenueCat

Krifak uses RevenueCat to validate purchases and manage subscription status. RevenueCat's data handling is governed by the RevenueCat Privacy Policy.

Your calendar

If you choose to add a lesson plan to your phone's calendar, Krifak writes the class name and the plan's topic, place, equipment and time to the phone's default calendar. If you move the lesson in the calendar, Krifak updates the time and place in the app. Your calendar provider, such as iCloud, Google or Outlook, may then sync it according to your own settings. You can also share upcoming plans as a calendar file with the same details. Student data is never added to the calendar.

No advertising or analytics

Krifak does not include any advertising, analytics, tracking or crash-reporting library.

6. Data storage and security

All class and student data is stored in the app's sandboxed storage on your device, protected by the operating system's standard data protection. Other apps cannot access it.

Krifak offers an app lock when you set up the app, and you can turn it on or off in Settings. With the app lock on, Krifak requires Face ID, a fingerprint or a four-digit PIN you choose to open. Biometric checks are handled by the operating system. Krifak never receives your fingerprint or face data.

Backups you export are encrypted with a password you choose. Without the password, the backup cannot be opened, not even by us. You decide where the backup file is stored. Reminders for lesson plans and notifications before lessons are scheduled locally on your device.

7. Your rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding personal data we hold about you:

• Right of access: you can request a copy of any personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete data we hold about you.
• Right to restriction: you can ask us to restrict processing in certain circumstances.
• Right to data portability: you can request your data in a structured, machine-readable format. The data you enter in Krifak can be exported at any time to an encrypted backup file from Settings. Student photos are not included in the backup.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

Because class and student data exists only on your device, requests about that data should be handled by you, your school or your club directly in the app. To exercise your rights regarding subscription data, contact us at kontakt@krifak.no. We will respond within 30 days.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet): www.datatilsynet.no.

8. Data retention and deletion

Lessons and lesson plans older than one year are deleted automatically. You can delete a student, a lesson or a whole class at any time in the app. Deleting a class also deletes its students and lessons. Deleting the app removes all data stored by Krifak on the device.

Subscription records are kept by Apple, Google and RevenueCat for as long as needed to provide the subscription and meet their legal obligations.

9. Children's privacy

Krifak is intended for teachers, coaches and activity leaders and is not directed at children. Students do not use the app. The student data you enter may concern minors, which is why it is kept on your device only and never collected by us.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you within the app.

11. Contact us

If you have any questions about this Privacy Policy or how data is handled, please contact:

Krifak
Norway
kontakt@krifak.no