This policy explains what the Carbon mobile apps ("Carbon Students" for students, and "Carbon" for teachers and training-center staff) collect from you, why, where it is kept, what stays on your phone, and what rights you have. The app is the Carbon web system on a phone, so everything here matches the web privacy policy, plus a few points that apply only to the phone.
1Who is responsible for your data
The training center you enrolled with is responsible for its own students’ data. The Carbon platform provides the system to that center and stores the data on the center’s behalf. For any question, contact your center first.
2What we collect
- Account: name, email and password (the password is stored hashed by Google Firebase; we never see it). If you sign in with Google, Google gives us only your name, email and profile picture.
- Optional: phone number, profile photo, short bio, and a guardian’s name and phone for students under 18.
- Learning: the courses and classes you belong to, lesson progress, grades, attendance, homework you submit (text, file, photo or recorded audio), questions under lessons, and messages exchanged with your teacher and center.
- Payment: the photo of the bank receipt you send to your center and the payment status (approved or pending). The app never asks for a card or bank number and no payment is made inside the app.
- Certificate: the official name you type at issuance, and your photo only if you explicitly allow it.
- Device: a push-notification token so we can send notifications, and the phone model, Android version and app version to diagnose crashes.
- Sign-ins: the IP address and a device summary of each sign-in, so you can spot an unfamiliar sign-in and sign out of all devices.
We do not collect your location, do not read your contacts, do not use the advertising ID, and show no advertising.
3Why we use it
Course and class enrollment, recording grades and attendance, submitting and marking homework, issuing verifiable certificates, the center’s accounting, sending learning notifications, and finding and fixing app crashes. Your data is never sold and never shared for advertising.
4Phone permissions the app asks for
Each permission is requested only when needed, and you may refuse:
- Camera and gallery: only when you upload a profile photo, a homework photo, a receipt photo or a certificate photo.
- Microphone: only when you record audio for homework.
- Notifications: for session reminders, grade results and teacher messages. Each category can be turned off in the app settings; no sounding notification is sent between 21:30 and 07:00 Kabul time.
5What stays on your phone
- Lessons and files you download for offline study are kept in the app’s private storage and scrambled with a key specific to your account, so another account on the same phone cannot open them.
- Your sign-in key is kept in the phone’s secure storage (SecureStore) and is erased when you sign out. Downloaded files remain after sign-out so they open again without re-downloading.
- You can erase all downloaded files at any time from the app settings (offline storage); uninstalling the app also erases them.
6Photo on the certificate
Adding a photo to the certificate is entirely optional and happens only with your explicit consent. At any time you can ask your center to remove it; the certificate is regenerated without the photo and its validity does not change.
7Students under 18
Training centers also have students aged 13 to 18. For these students:
- When registering in the app, a student under 18 confirms that a parent or guardian is aware of the registration; the guardian’s name and phone are optional.
- A parent or guardian can, through the center, view the student’s data or request account deletion.
- The app shows no advertising to any age group.
- The app is not designed for children under 13.
8How long we keep it
As long as your account is active. After account deletion your personal data is anonymized (name, email, phone, photo and private messages are erased), but payment records, certificate serial numbers and learning records (grades, attendance, homework) — without your name — remain in the center’s records, because the center’s accounting and the validity of already-issued certificates depend on them. Sign-in history is kept for up to 24 months for security incident review.
9Your rights
You can permanently delete your account at any time: inside the app (My account), from your profile page on carbon.af, or by sending a request to our support email. Full instructions are on the website’s "Delete account" page. You can also download a full copy of your data from your profile page on the website. If you are the only head of a center, another head must be assigned first.
10Who it is shared with
- Your training center: the teachers and managers of your own center see your learning data — just as they would in a physical classroom. Other centers see nothing about you.
- Google Firebase: for sign-in (Firebase Authentication) and push notifications (Firebase Cloud Messaging). Google processes this data only to provide these services.
- Carbon’s own server: crash reports (without name or email) and anonymous usage statistics go only to Carbon’s server and are not shared with any other company.
- Law: only when required by law.
All communication between the app and the server is encrypted over HTTPS.
11Contact
For any question about your data, contact your center or the Carbon platform at support@carbon.af.
12Changes to this policy
If this policy changes, the new version is published on this page with a new date.