NisabaCircle
Privacy
Effective 26 October 2026 · Version 2026-10-v3
What NisabaCircle stores, why, who can see it and how long it is kept. Everything below is taken from the software itself — the database schema and the services that read and write it — rather than from an intention.
Who is responsible for your data
NisabaCircle is operated by Maytham Al-Rubaye, an individual based in the United Kingdom ("we", "us"), rather than a company. We do not publish a postal address. If you need to send formal correspondence, email us first and we will reply.
Contact: privacy@nisabacircle.com for privacy and data requests, and support@nisabacircle.com for help.
Schools and us. Your school decides who may join, which groups exist, how long its records are kept (within our limits), and handles safeguarding reports. For the records your school creates and manages, the school is the data controller and we process them on its behalf. For running the service itself (sign-in, security, account deletion, support), we are the controller.
Who can use NisabaCircle
Only people invited by a school and approved by that school's administrator: staff, students aged 11 and over, and other adults the school approves. There is no public sign-up and no public directory. The software does not itself check a date of birth; the school is responsible for approving only people who may use it, and for obtaining a parent's or guardian's consent where the law requires it.
What is stored
| What | Why |
|---|---|
| Sign-in details: username or email address, password (stored only as a secure hash by our sign-in service), and for administrators a second sign-in factor | Signing in securely. Some accounts — students invited by their school, and an administrator who signs in with a username — have no email address, and none is created for them |
| Your display name | So people who may already see your account know who you are |
| Your school and group memberships — the role, the status, who decided it and why | Deciding what you can see, and keeping a record a school can answer for |
| Messages you send, in groups and one to one | Delivering them. Message bodies are stored; they are not end-to-end encrypted |
| Photographs and videos you attach — the file, its type, size and digest, and the result of scanning it | Sharing them with the people in that conversation |
| Call records — who called whom, when it started, when it was answered, when it ended, and how | A school's record that a call happened |
| Device registration for notifications (an encrypted push token for your phone) | To ring your phone for a call and tell you a message is waiting |
| Reports, blocks, safeguarding cases and evidence holds | To keep people safe and let your school act on concerns |
| Acceptance of our Terms and Conduct rules (which version, when) | To show you agreed before creating content |
| Account deletion requests and their status | To carry out deletion and show you its progress |
| Security records (sign-in sessions, audit entries of administrative actions) | To protect accounts and keep schools accountable |
Live calls are never recorded
No audio and no video from a live call is ever recorded, stored, transcribed or analysed. What a school keeps about a call is who, when, how long, and how it ended.
There is no recording feature to switch on, for anybody — not for a school, not for an administrator, and not for us. Voice and video in a live call travel through our call relay and media server only while the call is happening. Calls use relay servers so participants do not see each other's IP address.
That paragraph is about live calls only. A photograph or video you attach to a message is a different thing entirely: it is stored, scanned and kept, your school's administrators and safeguarding leads can review it inside a safeguarding case, and it stays for the retention period below. The next section is about those.
Photographs and videos you attach — these are stored
Unlike a call, an attachment is kept. The file itself is stored, not merely a reference to it, and it is subject to the retention period below, to your school's evidence holds, and to safeguarding review.
Only images and video are accepted — JPEG, PNG, WebP, MP4 and QuickTime, and nothing else; a file whose container is not recognised is refused rather than relabelled. There are no documents and no PDFs. A photograph may be up to 8 MiB; a video up to 64 MiB and five minutes. Every upload is scanned for malware before anybody can fetch it.
A video's duration is read from the file and kept as part of the record. The pixels and the audio are never decoded on our servers, analysed, or transcribed. Playing one on your phone decodes it on your phone, from a file in the app's own private storage, and produces nothing that is stored or sent anywhere.
Message and call notifications show a name
When a new message arrives, a push notification may show the sender's display name, the group name if it is a group chat, and a short preview of the message — the same kind of lock-screen notice other messaging apps show. For a photograph the preview is a short label such as “Photo”; for a video, “Video”. School names are never included.
The preview is taken from the stored message after our language filter has already replaced objectionable words, so a notification cannot show wording the conversation itself no longer carries. You can hide names and previews in your phone's notification settings (for example by turning off lock-screen previews or notification content).
A call notification shows who is calling — the caller's display name, and the group's name for a group call — and whether it is a voice or video call. It never includes a school name, a message or any call audio. You can hide names on the lock screen in your phone's notification settings.
The “typing…” indicator is not stored
While you type in a conversation, the other people who can see that conversation may see “typing…” beside its name, in the chat and in the chat list. It is a signal, not a record: it is held in the server's memory for a few seconds, is never written to a database, a log or a school's records, and is not sent to anyone you have blocked or anyone who may not see that conversation. What you type is not sent until you send it.
Who can see what
- The people in the conversation. A group's messages are visible to that group's members. A one-to-one is visible to the two people in it. Nobody else reads either as a matter of course — with one exception, which is the next point.
- The exception: safeguarding review. Your school's administrators and safeguarding leads can review content that has been reported, open a safeguarding case, and read the messages and attachments that case covers — including a one-to-one. This applies to any conversation at their school. A teacher cannot, whatever group they run.
- Administrators can see call records — who, when, how long, how it ended. Never any audio from the call, because none is ever recorded. A photograph or video attached to a message is a separate matter: those are stored, and a safeguarding case can show them.
- No public directory. Sharing a school is not sharing a group: you are only ever offered people you already share an approved group with.
- Schools are separated from one another. No school's administrator can see another school's records. This is enforced in the database.
- We (the operator) do not read your conversations as a matter of course. We may access data only where needed to run, secure or fix the service, or where the law requires it.
Service providers we use
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting our application, database, file storage and sign-in service | United States |
| Hetzner | Call relay and media server (live call routing only, nothing stored) | Germany |
| Apple (APNs) and Google (Firebase Cloud Messaging) | Delivering call alerts (caller name, group name) and message notifications (sender name, group name and a message preview) | Global |
| Resend | Sending account-deletion confirmation emails | Outside the United Kingdom |
| Cloudflare | Domain name service and receiving email to our @nisabacircle.com addresses | Global |
Application data is hosted on Railway in the United States. That is an international transfer from the United Kingdom. Call audio and video are routed live through a relay in Germany and are not stored. Where data leaves the UK, we rely on the provider's data-transfer safeguards (for example the UK International Data Transfer Addendum or adequacy regulations).
Our servers use your IP address briefly to deliver the service and limit abuse (rate limiting). We do not store it in our application database. Our hosting providers may keep short technical logs.
How long it is kept
Schools can configure retention periods of up to 24 months, and the software refuses anything longer. A school may configure a shorter period instead, down to one month. If your school has not configured one, the starting values below apply.
Automatic deletion is active. Scheduled cleanup runs and removes records when they reach the period below. Nothing is kept longer than the school's configured period, and never longer than 24 months from the record's own date — unless an ordinary legal hold is still in force. Specifically flagged safeguarding evidence is capped separately, below.
Where a period is measured from depends on the records. Each record is measured from its own date: a message from when it was sent, an attachment from when it was uploaded, a call from when it was placed, a safeguarding case from when it was opened, and a report from when it was filed — not from the chat it sits in, and nothing restarts the clock: sending another message, deleting one, or closing a safeguarding case does not extend it, and opening a case does not extend the life of the messages it is about. A school may configure a shorter period, which applies to the same dates. Other records are measured from their own points too: a sign-in or session record from when that session ended or was last used, and an account from when its last membership of a school changed. An attachment is given its own expiry when it is uploaded.
| What | If the school has not configured one | Maximum configurable period |
|---|---|---|
| Message content | 24 months | 24 months |
| Photographs and files | 24 months | 24 months |
| Call records | 12 months | 24 months |
| Sign-in and session records | 12 months | 24 months |
| Accounts after their last membership | 12 months | 24 months |
| Safeguarding records | 24 months | 24 months |
Safeguarding records are measured from their own dates, and that is worth being exact about. A case is removed this long after it was opened and a report this long after it was filed — each by its own date, not by the age of the conversation it is about. A school can configure a shorter period, up to the same 24-month ceiling as everything else. Closing a case or resolving a report changes nothing, leaving one open does not exempt it, and opening a case does not extend the life of the messages it is about. The scheduled cleanup does remove these records when it reaches them.
An evidence hold does not restart the clock. If your school selects a particular message, photo, video, call record or report as safeguarding evidence, that item is kept until the hold is lifted, or until 24 months after the record's own date, whichever comes first (12 months for a call record). Those items are hidden from everyone except authorised safeguarding staff at your school.
An ordinary legal hold — a hold without that specific safeguarding-evidence selection — works differently. It stops scheduled cleanup of what it covers until it is lifted or expires. A hold on a membership stops that person's account deletion until it is lifted. A hold on a conversation can keep a safeguarding case about that conversation past 24 months until the hold is lifted. That is the one circumstance in which "nothing is kept longer than 24 months" is not true.
Deleting your account
You can delete your account in the app (Profile → Delete my account) or from the account deletion page if you cannot sign in. Deletion removes your sign-in, profile, name, email address, devices and sessions, and the messages, photos and videos you sent. Specifically flagged safeguarding evidence stays, hidden from everyone except authorised safeguarding staff, and is deleted no later than 24 months after it was created (12 months for a call record). A legal hold on your membership stops the whole deletion until it is lifted. This is not anonymisation: the account row remains as an identifier with no name, and school records that remain still point at it.
Your choices
- Block someone. A block stops a one-to-one in both directions, and the person blocked is not told.
- Report a message, call or person. It goes to your school's safeguarding lead.
- Delete your account. What that does, exactly.
What we do not do
- No advertising, and no advertising identifiers.
- Nothing is sold, and nothing is shared with anybody for their own purposes.
- No analytics or tracking SDK is present in the application.
- No phone numbers are asked for or stored.
- No location is collected.
We do not claim end-to-end encryption. Data is protected in transit and at rest; message bodies are readable by the service, which is what makes safeguarding review possible. Notification tokens are encrypted at rest. Administrators use a second sign-in factor.
Your rights
Under UK data protection law you can ask to access, correct, delete or receive a copy of your data, and to object to or restrict some uses. For data your school controls, we will pass your request to the school or help it respond. Email privacy@nisabacircle.com. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Children
Students aged 11 and over use NisabaCircle only through their school. We design for them: no ads, no tracking, no public profiles, and no contact with people outside the school's approved groups. If you think a child is using NisabaCircle without the school's approval, contact your school or privacy@nisabacircle.com. Our child safety standards describe how we handle child sexual abuse and exploitation.
Changes
If we change this policy we will update the date above and, for important changes, tell you in the app. If the Terms change, you will be asked to accept the new version before creating new content.
Version 2026-10-v2 (7 October 2026) records that message notifications show the sender's name, the group name and a message preview, and that users can hide that content in their phone's settings. Version 2026-10-v1 described notifications as carrying no names.
Version 2026-10-v3 (26 October 2026) records that call notifications show the caller's name, the group name for a group call, and whether the call is voice or video, and that a “typing…” indicator is shown to the other people in a conversation and is not stored. Version 2026-10-v2 described call notifications as carrying no name.
Effective 26 October 2026 · Version 2026-10-v3.