Privacy

The pupil records inside Lekkol belong to the school that entered them. The school decides who is enrolled, what is written down, who may read it and how long it is kept.

Lekkol is the program the school runs, and it is made by ⁦Gandalfooli⁩. On an ordinary installation we hold no copy of anything and cannot reach the school’s database at all.

So a question about one child’s record is answered by the school, not by us.

No school fills in every field. What the software has room for is:

• Pupils — name, date of birth, sex, admission number, class, photograph, address, and the reason for leaving.
• Families — guardians’ names, relationship, phone numbers, and the pupils they are linked to.
• Health — blood group, allergies, medical notes, and an emergency contact.
• School life — attendance, marks, report-card remarks, conduct notes, follow-ups, library loans, canteen purchases.
• Money — fees charged, payments and receipts, discounts, and for staff their salary, advances and payslips.
• Staff — name, role, contact details, attendance, and a trail of what they did in the system.
• Messages sent between staff, and between staff and families.

On an ordinary Lekkol installation the whole school is a single database file on the school’s own computer. It is not on our servers, it does not cross the internet, and unplugging the router changes nothing.

Photographs, receipts and attached documents are kept inside that same file, so one copy of it is a copy of everything.

Lekkol sends nothing to us in order to run. There is no analytics, no advertising, no tracking, and no font, script or image fetched from another company while you use it.

Everyone who uses Lekkol has an account and a role, and the role decides which rooms open. A class teacher does not see the payroll; a bursar does not see conduct notes.

Health and emergency details sit behind a permission of their own, separate from the rest of the pupil’s record, because most staff have no reason to read them.

A family reaches only its own children, through a portal code the school issues and can withdraw.

Actions with consequences — money in and out, marks saved, health details changed, staff accounts opened or closed, a pupil deleted — are written to an audit trail carrying the name of whoever did them.

Nothing leaves on its own. There are three ways data can go elsewhere, and a person at the school starts all three:

• Cloud sync. If the school turns it on, records are pushed to a Lekkol hub so the school can restore them and use features that need a connection. It is off unless somebody configures it, and the hub is not yet running.
• Backups. The school makes its own backup files and chooses where to keep them. A backup is the entire school in plain form and is not encrypted — treat the memory stick the way you treat the record cupboard.
• WhatsApp. Where Lekkol offers to message a family it hands the message to WhatsApp on your own phone or computer. From that moment WhatsApp’s rules apply and not ours.

Lekkol deletes nothing by itself. Records stay until the school removes them, and a school usually has good reason to keep them for many years — a transcript asked for in 2040 is a real request.

Deleting certain records marks them as deleted rather than erasing the row, so that the deletion travels to every other copy of the school’s database instead of the record reappearing at the next sync.

A finished year can be sealed: its marks, attendance and payments become final, and further changes are refused.

Almost every person in this database is a child, and much of what is recorded about them — health, conduct, family circumstances, unpaid fees — would embarrass or endanger them in the wrong hands. That is the reason for the permissions above rather than an afterthought to them.

The rights that follow belong to the child and to those with parental responsibility, and they are exercised through the school: to see what is held, to have a mistake corrected, and to ask why something is kept at all.

Lekkol’s part is to make it possible for the school to answer, and to keep the number of people who can see any one field as small as the work allows.

Passwords are stored as one-way hashes and never in readable form, and repeated wrong guesses lock an account for a time.

Beyond that, an offline school’s security is physical. Whoever can use the computer can use whatever account is signed in on it, and whoever can copy the database file has the school. Lock the office, sign out, and keep backups where a stranger cannot reach them.

We do not claim the software cannot be broken into. Two known gaps are written here rather than hidden: backup files are not encrypted, and the desktop installer is not yet signed, so the operating system warns when it is opened.

A question about a particular child’s record goes to the school that holds it. A question about the software itself can come to us.

If this page changes in a way that matters, the date at the foot changes with it.

A lawyer must settle this: An address for reaching Lekkol about privacy has not been decided. Until one is published here, this page tells a family where not to write, which is not good enough.