Privacy

In short

• We ask for your name, your email address and a password. Nothing else — no phone number, no postal address, no date of birth.
• The photo you upload goes to Google to be read, and is kept here afterwards.
• Your calendar link is a secret address. Anyone who has it can read your child's timetable.
• Nothing is deleted on a timer. It goes when you delete it.

Who runs it

NxtBell is run by Stephen McInerney. To ask anything about this page, or to have something changed or deleted, write to hello@nxtbell.com.

We hold this because you asked us to turn a timetable into a calendar. Under the GDPR our lawful basis is that agreement with you — we hold what we hold in order to provide the thing you signed up for, and nothing beyond it.

What we hold

About you: your name, your email address, a scrambled form of your password, whether you are an admin, when the account was made and when you last logged in. That is the whole account; we also note failed logins and scans against it, described under How long we keep it. There is no phone number, no postal address and no date of birth anywhere in NxtBell.

Your email address is what you log in with, and the only thing we ever send you is a password-reset link, when you ask for one. There is no newsletter, no announcements and no marketing of any kind. We do not give the address to anybody.

About your child: the student's name and the school or college name; for every class the subject, teacher, room, day and times; the term dates, holidays and closures. We also keep a copy of what you uploaded and the reading the model gave back. For a photo that copy is the stripped-down version described below, with no location, camera or date left in it; for a PDF it is the file exactly as you sent it, metadata and all. We never ask for a photo of your child, their age or their address.

What goes to Google, and why

NxtBell cannot read a photo on its own. It sends it to Google's Gemini service, which reads the picture and sends back the classes. That happens only when a timetable or a school calendar is read, or when an admin tests the scanner (one line of text, no picture). Otherwise, the only things here that reach Google are uploading a photo, tapping Add to Google Calendar, and — if your own address happens to be a Gmail or Google Workspace one — the reset email arriving in your inbox, the same as any other email you receive.

We send the picture and a fixed instruction telling the model what to look for. Nothing else: not your name, not your email address, not your child's name, not the file name, not the cookie that keeps you logged in.

A photograph is never sent as it came off your phone. We decode it, turn it the right way up, shrink it and save it again, which drops the location, the camera and the date it was taken. A PDF is different: it goes exactly as you uploaded it, so an author name, a creation date or photos with location data inside it all travel with it. If that matters, send a photo instead.

Our key is on Google's paid Gemini API (a prepaid billed account), not the free tier and not the consumer Gemini app — the difference matters. Google's terms for the paid API say that what you send is not used to train or improve Google's models. Google may still hold it briefly to run the service and to check for abuse.

Those are Google's terms, not ours. We cannot see what Google does, and Google can change them. If the account ever stopped being a paid one, the free tier's terms would apply instead — they do allow Google to use the content — so this page would have to change with it.

Where it is kept

On a rented server at Hostinger, in France — so it stays inside the EU. Timetables are in a database there. Photos and PDFs sit in a folder beside the website, not inside it, so no web address reaches them; each gets a random name.

Hostinger runs the machine, so Hostinger can reach what is on it. Its web server keeps its own log of requests, which normally records the visitor's IP address and the address asked for — and for a calendar feed that address contains your private link. A password-reset link is deliberately built so that its secret part is NOT sent to the server at all, so reset links do not end up in that log. We cannot see those logs or say how long they are kept. [[Check with Hostinger and say.]]

Most nights a full copy of the database, of every uploaded photo and of the site's own settings file is taken to Stephen McInerney's own computer in Ireland. It runs on a computer that has to be awake, so a night is sometimes missed. About thirty are kept. The backup program does not encrypt the files itself, but the disk they sit on is encrypted (FileVault), and the folder is not copied on to iCloud, Dropbox or anywhere else.

When you reset a password: we store a scrambled form of the one-time link (never the link itself, so reading our database hands nobody a working one), when it was made, when it expires and the IP address that asked for it. The link dies in an hour or the first time it is used, whichever comes first, and the record is cleared out the next time that account asks for another.

We also keep one line for each email that leaves: the address it went to, what it was for, whether it arrived at the mail server and how long it took. No message body, and never the link.

How long we keep it

Nothing on the website is deleted on a timer. Things go when somebody removes them. The one exception is the backups, below.

• A photo that could not be read is deleted straight away.
• Otherwise a photo stays until you delete the timetable it belongs to.
• A saved calendar and its scan cannot be deleted in the app yet. Ask at hello@nxtbell.com and it will be removed by hand.
• Deleting an account takes its timetables, calendars and every stored photo with it.
• Anything already in a backup normally rolls off about a month later. A backup that failed part-way is kept aside instead, and those are never deleted automatically — they are looked at and removed by hand.

One thing is kept on purpose: the record of what each scan cost — the time, the model, the tokens, the price. It is the only bill there is, so it outlives the account that made it. It holds the account's number and, when a read failed, the reason Google gave. No photo, no name and no timetable.

Failed logins are noted, with the IP address and the address tried, so nobody can sit there guessing; every attempt to create an account is noted too, with the IP address only. A login that works is not noted. A note clears on the next successful login, or when a new password is set, and stays if neither happens. When an upload is refused, the error log records the file name you chose and its type — no IP addresses, no timetables, no pictures — and nothing trims that log.

Who can see it

You, when logged in. One account can never see another's: somebody else's timetable answers exactly as one that does not exist.

An admin sees the list of accounts — names and email addresses, who is an admin, when each was made and last used, how many timetables each has — and what the scanning has cost. The Admin page does not show anybody else's classes. It does carry a Set a password button on every account, though, so an admin can give themselves a way in to any account here.

Being straight about it: the person who runs NxtBell holds the server, the database password and the backups, so everything in it is within reach of Stephen McInerney. There is no technical barrier, and it would be dishonest to suggest one.

Your calendar link

Each timetable has its own address ending in .ics, made of thirty-two random characters. Your phone reads it to stay up to date. There is no login on it and no password — the address itself is the whole secret, the way a private Google Calendar address is.

So anyone you send it to can read the lot: your child's name, every subject, room and teacher, and the school's closures. The name is in the file name as well. Keep it to yourself, like a house key. If it goes astray, use Reset the link and the old address stops working at once. We count every time the link is read and show you the count.

Tap Add to Google Calendar and the link is handed to Google, whose servers then fetch and hold their own copy. On an iPhone you choose whether a subscribed calendar lives on the phone or in iCloud; choose iCloud and Apple's servers hold a copy too. We cannot see which you chose, and those copies are theirs, not ours.

Cookies and other companies

One cookie, called nxtbell. It holds a session number and nothing else. No script on the page can read it, another site cannot make your browser send it in the background or post to us with it, it is marked so the browser only sends it over https, and it lasts thirty days. Log out and it is cleared. If you are not logged in, no cookie is set at all.

There is no analytics, no advertising and no tracking pixel, and no other company's code on any page. Every font, script and image is served from this site, so simply opening a page here contacts nobody but us. The only thing saved in your browser's own storage is whether you chose the light or the dark theme.

How it is kept safe

• Passwords are never stored — only a scrambled form, re-scrambled as the standard moves on.
• Guessing is limited: too many failed logins from one address, and it stops answering for a while. A run of wrong guesses at your account slows further guesses, but it can never stop the right password working — otherwise anybody who knew your email address could lock you out on purpose.
• Resetting a password ends every session that account had, on every device. That is the point of it.
• Uploads sit outside the website under random names, and are judged by what is inside the file, not what it is called.
• Accounts are not open to the public. You need a join code.
• The site is served over https, and a plain http:// address is redirected to it, so a page here is always encrypted in transit.

No system is perfect, and this one is small and built by one person. Worth knowing before you put a term of a child's movements into it.

This is a child's information

A timetable says where a named child is at every hour of the week, in which room, with which teacher. We treat it as what it is: it is why we ask for so little, why one account cannot see another's, and why the calendar link tells you to keep it to yourself.

The account belongs to the parent or guardian, not the child. If you are under 16, ask a parent to set it up — in Ireland 16 is the age at which a person can agree to a service like this on their own.

Your rights, and getting it deleted

Under the GDPR you can see what we hold, correct it, have it deleted, get a copy to take elsewhere, and object to what we do with it or ask us to pause.

Most corrections you can make yourself: the student's name, the school, every class and every closure are editable here. Delete a timetable and its photo goes with it. A saved calendar has no delete button yet — ask and it will be removed by hand.

There is no button that deletes your whole account, and no export button — both are done by hand. Ask at hello@nxtbell.com and the account, its timetables, its calendars and every stored photo will be deleted, or a copy of it all put together for you. The one account that cannot be deleted this way is the admin's own — somebody has to be able to run the install. We answer within a month, and there is no charge. If you have forgotten your password you can reset it yourself from the login page; if that does not work, ask and a new password will be set for you. Deleting an account removes it, its timetables, its calendars, its photos and its reset links. The one-line record of an email having been sent is kept, and it holds the address it went to — say so in your request and it will be removed by hand as well.

If you think we have handled your information badly, tell us first. You can also complain to the Data Protection Commission, the supervisory authority in Ireland, at dataprotection.ie.

If any of this changes, this page and the date at the top change with it.