Keeping a display safe

Embeds and screens are public by design — that is the job. What is worth understanding is exactly how much they are public, because it is less than people assume and in one respect more.

The address is the whole credential

Each display has one long random address. Anyone holding it sees that display; anyone without it sees nothing. There is no account, no password and no sign-in involved.

That has two consequences worth stating plainly:

Treat the address like a key. Pasted into a public web page it is public, which is fine for an embed and worth thinking about for a screen.

It grants only that display. The address opens what the display was scoped to and nothing else — not the timetable behind it, not your other displays, not your account.

A TV connected with a phone

A TV that you connect with your phone does not use the screen's address. The TV keeps its own private key in its browser. The key opens only the screen that you picked.

• Revoke also stops a connected TV. It shows "unavailable" until you switch the screen on again.
• Rotate secret does not affect a connected TV. It continues to show the board.
• Delete also disconnects every TV that shows the screen.

To stop one TV only, use Disconnect under Connected TVs. If a TV is lost or stolen, disconnect it. Its key then stops working.

Scope is enforced before the data leaves

A display narrowed to one class does not receive the rest of the timetable and hide it. The rest is never sent.

This is the part people expect to be a filter and are right to check: reading the page source of an embed scoped to one class will not reveal another class's teachers, because they were never in the response.

Withdrawing one

The row's More actions menu holds three ways out, for three different situations:

• Revoke switches the display off. The address stops working and can be switched back on later. This is the one you want for a screen that is coming down for the holidays. It does not free a slot against your plan — only deleting does.
• Rotate secret keeps the display exactly as it is and gives it a **new address**. The old one dies immediately.
• Delete removes it. The address is gone for good, and the slot is freed.

Either way, a visitor holding the old address gets a plain "unavailable" card — not an error, and no hint about what used to be there. An embed that has been withdrawn should look tidy inside someone else's page.

If an address has genuinely leaked, rotate the secret. You keep the display, its layout and its history, and the leaked address is dead within seconds. Deleting and rebuilding also works, but it throws away the configuration for no benefit.

What your plan changes, and what it does not

Plans set how many embeds and screens you can create. They also set how many activities one display can show.

An existing display keeps working when a paid period ends. It does not go dark, and you do not have to rebuild it.

If a timetable holds more activities than your plan allows, the display shows your plan's number and leaves out the rest. Placed activities come first, so the grid stays full.

The display itself says nothing about this, and a visitor cannot tell. The embed manager tells you, because you are the person who needs to know.

The branding also changes with the plan: your institution logo appears on every plan, while brand colours and removing the badge are paid.

The only thing that stops a display for good is deleting the timetable behind it.

Displays and your visitors' privacy

We add no analytics to a display. A display sends nothing to Google Analytics, Tag Manager or Clarity, and it shows no cookie banner. The same is true for the QR page at fetviewer.com/screen. An embed lives inside somebody else's website, so it does not carry our measurement into a page that is not ours.

Where to go next

• Embedding a timetable in your website
• Running a screen on a wall
• How sharing works — the account-side equivalent, for people who need to edit rather than watch.