Nib Privacy Policy

1. Who we are

Nib is operated by Syed Khairi, an independent developer based in London, United Kingdom (referred to as “Nib”, “we”, “us” or “our”).

2. Who is responsible for assessment and student information?

Schools, colleges, other educational organisations and teachers decide why student information is entered into Nib and how it is used. They will normally be the data controller for that information. Their privacy notice should explain their lawful basis, retention period and how students, parents or guardians can exercise data protection rights.

Merely installing or using Nib does not send assessment content to us. We are the controller for the limited information for which we decide the purposes and means of processing, such as support correspondence and information needed to administer the app and its subscription entitlement. If we enter a separate written agreement with an organisation under which we process information on its behalf, the responsibilities in that agreement also apply.

If you are a student, parent or guardian and your information is in Nib, contact the relevant teacher or educational organisation first. Because local records and private iCloud databases are not visible to us, we will usually be unable to locate or change that information ourselves.

3. Information handled by Nib

Nib’s on-device recognition features may suggest a student-name match, detect page regions or recognise text. They do not make solely automated decisions that have legal or similarly significant effects. A teacher remains responsible for reviewing the source material, marks and any suggestions.

4. Where information comes from

Information may come directly from the user; from documents, lists or media the user imports; from the educational organisation that manages the device or assessment; from people collaborating through iCloud; from on-device recognition; or from Apple when the user enables iCloud features or makes an App Store purchase.

If a user adds information about another person, including a student or colleague, that information is obtained indirectly. The user and their organisation are responsible for ensuring that they have authority to add it and for giving the person any privacy information required by law.

5. Purposes and lawful bases

For the limited processing for which we are the controller, we rely on the following UK GDPR lawful bases:

Where a school or another organisation is the controller of student or assessment information, that organisation selects its own lawful basis. It must also identify an Article 9 UK GDPR condition before processing any special-category information. Nib is not designed to infer special-category information, but imported scripts or feedback may contain it; users should avoid adding it unless necessary and lawfully authorised.

6. Local processing and on-device intelligence

By default, Nib stores its database, documents, settings and generated material on the device in the app’s storage. Apple platform sandboxing and device data-protection features apply.

Page-region detection, optical character recognition and name-matching logic run within the app using Apple frameworks. Nib does not automatically upload assessment pages or recognised text to us for artificial-intelligence or machine-learning processing.

The optional “Layout Training Data” feature creates a file locally only after the user enables the setting and chooses Export. The user then chooses where to send the file through the system share sheet. Enabling the setting alone does not upload anything, and exported files may contain page images and labelled regions. Users must inspect the export and have authority to disclose it before sharing.

7. iCloud sync and collaboration

iCloud Sync is off by default. If the user turns it on, Nib stores relevant app data in the private CloudKit database associated with that user’s Apple Account so it can synchronise across devices. Apple states that private-database content is owned by and accessible to the user by default and is not visible in the developer portal.

If the user creates or accepts a collaboration, the shared records and assets become available to the invited participants with the permissions shown in the app or Apple sharing interface. Shared material can include student and assessment content, marks, annotations, voice notes, collaborators’ display names and activity attribution. A share owner should invite only authorised people, review permissions and stop sharing when access is no longer required.

Apple encrypts third-party app data stored in iCloud in transit and on its servers. The precise protection for shared content depends on Apple’s service configuration and the participants’ iCloud security settings. See Apple’s iCloud data security overview, iCloud Terms and Privacy Policy.

8. Microphone and speech recognition

Nib asks for microphone access only when the user starts dictation or another audio feature. On supported newer systems, transcription may occur on the device. On other systems, Apple’s speech-recognition service may process live audio under Apple’s terms and device settings. The resulting text becomes part of the marking feedback if the user keeps it. The user can stop recording at any time and can withdraw microphone or speech-recognition permission in device Settings.

9. Purchases

Subscriptions are offered through Apple’s App Store and processed using StoreKit. Apple handles billing, payment details, refunds and the user’s Apple Account. The app uses signed transaction and subscription-status information to decide whether unlimited assessments are available. Apple may provide developers with subscription reporting as explained in its App Store & Privacy notice.

10. When information is disclosed

Information may be disclosed to:

• Apple, when the user uses iCloud, CloudKit sharing, speech recognition, the App Store or StoreKit;
• people the user authorises, including invited collaborators and recipients selected through AirDrop, Files, email, printing or the system share sheet;
• the user’s employer or educational organisation, particularly on a managed device or when work is stored or shared using an organisation-controlled Apple Account;
• our email and professional service providers, only as needed to handle support, complaints, security, accounting or legal matters; and
• courts, regulators, law enforcement or other parties where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.

We do not sell personal information, use it for third-party advertising or permit advertising or analytics services to collect assessment content. The public Nib website uses Cloudflare Web Analytics to measure aggregate page views and performance without analytics cookies or behavioural profiles. Nib app records, student work and assessment content are not sent to this website analytics service.

11. International transfers

Local-only app content remains on the user’s device, subject to any device backup or management chosen by the user or their organisation. Apple and other recipients selected by the user may process information in the United Kingdom and other countries. Their own privacy information describes their locations and safeguards.

If personal information for which we are the controller is transferred outside the UK, we use an applicable UK adequacy regulation, an approved contractual safeguard together with the required data-protection assessment, or another lawful transfer mechanism. Schools and other controllers should assess the terms and international-transfer arrangements of iCloud and any export destination they choose.

12. Retention and deletion

Before disposing of a device, leaving an organisation or ending a collaboration, users should export any records they lawfully need, delete material they no longer need, allow iCloud changes to synchronise, and review Apple Account and device-backup settings.

13. Security

Nib uses Apple platform storage, sandboxing, code signing, iCloud account controls and CloudKit permissions. Private iCloud records are not visible in the CloudKit developer portal. Collaboration is limited to the share’s participants. No method of storage or transmission is completely secure, so users should also protect their device and Apple Account, use appropriate passcodes and multi-factor authentication, maintain authorised backups, and avoid exporting student information to unsuitable destinations.

14. Children and educational use

Nib is designed for teachers and other authorised adults, not for children to create accounts or use independently. It nevertheless processes children’s information when an authorised user adds assessment records. Nib does not use that information for advertising, behavioural profiling or its own product-training purposes.

Educational organisations should apply data minimisation, provide age-appropriate privacy information, establish an appropriate lawful basis, control access, set retention periods and complete a data protection impact assessment where required. A child’s rights should be exercised through the organisation responsible for the assessment data.

15. Your data protection rights

Depending on the circumstances and lawful basis, UK data protection law may give you rights to be informed; request access to your personal information; correct inaccurate information; request erasure; restrict processing; receive certain information in a portable format; and complain about how information is used. You may also withdraw consent where processing relies on consent, without affecting earlier lawful processing.

Rights are not absolute and exemptions may apply. We may need to verify identity and authority before acting. There is normally no charge, and we aim to respond within one month.

For assessment or student records controlled by a school or another organisation, send the request to that organisation. For information controlled by us, email help@mynib.app. If the information exists only on your device or in your private iCloud database, we cannot retrieve it for you; use Nib’s edit, export and deletion controls and your Apple Account settings.

17. Complaints

To make a data protection complaint, email help@mynib.app with the subject “Nib data protection complaint”. We will acknowledge receipt within 30 days, make appropriate enquiries without undue delay, keep you informed where appropriate and tell you the outcome.

You may also complain to the UK Information Commissioner’s Office. See the ICO’s data protection complaints service or call 0303 123 1113. We would appreciate the opportunity to address the concern first, but this does not affect your right to contact the ICO.

18. Changes to this policy

We may update this policy when Nib’s features, service providers or legal obligations change. We will update the date above and, where a change is material, provide an appropriate notice in the app, on the policy page or through the App Store.

19. Contact