Children's Privacy Notice

1. Who is the operator?

NIX Development LLC is the operator responsible for personal information collected from children through the Service.

• Email: contact@nix.management
• Mail: NIX Development LLC, 12167 W Devis Rd, West Olive, MI 49460-9393, United States

2. What we collect from children

NIX is deployed by schools, and we deliberately collect the minimum needed to verify phone-free participation:

• First and last name, to tie participation to the right student.
• School-issued student ID number, the student's existing school badge number.
• A login password, stored only as a one-way cryptographic hash (scrypt).
• A recovery email address, provided at registration or by the school's roster import, used only for password reset and account notices. Never used for marketing.
• Device location: a single, current location reading (latitude and longitude plus accuracy), used only to compute whether the phone is inside or outside the school's geofence. This reading overwrites itself, so we do not build an ongoing location history or movement trail. In the events model, each event check-in additionally stores a one-time location snapshot on that event's scan record, used to confirm the phone was away from the event, which is automatically deleted 90 days after the scan.
• Push-notification device token, a device identifier used only to deliver app notifications (for example, “a new event is available”). Not used for advertising.

In the school-day model, the only records we store about a child are derived signals: a per-day “phone off campus: yes/no,” and, if the device is detected inside the campus geofence during school hours, a single per-day summary of that. The summary holds the time the phone was first detected, the time it most recently left campus, whether it is on campus now, and how many times it came onto campus that day. The count is a number only: we do not store the time of each individual crossing, so a school can see that a phone was retrieved and brought back without getting a timeline of the child's movements. We do not store the underlying coordinates or any path.

We do not collect from children:

• Date of birth or age.
• Photos, video, or audio. (When a school ID badge is scanned, the camera reads only its barcode value, and no image is taken or stored.)
• Contacts, messages, or biometric data.
• Persistent identifiers used to track the child across other apps or websites.
• Any advertising identifier (no IDFA, no tracking).

When location is collected

Location is only read inside a collection window: school hours on a school day, plus the 45 minutes before and the 30 minutes after, or a school event, plus the 90 minutes before it and the 30 minutes after. Outside those windows the app reads nothing. That is true on both iOS and Android, and it does not change based on any permission the child grants.

Inside an event window, the check does not depend on how near the venue the child is: their phone is checked wherever it is, including at home. This is so a child who leaves their phone behind still gets credit for it. School-day checking is different, and only looks at the phone near campus. Outside a window, neither collects anything.

Background permission

To read location inside those windows without the child having to open the app each time, both apps ask for background location permission, called “Always” on iOS and “Allow all the time” on Android. Before Android shows that request, the app explains in plain words what it is for: NIX collects location data to verify your phone stayed off campus during school hours, or away from a school event, even when the app is closed or not in use. A child can decline it, or turn it off later in device settings, and turning it off is what stops automatic collection. If they decline or turn it off, NIX sends a reminder notification before each window with an Arm button the child taps to start that check by hand, nothing is collected until they tap it, and they can stop that check whenever they like. Whenever a check is running on Android, a notification is visible the whole time; an automatic check carries no stop button and ends when the window ends.

Background permission changes when the app may read a location, not what we keep. What we keep is unchanged: one overwriting reading, derived signals, no history, and no path.

3. How we use children's information

Only to operate the Service for the school: to verify phone-free attendance and compliance, to issue the school's rewards to eligible students (events model), to show the student their own status and history, and to keep the Service secure.

We do not use children's information for behavioral or targeted advertising, for building any profile outside the educational purpose, or to sell or share for any third party's commercial purposes. The NIX app has no advertising or analytics tools. Our website, including the admin console, uses Vercel Web Analytics to count page visits.

4. Who we share it with

Only the service providers needed to run NIX: database hosting, app and website hosting, website page-visit analytics, push delivery, and (for school staff only) email and payment processing. Each is contractually bound to use the data only as we direct, to keep it confidential and secure, and to comply with COPPA. The current list is published at nix.management/legal/subprocessors. We also disclose information to the child's school (which directs the deployment) and when required by law.

5. School-authorized consent

NIX is offered to children only through a school. Under the FTC's guidance on school authorization under COPPA, the school or district acts as the parent's agent and provides consent on the parent's behalf, because all of the following are true and NIX commits to them:

1. Educational/operational purpose only. Children's information is collected solely for the use and benefit of the school, never for advertising, marketing, or profiling outside the Service.
2. School authorization. The school has reviewed NIX's practices and authorized the collection (via the signed Student Data Privacy Agreement).
3. Parental notice through the school. The school provides notice to parents, typically through its annual FERPA notice or technology-use policy, which names NIX (or “third-party service providers acting as school officials”).

Under this arrangement the school is the data controller for the child's education records; NIX is a service provider acting as a FERPA “school official” (34 CFR § 99.31(a)(1)(i)(B)) and uses the data only under the school's direction.

NIX does not offer a direct-to-consumer signup for children; there is no path for a child to use NIX without a participating school. We therefore rely on school authorization rather than collecting verifiable parental consent directly.

Some events are also open to guests who are not students. Guest sign-up is for people 16 and over. It is not offered to children, and it needs the person's own driver's license or state ID.

6. Parent rights

Parents may review, correct, or delete their child's information and may refuse further collection. Because the school controls the records, please contact your child's school first; the school will direct us and we will act within the timelines in our data privacy agreement (deletion within 30 days of a school request). You may also contact us at contact@nix.management and we will coordinate with the school. A student can also delete their own account in-app at any time, which immediately removes their location, revokes their device token, and disables their login.

7. Retention and deletion

We keep a child's information only as long as needed for the school's purpose, then delete or de-identify it. The live location reading is overwritten, not accumulated; per-event location snapshots recorded during events-model check-ins are automatically deleted within 90 days of the scan. On a school's request we delete within 30 days. When a school's engagement ends, its account is suspended 14 days after its paid period ends, or 28 days after a semester or pilot term ends. Its data is then kept for 30 days (120 days for a semester or pilot term) and deleted after that, unless the school asks us in writing to keep its data longer, and subject to any longer period the law requires.

8. Security

We protect children's information with encryption in transit (HTTPS/TLS), encryption at rest, hashed passwords, role-based access controls, rate limiting on login, and an append-only audit log of every staff view of a student record.

9. Changes

We will not materially change how we handle previously collected children's information without new authorization from the school (or parents, as applicable). We will give at least 30 days' notice of prospective changes through the school.

10. Contact / FTC

• Email: contact@nix.management
• Mail: NIX Development LLC, 12167 W Devis Rd, West Olive, MI 49460-9393, United States
• The FTC enforces COPPA: ftc.gov