1. Operator and scope
School Ride is a transportation management platform operated by YCode Solutions LLC, based in Florida, United States. This policy applies specifically to the School Ride Alexa Skill, its account-linking website, and the School Ride services used to answer Alexa requests.
The Skill is intended for parents and guardians who have an active School Ride account associated with a participating transportation company. It is not intended for direct use by children.
2. Information we receive
When you use the Skill, Amazon Alexa sends School Ride a structured request. Depending on the request, this may include the request type, intent name, slot values such as a child name or requested date, language or locale, session attributes, an Amazon user identifier, a device identifier, a request identifier, the Alexa API region endpoint, and an OAuth access token when your account is linked.
The Lambda function forwards the structured Alexa event to the School Ride API. The implemented integration does not receive or store the original voice recording. Amazon processes your spoken request and provides the structured request to the Skill. Amazon's handling of Alexa interactions is governed by Amazon's own notices and privacy policy.
School Ride may also process technical information associated with the request, such as timestamps, IP address, user agent, request outcome, error details, and limited diagnostic identifiers for security, reliability, and troubleshooting.
- Account and authorization information needed to identify the linked School Ride user.
- Child and family information already maintained in School Ride and authorized for that parent or guardian.
- Transportation, communication, payment, attendance, behavior, QR, story, and catalog information needed to answer the requested feature.
3. Account linking and tokens
Account linking is required for family information. The authorization page asks you to sign in with your School Ride parent credentials. Those credentials are sent through the School Ride web backend to the School Ride authentication service; they are not sent to Alexa by the School Ride website.
The linking website uses a secure, HTTP-only session cookie for the temporary sign-in session. The current implementation sets that cookie for up to 30 minutes. It is used for account linking and is not an advertising or analytics cookie.
After you approve linking, School Ride issues a short-lived authorization code and then access and refresh tokens to Alexa. Authorization codes are single-use and expire after five minutes. School Ride stores cryptographic hashes of authorization codes and tokens, together with connection status, approved scopes, locale, creation, use, expiration, consumption, and revocation timestamps. Raw tokens are not stored in the Alexa OAuth database tables.
Refresh tokens are rotated when used. Reuse of a consumed refresh token revokes the related token family. Access is rejected when a token is expired, revoked, associated with a revoked connection, or associated with an inactive School Ride user.
4. Information the Skill can access or change
The Skill only performs a feature when the linked account has the required scope and the parent or guardian is authorized for the applicable child and company. Depending on company configuration, family permissions, active services, assignments, and available operational data, the Skill may provide:
- The current or most recent authorized trip status for a child.
- Available bus or route status and an estimated arrival time when a reliable estimate exists.
- Reported absences and the creation of a one-day absence after an explicit confirmation.
- Pending or past-due school transportation payment totals.
- Active announcements, unread important updates, and unread company-message counts.
- Whether a published behavior update is available, without speaking sensitive note details.
- The number of times a child's QR profile was scanned on a requested date, without identifying the scanner.
- Available School Ride stories and information about external platforms where Leo's music is available.
- A family briefing that combines supported counts and recent information requiring attention.
6. Information Alexa is designed not to speak
The implemented Alexa responses are designed not to speak residential addresses, parent or guardian phone numbers, or the identity, device, IP address, or location of a person who scanned a child's QR profile. Behavior responses confirm whether a published update exists but direct the parent to School Ride for sensitive details.
Trip information is limited to authorized operational status and reliable estimates. The Skill does not provide a public map or unrestricted precise location through voice.
7. How we use information
School Ride uses information received through the Skill to authenticate and link accounts; understand and respond to Alexa requests; enforce family, company, child, and feature permissions; create a confirmed absence; maintain OAuth connection and security records; diagnose errors; prevent abuse; monitor service reliability; and comply with legal or operational obligations.
School Ride does not use Alexa Skill requests or child information for targeted advertising or sale of personal information.
8. Service providers and third parties
The Skill necessarily involves Amazon Alexa and Amazon Web Services. Amazon processes the voice interaction and sends the structured Skill request. AWS Lambda runs the Skill handler, and School Ride uses AWS cloud infrastructure for parts of its platform.
The School Ride API includes production monitoring and error-reporting integrations. When enabled and applicable, sanitized technical logs or error diagnostics may be processed by Better Stack and Sentry. Critical server errors may also generate restricted operational alerts through School Ride's configured alerting channel. These services receive only the information included by the implemented logging and error-handling paths.
The Skill may report the availability of School Ride stories or music on an external platform, such as Spotify, but asking Alexa about that availability does not cause School Ride to send your family record to that music platform.
9. Technical logs, security, and abuse prevention
School Ride records request and response status, request type, locale, timing, and diagnostic information to operate and protect the service. Authorization headers, tokens, passwords, cookies, session values, and other fields matching sensitive-data rules are redacted by the implemented logging paths. Error telemetry is also sanitized and truncates nested or oversized values.
No security control can guarantee absolute security. School Ride uses access controls, token expiration and revocation, one-time authorization codes, refresh-token rotation, request timeouts, client and redirect validation, API authentication, and HTTPS in the deployed service to reduce risk.
10. Retention
The linking session cookie expires after up to 30 minutes. Authorization codes expire after five minutes. Access and refresh tokens have configured expiration dates and may be revoked earlier. OAuth connection, token-hash, consumption, expiration, and revocation records may remain as restricted security and audit records after unlinking.
Other School Ride information is retained for as long as reasonably necessary to provide the service, maintain operational and safety records, prevent abuse, resolve disputes, comply with legal obligations, protect families, and support company or internal audits. Specific periods vary by information type, legal requirements, safety needs, and transportation-company policy. School Ride does not claim a single fixed deletion period for all Alexa or underlying School Ride records.
11. Unlinking Alexa
You can disable or unlink the School Ride Skill from the Alexa app through the Skill's settings. This stops Alexa from using the linked Skill. Where the School Ride app provides a connected-services control, you may also revoke the Alexa connection there. Revocation marks the connection as revoked and revokes its active access and refresh tokens.
Unlinking does not automatically delete the underlying School Ride parent, child, transportation, payment, communication, or company records. It also does not necessarily erase restricted OAuth security and audit records. To request deletion or correction, use the process below.
12. Access, correction, and deletion requests
School Ride accounts and official transportation records are managed with the participating transportation company. You are encouraged to request corrections or deletion through that company. You may also contact YCode Solutions LLC at legal@ycodesolutions.com or support@ycodesolutions.com.
School Ride may need to verify your identity and coordinate with the transportation company. A valid request may result in deletion or anonymization, subject to information that must or may be retained for legal, safety, operational, fraud-prevention, dispute-resolution, audit, or regulatory purposes.
13. Information related to children
The Skill is used by authenticated parents or guardians, but it processes information related to their children, including names, transportation assignments and events, absences, limited payment context, published behavior-update availability, and QR scan counts when needed to answer an authorized request.
Children do not create or link Alexa accounts through this Skill. School Ride uses child-related information to support transportation, safety, communication, attendance, service management, and the authorized features described in this policy—not for targeted advertising or sale of personal information.
14. Not for emergencies
Alexa responses depend on the latest information available to School Ride and may be delayed, incomplete, unavailable, or out of date. Do not rely on the Skill for emergencies, real-time safety decisions, or guaranteed arrival information. Contact the transportation company, school, emergency contact, or local emergency services as appropriate.
15. Changes to this policy
We may update this Alexa Skill Privacy Policy to reflect changes in the Skill, law, providers, or data practices. The current version and effective date will be published at this URL. Material changes may also be communicated through appropriate School Ride channels when required.
16. Contact
For privacy questions or requests, contact YCode Solutions LLC, Florida, United States, at legal@ycodesolutions.com. For product support, contact support@ycodesolutions.com.