Privacy Policy

1. Our role: schools direct, NIX processes

NIX is a platform that schools use to run phone-free events and, where a school chooses, to support a phone-free school-day policy. A school decides to adopt NIX, configures how it works, and directs how student information is used within it. For the student records processed through NIX, the school is the data controller and NIX acts as a service provider (a “school official” under FERPA) carrying out the school's instructions. We do not use student information for our own purposes, and we do not sell it.

2. Information we collect

We collect only what is needed to run the Service for a school:

Students

• Full name and the school-issued student ID number used to identify the student at events and during the school day.
• A password the student sets to sign in to their account (stored only as a securely hashed value, never in plain text).
• Grade level, if the school provides it. We do not collect a student's date of birth.
• A recovery email address, so the student can reset their own password if they forget it. Students provide one when they register, and a school's roster import can also supply one. It is used only for password reset and account notices, never for marketing.
• Device location, used as described in Section 3.
• The phone's location settings, so the school can see whether checks will work: the location permission level, whether precise location, location services, background app refresh and notifications are on, whether battery saving could stop a check, and whether a test reading worked. The app sends these when the student answers the location prompt or opens the app, and when NIX wakes it in the background. Each report replaces the last. It never includes where the phone is: the test reading stays on the phone, and location itself is collected only inside the windows in Section 3.
• In the events experience, friend connections a student chooses to make with other students at their school.
• A device push-notification token, so the school can notify the student about events.

School staff (admins)

• Name, work email address, and a securely hashed password.
• When a staff member scans student IDs at an event, the scanning device's location at the moment of the scan (used to confirm the scan happened on site).
• If a staff member uses the NIX Assistant, their conversations with it: their messages, its replies, and the drafts and reports it showed them. Section 8 says how long we keep them.
• A device push-notification token.

School configuration

• School name, the campus boundary and time zone, bell schedule and no-school calendar, and (for the school-day model) classes and rosters the school sets up.
• The school's branding (logo and colors).

Walk-in students who do not use the app

Some events let staff scan a student's school-issued ID badge even if that student has no NIX account (for example, a printed coupon card). In that case we record only the school-issued student ID number and the event, so the school can issue the reward. The school remains the controller of those records.

Automatically

• Basic technical information needed to keep accounts secure and the Service working (for example, a device identifier used to deliver push notifications, and security and error logs).

NIX uses no advertising identifiers and no cross-app or cross-site tracking. The NIX app has no advertising or analytics tools. Our website, including the admin console, uses Vercel Web Analytics to count page visits. We do not collect contacts, photos library, health, or biometric data.

2A. Guests at events

Some schools and organizations open certain events to guests: people who are not their students. People 16 and over can take part with a driver's license or state ID. Taking part as a guest is optional. If you'd rather not, you can still come to the event. You just won't be signed up for its reward.

This section covers guests only. Guests are not students, and nothing this Policy says about students changes because guests exist. FERPA protects the education records of a school's own students, so it does not apply to guest records.

The organization running an event decides which of its events are open to guests and uses the record of who took part. NIX runs the guest account you create in the app and processes that record for the organization.

What we hold about guests

When you sign up as a guest, we hold:

• The name you type when you sign up. It is never read from your card.
• An email address and a password (stored only as a securely hashed value), so you can sign in and reset your password.
• A Guest number, such as Guest G-482137. It is made at random and is never taken from your card.
• A scrambled code made from your card, as described below.
• A record of the consent you gave on the sign-up screen: which version of that screen you saw, and when.
• Device location, used as Section 3 describes for events, to check whether your phone was away during an event.
• The events you took part in, whether your phone was away, and any reward you earned.
• A device push-notification token, so you can get notices about events.

Your card

Your phone turns your ID card into a scrambled code before anything is sent. NIX never receives your address, date of birth, or photo, or the card's barcode.

Your phone checks your date of birth to make sure you're 16 or older. If you're under 16, it stops, and nothing is sent.

We scramble that code again with a secret key before we store it, and the code is different at every school or organization. It is used only to recognize your card when staff scan it at the door, and we do not use it to link people across organizations.

The app reads the card on the phone. On iPhone it uses Apple's built-in camera framework. On Android it uses Google's ML Kit and Google's code scanner, which run on the phone. By Google's published disclosure these send Google metadata only (device, app, performance, and the size of the input and output), never the image or the barcode's content, and the version bundled in the app sends per-installation identifiers only, with no device identifier. They are closed source, so for this we rely on Google's statement.

At the door

Staff scan your card again on their phone, only when you hand it to them. Their phone makes the same code so they can check you in. Staff see your Guest number and whether your phone is away, and may also see the name you typed, shortened. Nothing else from your card is kept.

Kept apart from students

Guests are kept apart from students:

• A guest never appears in a school's student roster or in its exports.
• Guest accounts have no friend connections and do not appear on any leaderboard, so a guest cannot find, connect with, or be ranked against anyone through NIX.
• School-day features are for students only. Guests take part in events and nothing else.

Everything in Section 5 applies to guests too. We never sell guest information, never use it for advertising, and never build a profile of a guest.

Keeping and deleting guest information

We keep your guest account and your code until you delete your account. You can delete your account anytime in the app (Profile, then Delete account). Your code is deleted when you delete your account, or sooner if the organizer's guest sign-up ends.

Deleting your account also deletes the record of your consent, revokes your sign-in, and disables the account. What stays behind, and why, is on the account deletion page.

Who can sign up, and your requests

Guest sign-up accepts cards from some states only. The app tells you if yours can't be used yet, and you can still attend.

Guest sign-up is for people 16 and over. It is not offered to children.

Guests can make requests about their information directly to us at contact@nix.management. If a security incident affects guest information, we notify the affected guests as the law requires.

3. How location works

Location is the core of how NIX verifies that a phone was left behind. How and when it is used depends on how the school runs NIX, and the school controls this:

• Events model: location is checked around an event window to confirm, against that event's geofence, whether the phone was away from the event.
• School-day model: if a school adopts a phone-free school-day policy, NIX checks whether the phone is off campus during school hours on school days, against the campus boundary the school sets. On both iOS and Android, the app asks for background location permission, called “Always” on iOS and “Allow all the time” on Android, so the check can run while the app is in the background. Granting it does not mean location is collected all the time: it is collected only inside the school's check windows, described below. While a check is running, the Android app shows a permanent notification that says location is being shared. That notification has no stop button and neither does the app: an automatic check ends when the window ends. The student turns automatic checks off by changing the location permission in the phone's settings, which also stops collection. A student who has not granted background permission starts each check by hand instead, from inside the app or by tapping Arm on the reminder notification NIX sends before a window opens, and can stop that check whenever they like.

Checking starts before a window opens and ends 30 minutes after it closes, so a phone that arrives early or leaves late is still counted correctly. For the school-day model, checking starts up to 45 minutes before the school day. For the events model, it starts up to 90 minutes before the event, which covers travel and arrival.

For events, checking during that window does not depend on how close the student is to the venue. If a student has an event window open, their phone is checked wherever they are, including at home. We do this so a student who leaves their phone behind and arrives without it is still credited as phone-free; a check that only ran near the venue would fail exactly the students who did what we asked. Outside the window, nothing is collected.

Within those windows we are deliberately data-minimizing. The app's live location field keeps a single, overwriting reading, so there is no ongoing location history or trail. For the school-day model, what the school sees is a derived signal, not a map of where a student went: whether the phone was off campus, the time it was first detected on campus, the time it most recently left, whether it is on campus right now, and how many times it came onto campus that day. That last one is a count only. We do not keep the times of those individual crossings, so the school can see that a phone was retrieved and brought back, but not a timeline of the student's movements. All of it is cleared on the same schedule as the rest of the school-day record. For the events model, each check-in additionally stores a one-time location snapshot on that event's record, used to confirm the phone was away from the event; this snapshot is automatically deleted 90 days after the scan. A student can turn off location sharing in their device settings at any time; doing so disables phone-free verification.

On Android specifically, the app asks for the “Allow all the time” location permission so a check can run and resume without the student opening the app. Before Android shows that request, NIX shows its own explanation in plain words: NIX collects location data to verify your phone stayed off campus during school hours, or away from a school event, even when the app is closed or not in use. The student can decline, and the app still works.

Granting that permission does not widen when location is collected. Collection happens only inside a check window, and the windows are the ones described above: for the school-day model, school hours on a school day plus the 45 minutes before and 30 minutes after, so nothing is collected in the evening, at the weekend, on a no-school day, or over the summer. For the events model, the window is the 90 minutes before an event through 30 minutes after it ends. Because events are often held in the evening or at the weekend, an event window can fall at those times, and an event check does not depend on how close the student is to the venue. Outside a window nothing is collected on either model. While a check is running its notification is visible the whole time. An automatic check has no stop button: it ends when the window ends, when the student changes the location permission in the phone's settings, or when the account's sign-in is no longer valid. A check the student started by hand also stops whenever they stop it.

The reminder notification stays as a fallback. A student who declines background permission, or turns it off later, still gets the Arm button on the reminder NIX sends before a window opens, and their check runs only while they start it themselves. Location permission can be changed or revoked at any time in Android settings; doing so disables phone-free verification.

4. How we use information

We use the information above only to run the Service for the school: to create and manage accounts; to run events and verify phone-free participation; to support a school's phone-free school-day policy where adopted; to issue rewards to eligible students; to send school-related notifications; to provide the admin console; to bill the school; and to keep the platform secure, prevent abuse, and meet our legal obligations.

5. What we never do

We do not sell personal information. We do not share it with advertisers or use it for advertising. We do not build profiles of students for any purpose unrelated to running the school's use of NIX, and we do not track users across other apps or websites.

6. Service providers we share with

We share information only with the vendors that help us operate NIX, and only so they can perform services for us under contract:

• Neon: database hosting (stores the Service data described above).
• Vercel: website and API hosting, and website analytics that counts page visits; processes Service data in transit while requests are handled (it does not retain student data at rest).
• Resend: sending account and notification emails to staff.
• Stripe: processing a school's subscription payments. Card details go to Stripe and are never stored on our servers.
• Apple Push Notification service (iOS) and Google Firebase Cloud Messaging (Android): delivering notifications to devices.
• Anthropic: AI model provider for the NIX Assistant, the helper built into the staff admin console on the web and in the app. When a school admin uses the assistant, their messages and the earlier messages in the same conversation, plus the school-level event details and aggregate metrics the assistant looks up, are processed by Anthropic's API. NIX never gives the assistant individual student records, and the assistant declines questions about individual students, but an admin's messages contain whatever the admin types, which could include a student's name. The assistant can only read information and draft changes, and every change requires the admin's explicit confirmation before anything is created or modified. Under our agreement, Anthropic does not use this data to train its models. We keep assistant conversations in our own database for 7 days, as described in Section 8.

The current, named list of sub-processors is published at nix.management/legal/subprocessors.

We may also disclose information when required by law, to protect the rights and safety of users and the public, or to a successor in a merger or acquisition. Any successor remains bound by this Policy for the information it receives.

7. Children's privacy: COPPA & FERPA

NIX is built for schools, and many students are minors, including children under 13. NIX is intended to be adopted and directed by a school as part of the school's educational program. Under the Family Educational Rights and Privacy Act (FERPA), NIX operates as a “school official” with a legitimate educational interest, processing student information only under the school's direction.

Under the Children's Online Privacy Protection Act (COPPA), a school may provide consent for the collection of personal information from students under 13 for the use and benefit of the school's educational program, in place of individual parental consent. The school is responsible for providing any notices to parents and obtaining any consent that COPPA or FERPA requires. We collect from children only the limited information described in this Policy, use it only to provide the Service to the school, and never for advertising or any commercial purpose unrelated to the school's use of NIX. Parents may exercise their rights, including reviewing or requesting deletion of their child's information, through their school, and the school may direct us to delete it. Questions can also be sent to contact@nix.management.

The full child-specific disclosure lives in our Children's Privacy Notice.

8. Retention & deletion

We keep information for as long as a school uses NIX and as needed to provide the Service, meet legal obligations, and resolve disputes, after which we delete or de-identify it. When a school's account is suspended (14 days after a canceled or unpaid period ends, or 28 days after a semester or pilot term ends), the school's account and data are kept unchanged for 30 days (120 days for a semester or pilot term) so they can be restored, then permanently deleted, unless the school asks us in writing to keep its data longer.

How to delete your account

A student can delete their own account from the app (Profile → Delete account), or request deletion at nix.management/legal/delete-account. Deletion clears the account's stored location and the location snapshots attached to its past event check-ins, revokes its sign-in tokens, and disables the account. A school can also direct us to remove a student's information.

School staff accounts delete themselves: a principal, counselor, event manager or Staff scanning account uses Account in the app or in the admin console. A master admin at a school that has more than one can remove just their own login by stepping down to a sub-admin from Team, signing back in (Step down signs them out), and then deleting from Account. A school's last master admin either transfers ownership from Team first and then deletes their own account after signing back in, or deletes the school itself from Settings. The deletion page linked above sets all of this out step by step, and is also the route for anyone who cannot use the app or the console at all.

What is retained after deletion, and why

The school, not NIX, owns its student records, and NIX processes them as a “school official” under FERPA. After an account is deleted, we retain the student's name, school-issued student ID, any recovery email on the account, and the school's attendance and event participation records, for as long as the school uses NIX and needs them for its own records. We keep them only to serve the school, never for advertising, and never to sell. To have those school records removed, ask the school, which can direct us to delete them, and we will.

What the school-day model stores

As noted above, the school-day model stores derived signals (for example, “phone was off campus” and an on-campus timestamp) and a single overwriting location reading rather than a location history.

Automatic coordinate deletion

Raw location coordinates attached to an event check-in are automatically deleted 90 days after the scan, whether or not the account is deleted.

NIX Assistant conversations

We keep each message an admin sends the NIX Assistant, and the reply to it, for 7 days from when the message was sent, then delete it automatically. Keeping it that long lets a reply finish even if the admin closes the app or loses the connection, and lets the admin pick the conversation up again from History. A conversation is visible only to the admin who had it, while signed in to that school; no other admin at the school, including the master admin, can see it. An admin can delete a conversation at any time from History, and deleting the admin's account or the school deletes all of that admin's conversations. We use assistant conversations only to show them back to the admin and to continue the conversation. We do not use them to train AI models or for advertising. When the assistant cannot answer a question about how NIX works, we note that question so we can improve NIX's help, and delete the note after 7 days as well.

9. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit (TLS), hashed passwords, access controls, and a logged, append-only record of every staff view of an individual student record. No system is perfectly secure, but we work to protect information and will notify affected schools of a material breach as required by law.

10. Your choices & rights

Students can turn location sharing on or off in device settings, and can delete their account in the app or request deletion at nix.management/legal/delete-account. After deletion, the school keeps its own attendance and participation records, which it controls as described in Section 8. School staff can update or delete account and school information from the admin console. Because the school is the controller of student records, requests about a student's data are generally handled through the student's school; we will assist the school in responding. You can also contact us using the details below.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, and to opt out of its sale or of targeted advertising. NIX does not sell personal information or share it for targeted advertising, so there is nothing to opt out of. To make a request, email contact@nix.management (or, for a student record, contact the school). We will respond as required by applicable law.

11. Where NIX operates

NIX is offered to schools in the United States, and information is processed in the United States. The Service is not directed to individuals in the European Union or United Kingdom.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Effective” date above and notify schools where appropriate. Continued use of the Service after a change takes effect means you accept the updated Policy.

13. Contact

Questions, requests, or complaints about this Policy?

• Email: contact@nix.management
• Mail: NIX Development LLC, 12167 W Devis Rd, West Olive, MI 49460-9393, United States