Privacy Policy

Last updated: 10 October 2026.

This Privacy Policy explains how School Bus Home ("we", "us"), operated by Erbacci LLC, collects and uses information. Contact: info@erbacciltd.com.

1. What the app does

School Bus Home checks your linked Ring entry camera or doorbell for a school bus during the time windows you define on school days.

• After-school window (always on). When the device reports motion or a doorbell press inside that window, the app retrieves up to three still images from Ring, determines whether a US yellow school bus is visible, and notifies you when a school bus is detected — and gives you a heads-up when no school bus has been detected by a time you choose.
• Morning window (optional — off unless you turn it on). The same check on the same school days, in the same timezone, on the same kind of still images. It is detection only: at most one "school bus seen this morning" note per day, with the local time it was seen. There is no expected-by time and no heads-up in the morning — a morning with no detection means nothing (the bus may stop out of the camera's view), so we never send one.

It is an arrival-awareness convenience — not a childcare, supervision, security, or life-safety service. It detects a school bus (a vehicle type), not people, and a detection is best-effort: a bus may stop out of camera view. Neither a detection nor its absence confirms that any person is or is not home, or where anyone went.

2. Snapshot classification — no video, no image kept in the app's storage

When a motion or doorbell event arrives inside one of your windows — the after-school window, or the morning window if you turned it on — we run one check on that event. A check retrieves up to three still image snapshots from your Ring device through the Ring Partner API, taken two seconds apart at the moment of the event, and sends each one straight to the classifier described below, stopping as soon as it can answer. (We take more than one because Ring's upload can lag and because a bus can be mid-turn or out of frame in the first picture.) There is one classification step and nothing else looks at the picture: no Amazon vision service screens it first, and no picture is filtered out inside AWS before the check. Both windows use exactly the same path, the same single step and the same discard-immediately rule; nothing extra is fetched, kept, or looked at for the morning.

The one step — "is this a US yellow school bus?" This step leaves the US cloud, so we describe it precisely rather than in general terms. We send the picture to vision.erbacciltd.com/schoolbushome/classify, and that address involves two hops:

• The public address is a reverse proxy running on a virtual server we rent from Contabo GmbH, a hosting company, in a data centre in Germany. That proxy ends the encrypted connection in order to forward the request, so Contabo's infrastructure is technically in a position to handle the picture unencrypted while it is passing through. Contabo is therefore an infrastructure sub-processor, and we name it as one in section 4. It performs no part of the analysis, retains nothing, and holds no account data.
• The analysis itself runs on two GPU servers that Erbacci LLC owns and operates, located in the United Arab Emirates, where the founder is based. Both run the same open-weights vision-language model (qwen3.5), from the same model file, and requests are load-balanced between them.

So for a US customer every picture we check travels out of the US cloud, through a data centre in Germany, to a machine in the United Arab Emirates — and only the answer comes back. The whole journey is over an encrypted, authenticated connection (HTTPS/TLS with a secret access key; the endpoint refuses any request that does not present one, answering 403). The only thing this step is asked is whether the picture shows a US yellow school bus, and the only thing it returns is that yes/no with a confidence value, plus a flag saying whether any vehicle was visible at all. It never identifies anyone: no faces, no ages, no names, no licence plates. The picture is written to disk at neither hop — it is held only for the moment the check takes and then discarded, and the logs there record the decision, a confidence value and a timing, never image data. If this step is slow (we wait up to 60 seconds), unreachable, or returns an error, the same question goes automatically to Amazon Bedrock running Anthropic's Claude Haiku 4.5 inside AWS, which answers instead; after 5 consecutive failures the app stops calling our servers altogether and uses Bedrock until it recovers, and for as long as that is the case the picture does not leave AWS.

Pictures that do not show a school bus are discarded immediately after classification — they are never written to file storage or to any database. When a school bus is confirmed, we keep that one picture, so you can see the evidence behind the alert: one image for the after-school window and, if you turned it on, one for the morning window. It is stored encrypted, is never public, and is deleted automatically after 31 days — the same horizon as the daily record it belongs to — or immediately when you delete your account. Alongside it we keep the derived result: a yes/no "school bus present", a confidence value and the timestamp. We do not access, request, or store any recorded video, media clips, live view, audio, or biometric data. No video is stored. We use no facial recognition and do not identify, describe, or track any person. The classifier is asked its one question about the one picture in front of it and nothing more: we do not use your images to train, fine-tune, or improve any model, neither the model on our own servers nor the model we call inside AWS when it answers instead. And those servers are ours: each picture is held there only for the moment the school-bus check takes and is not kept.

How many pictures this adds up to. We count our budget in checks (we call them vision attempts), and a check is not one picture — it is up to three. Each window has its own daily budget: 12 checks for the after-school window and 4 for the morning window, and each window stops for the day as soon as a school bus is confirmed. So a worst-case school day is around 36 still images from your camera with the morning window off (12 × 3), and around 48 with it on (16 × 3). Most days are far below that, because a confirmed bus ends the window and most checks stop at the first picture. To be precise about what those budgets are: they are spending limits, not a hard shutter. We count a check once it has finished, so if your camera fires a burst of events at once a window can run a few checks past its budget before the count catches up and closes it. Whatever the number, every one of those images is classified in memory and discarded — the retention table in section 5 does not change with the count.

School Bus Home needs a Ring device with cloud recording (Ring Protect) active so that a still image exists at the moment of the event; without it, the app tells you detection is unavailable for that camera rather than reporting a false result.

3. Information we collect

• From Ring (via account linking): your Ring account id and email, the OAuth tokens that authorize our account/device-metadata and image-snapshot API calls (stored encrypted), your devices' names/ids/types and online/offline status, motion/doorbell event metadata (device id, event timestamp, request id), and up to three transient still image snapshots per check at the event moment, each classified as described in section 2 (the school-bus answer is produced on our own servers, with Amazon Bedrock as the automatic fallback if they do not answer). Every snapshot that does not show a school bus is discarded immediately and never retained in any of our files or databases. The one snapshot that confirms a school bus is kept for 31 days so you can see the evidence behind the alert — at most one per window per day, encrypted, private to your account, and deleted at once if you delete your account. Section 5 sets out the retention in full.
• From you: your arrival schedule (after-school window start/end, expected-by time, active days of the week, timezone), the optional morning window's start/end and whether it is on (it has no expected-by time), and your notification preferences.
• If you asked to hear about future features: only the email address you typed into that form. It is used for that one purpose and nothing else — it is not added to a newsletter or a mailing list, it is never used to advertise anything, and it is never sold or shared. You can have it deleted at any time by emailing info@erbacciltd.com. That form is no longer offered in the app; any address collected while it was is held only until you ask us to remove it.
• From your device: push notification tokens (APNs/FCM), app/OS version, locale, a per-install identifier, and a browser timezone hint captured during account linking (used only to pre-fill your timezone). No advertising identifiers and no location data.
• We generate: daily school-bus-detection records — a boolean result, detection confidence, timestamps, and the classifier model name (no image bytes), plus, when the morning window is on, the time a school bus was seen that morning and its confidence, all on the same daily record — which expire automatically after 31 days — and diagnostic logs (labels, confidence, timing only — never image data).

We collect no information from or about children; your schedule describes your household's door, not a person.

4. How we use and share information

We use the data solely to check your windows for a school bus, deliver the notifications you enabled, and run your account. We do not sell or share personal information for advertising, and we do not use it to train AI models.

The third parties that receive data are: Amazon Web Services (hosting — the application, its databases, queues and the stored confirming image live there, and push goes out through SNS; AWS is shown a picture only when the Amazon Bedrock inference service answers the school-bus question as the fallback described in section 2), Anthropic (its Claude Haiku 4.5 model runs that fallback classification inside Amazon Bedrock — a sub-processor of that inference; it does not retain the image or train on it), Contabo GmbH (the German hosting provider whose rented virtual server runs the reverse proxy in front of our classifier described in section 2 — it carries the picture in transit and performs no analysis), Resend (email delivery), Apple/Google (push transport), and Ring (Amazon) (identity, event webhooks, and the still-image snapshot). The classification itself runs on servers Erbacci LLC owns and operates in the United Arab Emirates: that is not an outside company, but it is a processing location outside the United States, which section 8 sets out. We disclose information only where required by valid legal process.

5. Retention

6. Your rights & deletion

Delete your account and all associated data any time from Account → Delete account, or email info@erbacciltd.com. Removing the integration from your Ring app revokes our access immediately.

7. Security

TLS in transit, AWS-managed encryption at rest, HMAC verification on every Ring webhook, short-lived signed session tokens, and least-privilege IAM. The call to the classifier described in section 2 is also encrypted in transit (HTTPS/TLS) and authenticated with a secret access key, which the endpoint requires before it will answer at all. To be exact about what that encryption does and does not cover: the connection is terminated at the reverse proxy in Germany and re-established onward to the classifier servers, so the picture is protected against interception on the public internet, but it is not end-to-end encrypted from AWS all the way to the machine that analyses it.

8. Children & international

School Bus Home is not directed to children under 13. It is used by adults to receive notifications about their own home; it has no features for children, collects no information from children, and does not identify any person in the images it classifies.

School Bus Home is operated by Erbacci LLC, a company registered in Wyoming, United States, and the app is available worldwide; its Ring integration works with Ring devices in the United States. Its cloud systems run in Amazon Web Services' us-east-1 (United States) region: your account, credentials, schedule, notification settings, detection history and the confirming image are stored there and nowhere else.

One processing step crosses borders — the school-bus check described in section 2. That step sends the still image out of AWS, through a reverse proxy hosted in Germany, to the servers we own and operate in the United Arab Emirates, which return only a yes/no and a confidence value. No image is stored at either place. Because it is the only classification step, every picture we check is transmitted outside the United States for the moment that check takes — nothing filters pictures out inside AWS first. If those servers are slow, unreachable, or return an error, the answer comes instead from Amazon Bedrock inside AWS; while the app is using Bedrock, the picture stays in the United States. By using the app you consent to that transfer; unlinking the integration or deleting your account stops all processing immediately.

9. Contact

Erbacci LLC · info@erbacciltd.com