Privacy Policy

1Who we are

Actually Here is operated by Selby Labs Pty Ltd (ABN 50 697 107 083), a company incorporated in Victoria, Australia, with its registered office at Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000.

Actually Here is a classroom attendance app for iOS and Android. An instructor creates a class; students join it with a class code; check-ins are proven cryptographically rather than confirmed by hand. This policy covers the mobile apps, the relay server they talk to, and this website.

2The law we work under

We are committed to protecting personal information and to complying with applicable privacy law, in particular:

• the Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme;
• the Privacy and Data Protection Act 2014 (Vic), as a Victorian company;
• the EU General Data Protection Regulation 2016/679, to the extent we process personal data of individuals in the EU, EEA or UK.

Where these are inconsistent, the more protective provision applies.

3How the design decides the privacy

Most of this policy follows from three facts about how the app is built, so they are worth stating before the lists.

The class key never leaves the teaching staff's devices

When an instructor creates a class, their phone generates a class key. Every event in that class (a student joining, a session opening, a check-in, a manual mark) is encrypted to that key before it leaves the device. Staff receive the key by having it wrapped to their own public key when they are promoted. It is never uploaded, never escrowed, and we hold no copy. If every staff device in a class is lost, that class's contents are unrecoverable, by us or by anyone.

Signing keys are generated in device hardware and cannot be exported

Each device generates its own signing keypair inside the Secure Enclave (iOS) or Android Keystore/StrongBox. The private key cannot be read out by the app, by us, or by anyone with the phone in their hand. We only ever see public key material, and only inside encrypted lines we cannot open.

Nobody has an account

There is no sign-up, no password and no email address anywhere in the product. Creating a class returns an opaque access token to the device that created it; joining a class returns another. The server knows those tokens only as one-way hashes, and knows nothing about the person holding one.

4What we hold on the server

This is the complete inventory. There is no other store, no database, and no analytics pipeline behind it.

5What never reaches us

The following are not withheld by policy. They are absent from the protocol, so there is no version of our server that could log them:

• Student names, student numbers, or any identity a student types into the app
• Email addresses, phone numbers, or postal addresses, for anyone at all
• Passwords or password hashes, since there is nothing to log in to
• The class key, or any private signing key
• Class names, session times, segment labels, attendance results or flags in readable form
• Location, contacts, calendar, photos, microphone or health data. The app requests none of these permissions
• Advertising identifiers or third-party analytics identifiers

6What stays on your own device

Most of what people would call "your data" lives on your phone and nowhere else:

• Your identity: the name and student number you typed once when you joined, held locally and bound to your device key.
• Your keys: generated in secure hardware, non-exportable.
• Your check-in record: which sessions you have already submitted for. This is what stops a double submission and what draws your personal attendance history.
• Staff devices additionally hold the class key and a decrypted cache of the class log, so the roll can be worked with offline.

Deleting the app deletes all of it. Leaving a class removes your membership from our server and wipes the class from your phone. Neither action can retract lines already appended to a class log, which is what makes an attendance record an attendance record; but nothing in that log identifies you to us.

7Who is responsible for class data

The instructor who creates a class, and the institution they teach for, decide what the class is for, who is in it and what happens to the attendance record afterwards. Under the Privacy Act and under GDPR they are the controller of that information.

Selby Labs stores and transmits that information as a service provider, a processor, and does so entirely in encrypted form. We do not decide how a class's data is used, we do not use it for our own purposes, and we could not do either if we tried.

If you are a student wanting to see, correct or remove your attendance record, ask the instructor who runs the class. They can read it; we cannot. See section 11.

8Where the data lives

Actually Here runs on one server, in Amazon Web Services' Asia Pacific (Sydney) region, ap-southeast-2. There is no second region, no replica in another country, and no content delivery network in front of it: your phone connects to that server directly. This website is hosted separately and carries no class data.

• At rest: the server's storage volumes are encrypted with AWS EBS volume encryption (AES-256).
• In transit: TLS 1.2 or higher on every connection, with certificates issued by Let's Encrypt.
• Additionally, at the application layer: every class log line is already encrypted end-to-end before it arrives, and stays that way on disk. Disk encryption is the outer of two layers, not the only one.
• Access: administrative access to the server is limited to Selby Labs personnel who need it to keep the service running. That access reaches ciphertext and access logs. It does not reach class contents, because there is no key on the machine to reach them with.

Because the server holds no identifying information about students or instructors, hosting it in Australia does not involve any cross-border disclosure of personal information about people outside Australia beyond the IP addresses described in section 4.

9Third parties

We do not sell, rent or share personal information. The complete list of outside parties involved in running the service:

We may disclose information where required by law, court order or lawful request from a government authority. What could be produced under such an order is what section 4 describes: ciphertext we cannot decrypt, token hashes, and up to seven days of access logs. We would have no way to comply with a request for the contents of a class.

If Selby Labs were acquired or merged, this information would transfer with the business, subject to protections no less protective than those set out here.

10Retention and deletion

• A class and its log persist for as long as the class exists. Attendance is a record; it is meant to survive the semester.
• Deleting a class is done by its owner from inside the app. It removes the entire class directory (log, membership list and class code) from our server. Deletion is immediate and permanent.
• Leaving a class removes your membership entry and kills the token immediately. Your phone wipes its copy of the class.
• Access logs are deleted seven days after they are written.
• Subscription records are kept while the subscription is live, and afterwards only as long as needed for financial and tax records.

11Your rights, and the honest limits of them

Under the Australian Privacy Principles you may ask for access to, and correction of, personal information we hold about you. Where GDPR applies you additionally have rights of erasure, restriction, portability and objection.

Those rights run into a design fact worth stating plainly: we usually cannot find "your" data, because nothing in our store is linked to you. A request naming a person cannot be matched against token hashes and ciphertext. In practice:

• Your attendance record: ask the instructor who runs the class. They hold the key and can read, correct, export or remove it.
• Your membership: leave the class from inside the app. That is the deletion, performed by you, with no request needed.
• Access logs: tell us the IP address and the day, and we will search the seven-day window and act on what is there.

Where the Privacy Act permits us to decline a request we cannot fulfil, we will say so and explain why rather than leave it unanswered. Requests go to the address in section 14; we respond within 30 days.

12Children

Actually Here is designed for tertiary teaching and is not directed at children. Where an institution chooses to use it with students under the age of consent in their jurisdiction, that institution is responsible for obtaining any consent required and for deciding whether the tool is appropriate. The app collects nothing from a student beyond the name and number they type, and that never leaves their phone in readable form.

13Data breaches

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988. If we become aware of a breach affecting information covered by this policy, we will assess it promptly and notify affected instructors, and the Office of the Australian Information Commissioner, where the scheme requires it, and in any event within 72 hours of becoming aware, so that institutions can meet their own obligations.

Because class contents are encrypted end-to-end, a compromise of our server would expose ciphertext, token hashes and recent access logs. We will describe honestly what was and was not exposed rather than reassure in general terms.

14Changes to this policy

We may update this policy. The version number and effective date at the top always identify the current one, and the current version is published on this page. Where a change materially reduces the protections described here, we will say so prominently rather than quietly reissue the document.