Privacy Notice

Courier — first public beta — 25 October 2026

1. Who this covers

Courier is one-way messaging software made by RSJ Software Ltd, a company registered in England and Wales. A school installs it on its own server. This notice describes what personal information Courier holds and where it goes. It covers:

• staff who have a Courier account (administrators and senders);
• people notices are sent to, such as staff or students in groups like “All Staff” or “Year 7”;
• people whose names appear in an audience list or in the text of a notice;
• people signed in on computers that run the RSJ Agent with the Courier module installed.

A school may adapt this notice for its own privacy information.

Data controller of RSJ’s own information: RSJ Software Ltd, a company registered in England and Wales (company number 17480568)
Registered office: 88 High Street, Turton, Bolton, BL7 0ER

2. What Courier stores

• Staff accounts: username, display name, role (administrator or sender) and whether the account is enabled. Passwords are stored only as a salted hash, so they cannot be read back.
• Sign-in records: a console sign-in lasts 8 hours. Courier also counts failed sign-ins by the network address they came from (an IP address): five failures block that address for a minute. The count is cleared when that address next signs in successfully.
• Notices and templates: title, text, who wrote it, when it was created and when it expires. Saved templates hold a name, title, text and expiry.
• Audiences: named lists of computers or people and which senders may use each one. A People notice stores the names that were typed or picked (people, or Active Directory groups), not a copy of the directory.
• Delivery and acknowledgement records: for each computer or person a notice reaches, the state of the notice and time-stamped events (received, displayed, acknowledged, failed). They record the computer and the signed-in user’s name.
• Computers and sign-ins: for each enrolled computer, an ID, its name, the RSJ Agent and Windows versions, the user currently signed in, the session type, whether Courier is installed on it, and when it was first and last seen. Courier also records which user was signed in on which computer and when that was last seen. The user is recorded as the Windows sign-in name the computer reports (such as DOMAIN\name), not as a directory identifier. Each computer’s machine key is stored as a hash.
• Module instructions: records of instructions to install or remove the Courier module on a computer, who authorised them, and the outcome.
• Activity log: the time, who did something, and what they did (for example, that an audience was changed).
• Settings: including the retention period and directory settings.
• Secrets: the Active Directory read-only account (username, server and an encrypted password) and, if used, the update token, both encrypted. The agent secret is also held by the server.
• Log files: a troubleshooting log on the server. It records service events, errors and update checks, and can include administrator usernames, computer identifiers and the network address of a refused request. We have not found notice text in it.

The text of notices is written by the school, so it may contain any personal information the school chooses to put in it.

3. Where it is stored

Everything is stored on the school’s own server, in %PROGRAMDATA%\RSJ Software\Courier\Data (logs are in its logs subfolder). Windows access to this folder is restricted. Upgrades and uninstalling keep this folder. Backups are the school’s responsibility.

4. What leaves the school

• To the school’s own computers: notices go to the RSJ Agent on each computer over https, and receipts come back. This stays within the school’s network.
• To the school’s own directory: if Active Directory groups are used, Courier reads group membership through the read-only account the school provides.
• To GitHub: when an administrator checks for or installs an update, or if automatic updates are switched on (off by default, run nightly at 03:00), the server contacts GitHub. GitHub sees the server’s address, under GitHub’s own terms. The public Beta and Stable channels need no token. A token is used only to read a private channel; it is made from a GitHub account, so it identifies whoever created it. We send nothing but the ordinary request for the release information and the installer.
• To RSJ: nothing. Courier has no telemetry and no licence key or licence check, and notices, recipients and delivery records are not sent to us. The RSJ Agent talks to the school’s Courier server; we found no address for RSJ in it.
• Support: if a school chooses to send us logs or other files, they may contain computer and user names. We will use them only to help that school and will delete them after 30 days.

If we ever add usage reporting, this notice will change first. It will not include notice text or the names of recipients.

5. How long it is kept

Notice history is kept for the period the school sets under Settings > Retention (the default is one year). Courier clears expired history daily. The clean-up removes notices and their delivery records, delivery and receipt events, and the records of which person was signed in on which computer once no notice in history refers to them.

Some things follow different rules:

• Activity log: the latest 1,000 entries are kept, whatever the retention period.
• Module instructions: kept until the school removes the data folder.
• Log files: kept in a rotating set of at most four files of 2 MB each.
• Console sign-ins: 8 hours. Failed sign-in counts: see section 2.

Uninstalling Courier does not delete the data folder. The school must delete it if it wants the data gone.

6. Roles: the school and RSJ

• The school is the data controller for what Courier holds. It decides who has accounts, what notices say, who receives them and how long history is kept. It needs a lawful basis for this, and must tell its staff, students and parents about this processing.
• RSJ supplies the software and has no access to the school’s data. While the data stays on the school’s server, RSJ is not a processor of it. If that ever changes, we will set out the position in writing, with a data-processing agreement, before it does.
• RSJ is a controller only of its own information, such as emails sent to hello@rsjsoftware.com and the information on our website and licensing records.
• An IT support company that runs Courier for a school acts for that school.
• GitHub is separate from both of us and has its own terms.

7. Security

• The console is https only. It can be opened from the school network, behind sign-in, and an administrator can limit it to listed addresses.
• The first administrator account can be created only from the server itself.
• Passwords and machine keys are hashed, and the directory password and update token are encrypted for the Courier service.
• Repeated failed sign-ins are slowed down.
• The service runs as Local Service, and the data folder has restricted Windows access.
• Courier’s installers and updates are signed.

Courier is an early build and production hardening is not finished. The school is responsible for its server’s security, its accounts and the agent secret. Courier is not an emergency system, and delivery is not guaranteed.

8. Rights and contacts

Individuals have the usual UK GDPR rights: access, correction, erasure, restriction, objection and, where relevant, portability. Because the school is the controller, requests should go to the school, to its data protection lead or DPO. RSJ cannot see the data and will pass on any request it receives.

Questions about this notice: RSJ Software Ltd, hello@rsjsoftware.com. Complaints can be made to the Information Commissioner’s Office (ico.org.uk).

The terms for using Courier are on the Terms of use page.